| In recent years,due to a large number of attack resources and the amplification effect on traffic is very significant.Distributed reflection denial of service(DRDoS)attacks,also known as reflection attacks or amplification attacks,has become the major part of distributed denial of service(DDoS)attacks,NTP and SSDP reflection attacks are the mainstream DRDoS attacks,and new attacks such as Memcached reflection attacks continue to emerge.The traditional detection method based on statistical methods can not effectively detect and distinguish DRDoS attacks,and suffer from the problem of single detection type.Therefore,there is an urgent need for a multi classification detection method for DRDoS attacks to improve the performance of detecting a variety of DRDoS attacks.Relying on the national key research and development program of china project "Identity based trusted protocol and malicious communication behavior monitoring method",this paper designs a machine learning based multi-category DRDoS attacks detection system.The system can effectively detect a variety of DRDoS attacks when deployed at the gateway with a 99.95% reduction rate in malicious traffic,and provides interfaces for the knowledge base of malicious behavior.The detection system designed in this paper is divided into traffic collection module,feature analysis module,off-line training module and online detection module.It can detect six types of DRDoS attack including Memcached,NTP and SSDP.The specific contributions of this paper are as follows:(1)Traffic collection module establishes DRDoS attacks data set and feature set.Aiming at the problem of lack of real and reliable DRDoS attack data set,establishes a self generated data set.By installing the servers for relevant configuration,writing scripts,simulating six kinds of DRDoS attacks according to the attack process,collecting attack and normal traffic,and establishing a data set that meets the detection requirements of this paper.Meanwhile,CICFlow Meter is used to extract the features of the data set and establish the feature set required for detection.(2)Feature analysis module performs feature analysis on the dataset to obtain a feature subset.This paper analyzes the specific principles of different DRDoS attacks,carries out feature selection combined with feature engineering methods to obtains a feature subset containing 24 features.These features can reflect the characteristics of DRDoS attacks,help distinguish attacks,improve detection performance and reduce system resource consumption and detection time.(3)Offline training module picks the best machine learning method.This paper compares a variety of common machine learning methods based on the current popular XGBoost for DRDoS attack detection,and compares the performance advantages of XGBoost combined with offline training experimental analysis.(4)Online detection module verifies the proposed scheme through online detection experiments.Build an online detection experimental environment and designs comparative detection schemes based on the methods proposed in other papers,and then detects and classifies the mixture of DRDoS attacks traffic and normal traffic at the network entrance.The experimental results show that the DRDoS attacks detection method based on machine learning proposed in this paper can realize the effective detection of DRDoS attacks and obtain multi-classification results based on security requirements,reduction rate in malicious traffic reached 99.95% which has obvious advantages compared with other methods.(5)This method provides interfaces to the malicious behavior knowledge base.The feature analysis module and online detection module provide interfaces for the malicious behavior knowledge base for malicious behavior feature analysis and attack nodes source tracing. |
