An Improved Mean Shift Clustering Algorithm for LFA Detection
Wenyue Sun, Changda Wang · 2021 IEEE 21st International Conference on Software Quality, Reliability and Security Companion (QRS-C) · 2021
Link flooding attack (LFA) is considered as a new class of DDoS attacks. Traditional DDoS attacks against end nodes, while LFA focuses on target links in the network. LFA is difficult to detect because of large-scale legitimate low-speed traffic flow. In this paper, we propose an improved weighted Euclidean distance Mean Shift algorithm named TD-MS(Time-Delay Mean Shift) and the decision feature PTIof the LFA detection based on Poisson process for TD-MS. The Weighted coefficient and the decision feature are obtained from the delay rate and the probability of the incremental LFA packet time, respectively. We constructed the software-defined-network(SDN) experimental environment to collect LFA packets through forwarding decisions made by the control plane on the data plane. We first cluster the network traffic flow based on the delay feature of network traffic flow while LFA happening, and then on which verify the existence of LFA according to the decision feature generated from such clustering results. The experimental results show that, the TD-MS algorithm outperforms the existing machine learning methods such as Decision Tree (DT) and Bernoulli Naive Bayesian classifier (BernoulliNB)in the light of both accuracy and efficiency.