基于OCSVM的DDOS攻击实时检测模型

摘要

To improve the accuracy of DDOS attack detection rate, address the offline training classifier problems caused by sample labeling and classification can not adapt to changes in traffic patterns, a real-time detection of DDOS attack model is proposed. The model is based on one-class SVM to do classification, it can reduce the time to sample label. The active learning mechanism is adopted to select the most beneficial samples to improve the performance of classifier. The congestion control theory is used to identify and correction the classification errors actively, so that learning machine can update their status with the flow changes. Experimental results show that the model has better classification accuracy, the error correction function can improve the detection rate, and it is validated and can be used for real-time detection of DDOS attacks.%为了提高DDOS攻击检测器的准确率,解决因离线训练分类器而导致的样本标注困难,分类器不能随流量模式变化而更新的问题,提出了一种DDOS攻击的实时检测模型.该模型以One-class SVM做分类器,可减少标注样本的时间.使用主动学习机制,能主动挑选最有利于分类器性能提高的样本进行训练.以拥塞控制理论为基础,通过对分类结果进行主动错误识别和纠正,使学习机可以随流量变化更新其状态.实验结果表明,该模型有较好的分类准确性,通过错误纠正功能可以提高检测率,可用于实时检测DDOS攻击.