Two-Stage DDoS Mitigation with Variational Auto-Encoder and Cyclic Queuing
Ryo Yaegashi, Erina Takeshita, Yu Nakayama · 2022
Distributed Denial-of-Service (DDoS) defense mechanisms have been a significant research issue in network security. A wide variety of DDoS defense strategies have been introduced such as machine learning based approaches. Among them, the cyclic queuing based approach is a promising solution for mitigating flooding attacks with resource-limited devices at a network edge. Attacking flows are detected via the cyclic queuing, i.e. repeated reconfiguration of queue mappings, with the variation of the current queue sizes as metrics. However, continuous reconfiguration during normal operation periods is computationally intensive and increases power consumption. To address this problem, this paper proposes a two-stage mitigation scheme with variational auto-encoder (VAE) and cyclic queuing. With the proposed scheme, an edge node such as a layer-2 switch first detects anomaly with VAE, and then high-rate malicious flows are identified with the cyclic queuing algorithm. The key idea for improving detection speed is to narrow down suspected flows with the history of queue sizes around the anomaly detection. The performance of anomaly detection with VAE was evaluated with open datasets. Then, the performance of the proposed algorithm was confirmed via theoretical analysis and computer simulation.