Skip to main content
SpringerLink
Log in

A Novel 3D Intelligent Cluster Method for Malicious Traffic Fine-Grained Classification

  • Conference paper
  • First Online:
Algorithms and Architectures for Parallel Processing (ICA3PP 2021)

Part of the book series: Lecture Notes in Computer Science ((LNTCS,volume 13155))

  • 1773 Accesses

Abstract

Distributed denial of service (DDoS) attacks have become one of the most serious threats to cloud network. Currently, most of the research on DDoS attack mitigation focuses on DDoS traffic detection without considering further analysis (e.g., fine-grained classification of mixed attack traffic). By further analysis, we can provide more support for attack interception and traceback. This paper proposes a new abnormal traffic classification method A3DC (Autoencoder-based Three-Dimensional Linear Cluster) to overcome the difficulty of fine-grained distinguishing DDoS attacks under a small amount of labelled training data in cloud network environment. Based on a novel proposed 3D cluster algorithm, A3DC method consisting of three stages, which are data normalization preprocessing, autoencoder downscaling, and data clustering, is designed. The experimental results on the public data set show that A3DC is significantly superior to existing methods in terms of mixed attack traffic classification and is able to obtain higher detection rate and lower false alarm rate in DDoS attack detection.

This work was supported by the National Natural Science Foundation of China (Grant No. 61972412) and the Science and Technology Innovation Program of Hunan Province (2020RC2047).

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 119.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Ye, J., Cheng, X., Zhu, J., Feng, L., Song, L.: A DDoS attack detection method based on SVM in software defined network. Secur. Commun. Netw. 2018, 1–8 (2018)

    Google Scholar 

  2. Tuan, T.A., Long, H.V., Son, L.H., Kumar, R., Priyadarshini, I., Son, N.T.K.: Performance evaluation of Botnet DDoS attack detection using machine learning. Evol. Intell. 13(2), 283–294 (2019). https://doi.org/10.1007/s12065-019-00310-w

    Article  Google Scholar 

  3. Mousavi, S.M., St-Hilaire, M.: Early detection of DDoS attacks against SDN controllers. In: 2015 International Conference on Computing, Networking and Communications (ICNC), pp. 77–81. IEEE (2015)

    Google Scholar 

  4. Lim, S., Ha, J., Kim, H., Kim, Y., Yang, S.: A SDN-oriented DDoS blocking scheme for botnet-based attacks. In: 2014 Sixth International Conference on Ubiquitous and Future Networks (ICUFN), pp. 63–68. IEEE (2014)

    Google Scholar 

  5. Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., Ghogho, M.: Deep learning approach for network intrusion detection in software defined networking. In: 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM), pp. 258–263. IEEE (2016)

    Google Scholar 

  6. Boshmaf, Y., Muslukhov, I., Beznosov, K., Ripeanu, M.: Design and analysis of a social botnet. Comput. Netw. 57(2), 556–578 (2013)

    Article  Google Scholar 

  7. Fire, M., Katz, G., Elovici, Y.: Strangers intrusion detection-detecting spammers and fake profiles in social networks based on topology anomalies. HFSP J. 1(1), 26–39 (2012)

    Google Scholar 

  8. Savage, D., Zhang, X., Xinghuo, Yu., Chou, P., Wang, Q.: Anomaly detection in online social networks. Soc. Netw. 39, 62–70 (2014)

    Article  Google Scholar 

  9. Zhou, W., Jia, W., Wen, S., Xiang, Y., Zhou, W.: Detection and defense of application-layer DDoS attacks in backbone web traffic. Future Gener. Comput. Syst. 38, 36–46 (2014)

    Article  Google Scholar 

  10. Scholl, T.B.: Methods and apparatus for distributed backbone internet DDoS mitigation via transit providers. US Patent 8,949,459, 3 February 2015

    Google Scholar 

  11. Osanaiye, O., Choo, K.-K.R., Dlodlo, M.: Distributed denial of service (DDoS) resilience in cloud: review and conceptual cloud DDoS mitigation framework. J. Netw. Comput. Appl. 67, 147–165 (2016)

    Article  Google Scholar 

  12. Lee, J.-H., Park, M.-W., Eom, J.-H., Chung, T.-M.: Multi-level intrusion detection system and log management in cloud computing. In: 13th International Conference on Advanced Communication Technology (ICACT 2011), pp. 552–555. IEEE (2011)

    Google Scholar 

  13. Iqbal, S., et al.: On cloud security attacks: a taxonomy and intrusion detection and prevention as a service. J. Netw. Comput. Appl. 74, 98–120 (2016)

    Article  Google Scholar 

  14. Bakshi, A., Dujodwala, Y.B.: Securing cloud from DDoS attacks using intrusion detection system in virtual machine. In: 2010 Second International Conference on Communication Software and Networks, pp. 260–264. IEEE (2010)

    Google Scholar 

  15. Chung, C.-J., Khatkar, P., Xing, T., Lee, J., Huang, D.: NICE: network intrusion detection and countermeasure selection in virtual network systems. IEEE Trans. Dependable Secure Comput. 10(4), 198–211 (2013)

