基于GAIG特征选择算法的轻量化DDoS攻击检测方法

Lightweight detection approach of DDoS attacks based on GAIG algorithm for feature selection

为了提高基于分类的DDo S攻击检测方法的实时性,通过结合轻量级入侵检测提出了以遗传算法为搜索策略、信息增益为子集评估标准的filter型特征选择算法(feature selection based on genetic algorithm and information gain,GAIG),提取具有高区分度的相对最小特征子集。在此基础上对比了Nave Bayes、C4.5、SVM、RBF network、Random forest和Random tree这六种常用分类器的性能,并选取Random tree构建了一种轻量化的DDo S攻击检测系统。实验结果表明,GAIG算法使分类器在尽可能不降低分类精度的同时,提高分类速度,从而提高分类检测的实时性。该轻量化攻击检测系统比一般的分类模型具有更好的检测未知攻击的能力。

To improve the real-time performance of classification-based methods for distributed denial of service （DDoS） at- tacks detection, this paper introduced a lightweight intrusion detection. Firstly, it proposed a filter algorithm for feature selec- tion：GAIG,by combining genetic algorithm as the search strategy and information gain as the evaluation function. Extracting the minimum feature subset with a high classification performance by GAIG,it reduced the noisy and redundant features. Based on the features selected by GAIG, it compared the performances of classifiers with Naive Bayes, C4.5, SVM, RBF network, Random forest and Random tree, and built a lightweight detection system with Random tree. The experimental results show, GAIG increases the real-time performance of classifiers obviously,while the accuracy is still satisfying. With the strong detec- tion ability of unknown attacks, the approach has a better survivability than the general classification models.