Multi-granularity Feature Fusion Detection for Encrypted Slow DDoS Attack in SDN
Jin Wang, Liping Wang, Ruiqing Wang · 2024
Slow Distributed Denial of Service attack (SL-DDoS) is a kind of server denial of service attack that exploits the vulnerability of HTTP protocol. Since SL-DDoS attacks do not need to send flooding or a large number of HTTP requests, it is difficult for traditional intrusion detection methods to detect such attacks, especially when HTTP traffic is encrypted. To overcome the above problems, this paper proposes an encrypted SL-DDoS attack detection and mitigation method based on the Multi-granularity Feature Fusion (MFFSL-DDoS) for Software Defined Networking (SDN). This method analyzes the encrypted session flow from the time sequence of packets and the spatiality of session flow and uses different deep learning methods to extract features, to obtain more effective features for abnormal traffic detection. In addition, this paper uses the advantages of SDN architecture to perform real-time defense against SL-DDoS attacks by way of SDN controller send flow tables. The experimental results show that the MFFSL-DDoS model has a higher detection rate than advanced methods, and can mitigate SL-DDoS attack traffic online and in real-time.