Detecting Linking Flooding Attacks using Deep Convolution Network

With the development of technology, a new kind of Distributed Denial-of-Service (DDoS) attack named link-flooding attack (LFA) has been widely applied to congest critical network links and to paralyze the network service. This is mainly due to LFA is easily implemented, obfuscated, and occulted by launching large-scale legitimate low-speed flows to paralyze target network areas. Many solutions are proposed to detect LFA, they are designed by hand-crafted algorithms and hardly keep up the developing progress of self-organizing network structures and emerging network protocols. This study proposes a Deep-Learning based LFA defense framework, called DCN (Deep Convolution Network), that applies Convolution Neural Networks to statistically monitoring the network status through end-to-end functionality (Input: network status snapshot; Output: LFA attack or not attack) without any manual intervention. The experiment results demonstrate DCN can accurately detect DCN in varying network structure and flow patterns. Furthermore, DCN also provides quantitative security risk analysis by using learning time as the control variable, network structure as the independent variable, and time to identify LFA as the dependent variable. The contributions of DCN are (1) providing an autonomic LFA defense framework without any manual intervention, (2) providing objective and quantitative analytical security risk evaluating indicator, and (3) allowing cloud computing and Internet of Things company focuses on their service and leaves security defending to DCN.