Flow-based machine learning approach for slow HTTP distributed denial of service attack classification. (12th May 2021)

• Record Type: Journal Article
• Authors: Muraleedharan, N.; Janet, B.
• Is Part Of: International journal of computational science and engineering. Volume 24:Number 2(2021)
• Page Start: 147
• Page End: 161
• Publication Date: 2021-05-12
• Subjects: denial of service -- slow DDoS -- application layer DoS -- machine learning -- network flow -- slow HTTP DDoS -- slowloris -- slow read; Computer science -- Mathematics -- Periodicals; Computer simulation -- Mathematical aspects -- Periodicals; Computational intelligence -- Periodicals; 004.015105
• Languages: English
• ISSNs: 1742-7185

Abstract

Distributed denial of service (DDoS) attack is one of the common threats to the availability of services on the internet. The DDoS attacks are evolved from volumetric attack to slow DDoS. Unlike the volumetric DDoS attack, the slow DDoS traffic rate looks similar to the normal traffic. Hence, it is difficult to detect using traditional security mechanism. In this paper, we propose a flow-based classification model for slow HTTP DDoS traffic. The important flow level features were selected using CICIDS2017 dataset. Impacts of time, packet length and transmission rate for slow DDoS are analysed. Using the selected features, three classification models were trained and evaluated using two benchmark datasets. The results obtained reveal the proposed classifiers can achieve higher accuracy of 0.997 using RF classifiers. A comparison of the results obtained with state-of-the-art approaches shows that the proposed approach can improve the detection rate by 19.7%.