Research on Feature Construction for Polymorphous Clone of Distributed Reflection Denial of Service Attack Traffic
Chanjuan Zhang, Xiaorui Gong, Zhenyu Song · 2018
Polymorphous clone of Distributed Reflective Denial of Service Attack traffic has great significance for DRDoS's demonstration, verification, defense, evaluation and scenarios that require DRDoS attack traffic.This paper studies a construction method of features in polymorphous clone of DRDoS attack traffic.Based on knowledge of information entropy and mutual information, traffic features were established from two perspectives of the content and statistical properties for clone of DRDoS attack traffic.It used a machine learning algorithm called Apriori, the filter feature selection and the wrapper mode of Random Generation plus Sequential Selection.By analysis of the NTP Distributed Reflective Denial of Service attack traffic which were collected and as the sample traffic, a feature set including 27 features are used as the attack traffic's features.