    Article  Google Scholar 

  16. Yu, S., Tian, Y., Guo, S., Wu, D.O.: Can we beat DDoS attacks in clouds? IEEE Trans. Parallel Distrib. Syst. 25(9), 2245–2254 (2013)

    Article  Google Scholar 

  17. Balkanli, E., Alves, J., Zincir-Heywood, A.N.: Supervised learning to detect DDoS attacks. In: 2014 IEEE Symposium on Computational Intelligence in Cyber Security (CICS), pp. 1–8. IEEE (2014)

    Google Scholar 

  18. Yi-Chi, W., Tseng, H.-R., Yang, W., Jan, R.-H.: DDoS detection and traceback with decision tree and grey relational analysis. Int. J. Ad Hoc Ubiquit. Comput. 7(2), 121–136 (2011)

    Article  Google Scholar 

  19. Lakshminarasimman, S., Ruswin, S., Sundarakantham, K.: Detecting DDoS attacks using decision tree algorithm. In: 2017 Fourth International Conference on Signal Processing, Communication and Networking (ICSCN), pp. 1–6. IEEE (2017)

    Google Scholar 

  20. Cheng, J., Li, M., Tang, X., Sheng, V.S., Liu, Y., Guo, W.: Flow correlation degree optimization driven random forest for detecting DDoS attacks in cloud computing. Secur. Commun. Netw. 2018, 1–14 (2018)

    Google Scholar 

  21. Idhammad, M., Afdel, K., Belouch, M.: Detection system of HTTP DDoS attacks in a cloud environment based on information theoretic entropy and random forest. Secur. Commun. Netw. 2018, 1–12 (2018)

    Google Scholar 

  22. Laskov, P., Düssel, P., Schäfer, C., Rieck, K.: Learning intrusion detection: supervised or unsupervised? In: Roli, F., Vitulano, S. (eds.) ICIAP 2005. LNCS, vol. 3617, pp. 50–57. Springer, Heidelberg (2005). https://doi.org/10.1007/11553595_6

    Chapter  Google Scholar 

  23. Zanero, S., Savaresi, S.M.: Unsupervised learning techniques for an intrusion detection system. In: Proceedings of the 2004 ACM Symposium on Applied Computing, pp. 412–419 (2004)

    Google Scholar 

  24. Amini, M., Jalili, R., Shahriari, H.R.: RT-UNNID: a practical solution to real-time network-based intrusion detection using unsupervised neural networks. Comput. Secur. 25(6), 459–468 (2006)

    Article  Google Scholar 

  25. Almalawi, A., et al.: Add-on anomaly threshold technique for improving unsupervised intrusion detection on SCADA data. Electronics 9(6), 1017 (2020)

    Article  Google Scholar 

  26. Leung, K., Leckie, C.: Unsupervised anomaly detection in network intrusion detection using clusters. In: Proceedings of the Twenty-Eighth Australasian Conference on Computer Science, vol. 38, pp. 333–342 (2005)

    Google Scholar 

  27. Jiang, S.Y., Song, X., Wang, H., Han, J.-J., Li, Q.-H.: A clustering-based method for unsupervised intrusion detections. Pattern Recogn. Lett. 27(7), 802–810 (2006)

    Article  Google Scholar 

  28. Jha, M., Acharya, R.: An immune inspired unsupervised intrusion detection system for detection of novel attacks. In: 2016 IEEE Conference on Intelligence and Security Informatics (ISI), pp. 292–297. IEEE (2016)

    Google Scholar 

  29. Casas, P., Mazel, J., Owezarski, P.: Unsupervised network intrusion detection systems: detecting the unknown without knowledge. Comput. Commun. 35(7), 772–783 (2012)

    Article  Google Scholar 

  30. Wu, W., Alvarez, J., Liu, C., Sun, H.-M.: Bot detection using unsupervised machine learning. Microsyst. Technol. 24(1), 209–217 (2016). https://doi.org/10.1007/s00542-016-3237-0

    Article  Google Scholar 

  31. Portnoy, L.: Intrusion detection with unlabeled data using clustering. Ph.D. thesis, Columbia University (2000)

    Google Scholar 

  32. Eskin, E., Arnold, A., Prerau, M., Portnoy, L., Stolfo, S.: A geometric framework for unsupervised anomaly detection. In: Barbará, D., Jajodia, S. (eds.) Applications of Data Mining in Computer Security. ADIS, vol. 6, pp. 77–101. Springer, Boston (2002). https://doi.org/10.1007/978-1-4615-0953-0_4

  33. Idhammad, M., Afdel, K., Belouch, M.: Semi-supervised machine learning approach for DDoS detection. Appl. Intell. 48(10), 3193–3208 (2018)

    Article  Google Scholar 

  34. Yonghao, G., Li, K., Guo, Z., Wang, Y.: Semi-supervised k-means DDoS detection method using hybrid feature selection algorithm. IEEE Access 7, 64351–64365 (2019)

    Article  Google Scholar 

  35. Srihari, V., Anitha, R.: DDoS detection system using wavelet features and semi-supervised learning. In: Mauri, J.L., Thampi, S.M., Rawat, D.B., Jin, D. (eds.) SSCC 2014. CCIS, vol. 467, pp. 291–303. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-44966-0_28

