Application Of Autoencoder And Improved K-means Algorithm In DDoS Attack Detection

DDoS attack is a relatively common network attack method.Its technical principles are not complicated,but the damage caused is very great.Therefore,achieving accurate detection of DDoS attacks and taking effective preventive measures are very important steps.However,the existing research works still have shortcomings,mainly reflected in the mainstream research work using supervised learning algorithms to detect DDoS attacks,which is not ideal for the detection of new forms of DDoS attacks.Aiming at the above shortcoming,this paper studies the application of unsupervised learning algorithms in DDoS attack detection to improve the accuracy of DDoS attack detection.The research content of this paper includes:(1)An improved k-means algorithm is proposed,namely the MK-means algorithm.This algorithm optimizes the initial center selection strategy in the k-means algorithm,and improves the accuracy of the clustering results.The iris data set and wheat seed data set are used for experimental evaluation.The experimental results show that the MK-means algorithm is better than the k-means++algorithm and the k-means algorithm in accuracy and recall.(2)A DDoS attack detection scheme based on autoencoder and MK-means algorithm is proposed.This paper first uses autoencoder to reduce the data dimension,which can reduce the computational cost of high-dimensional data;then,the reduced data is applied to the MK-means algorithm for clustering,and finally DDoS attack detection is realized.The CICDDoS2019 data set is used to conduct experiments.The experimental results show that the accuracy of the scheme for detecting most types of DDoS attacks is above 90%.(3)A DDoS attack detection scheme based on the output and input errors of the autoencoder is proposed.The autoencoder is an unsupervised learning algorithm that can learn the internal laws of the data.Train autoencoder models for different types of network traffic samples,and then use test samples to test different types of models(models trained with benign samples or models trained with attack samples).If the loss in the benign model is smaller than the loss in the attack model,the sample is a benign sample,otherwise it is an attack sample.The CICDDoS2019 data set is also used for experiments.For most types of DDoS attacks,this scheme has an accuracy and recall rate of more than 90%,and the highest can reach 99.7%.The research on DDoS attack detection is a very important topic.This paper proposes a detection scheme based on autoencoder and MK-means algorithm,and a detection scheme based on autoencoder output and input errors,and uses public data sets for experimental evaluation.The experimental results show the effectiveness of these two schemes for DDoS attack detection.