基于RF-SVM的应用层DDoS攻击检测方法

Application Layer DDoS Attack Detection Method Based on RF-SVM

目前对于应用层DDoS攻击的检测已经取得一定进展,但这类方法往往只能针对一种或几种特定类型的攻击,无法适应应用层中复杂多变的混合攻击。针对应用层DDoS攻击检测方法存在的不足,提出一种基于RF-SVM模型的应用层DDoS攻击检测方法。首先通过随机森林特征重要性算法评估混合攻击下具体特征的重要性,再根据FDRCA算法进行特征降维,最后通过SVM分类器进行分类。经过实验验证,RF-SVM模型能够适应应用层中复杂多变的混合攻击,通过与BP算法、单一SVM算法和HsMM算法比较,能够验证RF-SVM模型拥有较高的检测率和较好的混合攻击适应性。

At present,some progress has been made in detecting DDoS attacks at the application layer,but these methods can only detect one or several specific types of attacks and cannot adapt to the complex and changeable mixed attacks in the application layer.Therefore,a class of detection methods that adapt to hybrid attacks is urgently needed.Aiming at the deficiencies of DDoS attack detection methods in the current application layer,an application layer DDoS attack detection method based on the RF-SVM model is proposed.Firstly,the random forest feature importance algorithm evaluates the importance of specific features under mixed attacks.Then the feature dimension is reduced according to the FDRCA algorithm,and finally,the SVM classifier is used for classification.After experimental verification,the RF-SVM model can adapt to the application layer′s complex and changeable mixed attacks.By comparing the BP algorithm,the single SVM algorithm,and the HsMM algorithm,it can be verified that the RF-SVM model has a higher detection rate and better mixing attack adaptability.