    Chapter  Google Scholar 

  36. Lysenko, S., Savenko, O., Bobrovnikova, K.: DDoS botnet detection technique based on the use of the semi-supervised fuzzy c-means clustering. In: ICTERI Workshops, pp. 688–695 (2018)

    Google Scholar 

  37. Casas, P., D’Alconzo, A., Settanni, G., Fiadino, P., Skopik, F.: Poster: (semi)-supervised machine learning approaches for network security in high-dimensional network data. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1805–1807 (2016)

    Google Scholar 

  38. Kaur, G.: A novel distributed machine learning framework for semi-supervised detection of botnet attacks. In: 2018 Eleventh International Conference on Contemporary Computing (IC3), pp. 1–7. IEEE (2018)

    Google Scholar 

  39. Vincent, P., Larochelle, H., Lajoie, I., Bengio, Y., Manzagol, P.-A., Bottou, L.: Stacked denoising autoencoders: learning useful representations in a deep network with a local denoising criterion. J. Mach. Learn. Res. 11(12), 3371–3408 (2010)

    MathSciNet  MATH  Google Scholar 

  40. Gong, D., et al.: Memorizing normality to detect anomaly: memory-augmented deep autoencoder for unsupervised anomaly detection. In: Proceedings of the IEEE International Conference on Computer Vision, pp. 1705–1714 (2019)

    Google Scholar 

  41. Sharafaldin, I., Lashkari, A.H., Ghorbani, A.A.: Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: ICISSP, pp. 108–116 (2018)

    Google Scholar 

  42. Ring, M., Wunderlich, S., Scheuring, D., Landes, D., Hotho, A.: A survey of network-based intrusion detection data sets. Comput. Secur. 86, 147–167 (2019)

    Article  Google Scholar 

  43. Khraisat, A., Gondal, I., Vamplew, P., Kamruzzaman, J.: Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecurity 2(1), 1–22 (2019). https://doi.org/10.1186/s42400-019-0038-7

    Article  Google Scholar 

  44. Koroniotis, N., Moustafa, N., Sitnikova, E., Turnbull, B.: Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-IoT dataset. Future Gener. Comput. Syst. 100, 779–796 (2019)

    Article  Google Scholar 

  45. Vinayakumar, R., Alazab, M., Soman, K.P., Poornachandran, P., Al-Nemrat, A., Venkatraman, S.: Deep learning approach for intelligent intrusion detection system. IEEE Access 7, 41525–41550 (2019)

    Article  Google Scholar 

  46. Vijayanand, R., Devaraj, D., Kannapiran, B.: Intrusion detection system for wireless mesh network using multiple support vector machine classifiers with genetic-algorithm-based feature selection. Comput. Secur. 77, 304–314 (2018)

    Article  Google Scholar 

  47. Chaabouni, N., Mosbah, M., Zemmari, A., Sauvignac, C., Faruki, P.: Network intrusion detection for IoT security based on learning techniques. IEEE Commun. Surv. Tutor. 21(3), 2671–2701 (2019)

    Article  Google Scholar 

  48. Moustafa, N., Jiankun, H., Slay, J.: A holistic review of network anomaly detection systems: a comprehensive survey. J. Netw. Comput. Appl. 128, 33–55 (2019)

    Article  Google Scholar 

  49. Chang, C.-C., Lin, C.-J.: LIBSVM: a library for support vector machines. ACM Trans. Intell. Syst. Technol. (TIST) 2(3), 1–27 (2011)

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. College of Computer, National University of Defense and Technology, Changsha, 410073, China

    Baokang Zhao, Murao Lin, Ziling Wei & Jinshu Su

  2. Faculty of Science and Technology, University of the Faroe Islands, Torshavn, Faroe Islands, Denmark

    Qin Xin

Authors
  1. Baokang Zhao
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Murao Lin
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Ziling Wei
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Qin Xin
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Jinshu Su
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Ziling Wei .

Editor information

Editors and Affiliations

  1. Xiamen University, Xiamen, China

    Yongxuan Lai

  2. Beijing Normal University, Zhuhai, China

    Tian Wang

  3. Xiamen University, Xiamen, China

    Min Jiang

  4. Tianjin University, Tianjin, China

    Guangquan Xu

  5. Hunan University, Changsha, China

    Wei Liang

  6. University of Naples Parthenope, Naples, Italy

    Aniello Castiglione

Rights and permissions

Reprints and permissions

Copyright information

© 2022 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Zhao, B., Lin, M., Wei, Z., Xin, Q., Su, J. (2022). A Novel 3D Intelligent Cluster Method for Malicious Traffic Fine-Grained Classification. In: Lai, Y., Wang, T., Jiang, M., Xu, G., Liang, W., Castiglione, A. (eds) Algorithms and Architectures for Parallel Processing. ICA3PP 2021. Lecture Notes in Computer Science(), vol 13155. Springer, Cham. https://doi.org/10.1007/978-3-030-95384-3_25

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-95384-3_25

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-95383-6

  • Online ISBN: 978-3-030-95384-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation