Biblio

Recently, DDoS attack has developed rapidly and become one of the most important threats to the Internet. Traditional machine learning and deep learning methods can-not train a satisfactory model based on the data of a single client. Moreover, in the real scenes, there are a large number of devices used for traffic collection, these devices often do not want to share data between each other depending on the research and analysis value of the attack traffic, which limits the accuracy of the model. Therefore, to solve these problems, we design a DDoS attack detection model based on federated learning named FLDDoS, so that the local model can learn the data of each client without sharing the data. In addition, considering that the distribution of attack detection datasets is extremely imbalanced and the proportion of attack samples is very small, we propose a hierarchical aggregation algorithm based on K-Means and a data resampling method based on SMOTEENN. The result shows that our model improves the accuracy by 4% compared with the traditional method, and reduces the number of communication rounds by 40%.

Nowadays, encrypted traffic classification has become a challenge for network monitoring and cyberspace security. However, the existing methods cannot meet the requirements of encrypted traffic classification because of the encryption protocol in communication. Therefore, we design a novel neural network named Stereo Transform Neural Network (STNN) to classify encrypted network traffic. In STNN, we combine Long Short Term Memory (LSTM) and Convolution Neural Network (CNN) based on statistical features. STNN gains average precision about 95%, average recall about 95%, average F1-measure about 95% and average accuracy about 99.5% in multi-classification. Besides, the experiment shows that STNN obviously accelerates the convergence rate and improves the classification accuracy.