Shannon entropy based DDoS attacks detection using combination of machine learning based feature importance techniques

A Distributed Denial of Service (DDoS) attack is one of the most dangerous cyber-attacks, capable of potentially bringing down servers. The main attacker in a DDoS attack assembles a very large number of infected machines and induces them to target a specific server. This attack overwhelms the targeted system with an extensive volume of useless requests, aiming to render legal users unable to access the available services on that system. Several pre-processing techniques were applied to the dataset to enhance the accuracy of detection, such as data cleaning, balancing, and encoding. CICFlowMeter was used to generate flows and extract features from each flow. Feature selection was utilized to choose relevant and important features and reduce the execution time of the detection process. A novel combination of four machine learning-based techniques-Random Forest, ANOVA, Extra Tree, and Pearson technique-was implemented for feature selection. Shannon entropy and Sequential Probability Ratio Test (SE-SPRT) techniques were combined to detect various types of DDoS threats. The CICDDoS2019 dataset and confusion matrix were used to test the effectiveness of the detection. Finally, the detection techniques exhibited higher f-score values and lower values of the probability of false alarms for most different attack types when compared with other state-of-the-art techniques.

Text 127802.pdf - Published Version Restricted to Repository staff only Download (520kB) Official URL or Download Paper: https://pubs.aip.org/aip/acp/article-abstract/3211...

Actions (login required)

View Item