Traffic Classification and Attack Detection Based on Flow Inspection over Data Link Layer
Qinglian Zhang, Zhuo Sun, Jingjing Li · 2021
This paper presents a DDoS attack detection method in VSAT satellite system. Different from the traditional way of analyzing traffic and attack behavior on the view of application layer or network layer, this paper explores the relevant characteristics of traffic behavior from the perspective of data link layer, screens them according to the information gain of characteristics, and selects the appropriate characteristics as the input of random forest model to recognize attacks. On the premise of identifying the basic data application types, Dynamic Time Warping index is used to measure the similarity between different application traffic. Normal traffic streams and DDoS attack streams are distinguished according to obvious differences of jitter and delay. Experiments show that the adaption capability of proposed method on traffic classification and attack detection are satisfied.