SequenceShield: A Robust and Accurate DDoS Detection Method via Serializing the Traffic with Direction Information
Zeyi Deng, Wei Yang, Minchao Xu, Meijie Du, Yuzhen Li, Zhou Zhou, Qingyun Liu · 2022
Distributed Denial of Services (DDoS) attacks continue to be one of the most challenging threats to the Internet. Previous methods try to reveal the pattern of attacks by using artificially selected statistical features or header fields of network packets. However, they suffer from low accuracy and are not robust in the face of evasion attacks (clever attackers can change some specific header fields of the packet or slow down the packet rate to avoid being detected). To achieve robust and accurate DDoS detection, we propose a method named SequenceShield. Sequence Shield is based on our observation that the direction information of each network packet can reveal the behavior pattern of DDoS attack traffic. Specifically, we innovatively serialize the network traffic between two endpoints into a sequence structure named interaction sequence (IS) with direction information. Then the converted IS is sent to a gated recurrent unit (GRU) network to learn the behavior pattern of attacks. SequenceShield only uses each packet's direction and protocol information, which makes our proposed method robust enough in the face of evasion attacks. Moreover, experimental results on two well-known datasets indicate that the classification performance of SequenceShield outperforms the state-of-the-art DDoS detection methods.