Research on DDoS Attacks Detection Based on RDF-SVM
Chenguang Wang, Jing Wen Zheng, Xiaoyong Li · 2017
DDoS attacks bring huge threaten to network, how to effectively detect DDoS is a hot topic of information security. Currently, there are some methods designed to detect DDoS attacks, but the detection rate of them is low. Moreover, DDoS detection is easily misled by flash crowd traffic. In this paper, a new method to detect DDoS attacks based on RDF-SVM algorithm is proposed. By considering the importance of feature selection in DDoS attacks detection, the RDF-SVM algorithm is designed to exploit random forest to compute the feature importance and SVM to rescreen the features, which will prevent from removing features mistakenly. Finally, an optimal feature subset is obtained, which will reach a higher detection rate and recall rate. In this paper, two kinds of datasets are used to train and test. The experimental result shows that the RDF-SVM algorithm can select the optimal feature subset over KDD99 dataset, and can also distinguish between DDoS attacks traffic and normal traffic (Flash Crowd) over the DDoS dataset collected from real environment. Compared with the CART, Neural Network, Logistic Regression, AdaBoost, and SVM method, RDF-SVM algorithm has a higher detection rate and recall rate.