Detecting and classifying DDoS attacks with deep learning
Research write-up: classifying seven DDoS attack types plus benign traffic from flow logs with clustering and a deep learning model at 96% ROC AUC.
Abstract
Distributed denial-of-service (DDoS) is among the most damaging attacks on the internet. The attacker's weapon is traffic: enough of it, from enough sources, to slow or crash a website.
The attack comes in several classes, each defined by how the attacker tries to break into or overwhelm the network.
This write-up describes a model that detects DDoS traffic with over 96% accuracy and classifies it into seven subcategories of attack plus a safe, healthy connection.
The attack and the dataset
A DDoS attack targets websites and online services by jamming the network or server with more traffic than it can handle. It works because the traffic comes from many compromised systems at once.
Attacks split into subcategories by the layer of the OSI model they target. Among the subcategories SecureLayer7 classified in this research are:
SYN Flood, UDP Flood, MSSQL, LDAP, Portmap, NetBIOS.
Machine learning and deep learning are the common backbones of A.I. today. SecureLayer7 applies both to problems across domains with accuracy close to human performance, and this research tests how far they go in detecting threats in cybersecurity.
The team analysed the logs generated during a DDoS attack, applied supervised and unsupervised techniques to detect the threat, and used deep learning to reach over 96% accuracy in classifying the attack types along with the safe connection.
Data pre-processing
The data had 88 attributes, and processing it within limited RAM was the first problem. The team downgraded the data types of the attributes to cut the memory the data frame used: float64 to float32, int64 to int32, int32 to uint32 and so on. That removed almost 42% of the initial size. Some attributes still had maximum values close to infinite, and those were handled in the same pre-processing stage.
Distribution of target features
The target classes were kept close to evenly distributed across the dataset.
UDPLag is somewhat under-represented compared with the others; that imbalance is handled later in the training setup.
Exploratory data analysis
Plotting the flow of bits and the flow of packets shows a marked drift during a DDoS attack compared with a benign connection.
The team also analysed how each threat type is distributed within each protocol and within inbound traffic.
Unsupervised detection
In the unsupervised approach the model does not see the target variable. The algorithm learns from the input data alone and finds patterns on its own.
Before training, the team removed the features Flow ID, Source IP, Source Port, Destination IP, Destination Port, Timestamp, Flow Packets/s and Flow Bytes/s. The last two went because after standard scaling they produced values too large for float64 and NaN values.
The data was standard-scaled, then normalised, then reduced to two dimensions with principal component analysis.
The resulting clusters separate the different threats from one another to a fair extent.
Labelling the generated clusters showed that the model had found the pattern in the data and segmented the target variable on its own, again to a fair extent.
Supervised detection
The supervised approach is the opposite: the model learns through the target variable, which helps it learn the pattern in the data from the labels. The pre-processing was the same as for the unsupervised run.
Here the team used deep learning to train the model.
Structure of the deep learning model
Because the target variable was imbalanced, the team used stratified K-fold to train and validate over each fold. That keeps the distribution of training and validation sets balanced with respect to the imbalanced feature.
Adam was the base optimiser, and ROC AUC (area under the receiver operating characteristic curve, computed from prediction scores) was the evaluation metric.
Trained and validated over 10 folds, the model reached an average ROC AUC score of 96% and above for [detection of threat](/) and a highest accuracy of 97% and above.
Classification report from one of the 10 folds
| Precision | Recall | f1-score | support | |
|---|---|---|---|---|
| BENIGN | 0.98 | 0.99 | 0.98 | 519 |
| Portmap | 0.94 | 0.97 | 0.96 | 500 |
| NetBIOS | 0.86 | 0.85 | 0.86 | 500 |
| LDAP | 0.60 | 0.90 | 0.72 | 500 |
| UDP | 0.91 | 0.10 | 0.18 | 500 |
| Syn | 0.99 | 0.99 | 0.99 | 500 |
| MSSQL | 0.66 | 0.75 | 0.70 | 500 |
| UDPLag | 0.55 | 0.88 | 0.67 | 188 |
| accuracy | 0.80 | 3707 | ||
| macro avg | 0.81 | 0.80 | 0.76 | 3707 |
| weighted avg | 0.83 | 0.80 | 0.77 | 3707 |
Accuracy for classifying each class from one of the 10 folds
| Accuracy | |
|---|---|
| BENIGN | 0.97687861 |
| Portmap | 0.206 |
| NetBIOS | 0.96 |
| LDAP | 0.862 |
| UDP | 0.138 |
| Syn | 0.982 |
| MSSQL | 0.498 |
| UDPLag | 0.91489362 |
What the results show
- Both the supervised and the unsupervised approach could pick out the threat ahead of time with A.I.
- The supervised approach has the upper hand, but the unsupervised performance on unlabelled data was still strong.
- Where labelled data is scarce compared with unlabelled data, as it is in most real deployments, semi-supervised and self-supervised learning can reach similar performance.
- TensorFlow's model fairness indicator is another tool for evaluating the model and scaling its performance.
Credits
- The University of New Brunswick, for making the dataset available.
- TensorFlow, Scikit-learn and Matplotlib, the tools used throughout this research.
- The SecureLayer7 team, for supporting this research.