“Low-and-Slow„ DDoS Detection Using Traffic Flow Analysis

Abstract

Low and slow distributed denial of service (DDoS) attacks are one of the toughest challenge for state-of-the-art network security systems due to their low aggression behavior and traffic rates close to valid user's activity. Signature-based or threshold-based intrusion detection schemes typically cannot effectively capture those attacks. In this paper, we are going to introduce a machine learning-based detection model based on flow-level attributes of network traffic automatically extracted from an in-house dataset for detection Low-and-Slow DDoS attacks. The proposed approach leverages full pre-processing, such as data normalization, feature selection and automatic management of labels to make sure that it is robust and actually scalable. A comprehensive set of temporal, statistical and behavioral features 11 which describe flow duration, packet sending patterns, idle time behavior and protocol-level properties are used to effectively model attack behavior. The processed information is used to train a strong classifier that learns to differentiate benign and malicious flows with high accuracy. In order to gain a stable evaluation, the model is validated by Stratified K-Fold Cross-Validation. Performance is evaluated based on accuracy, precision, recall, F1-score, confusion matrix evaluation and ROC curves. Experiments show that the proposed system can achieve a 99.98 percent average overall detection rate with low false positive, which demonstrates that this framework is an effective method to detect Low-and-Slow DDoS attacks at real network level.