SDN中基于SA-GRU的DDoS攻击检测

SA-GRU-Based DDoS Attack Detection in Software-Defined Networking

  • 摘要: 软件定义网络(SDN)因其集中式的架构,使其容易受到分布式拒绝服务(DDoS)攻击。许多检测方法侧重模型的性能而忽略了特征维度对检测的影响,导致模型受到噪声干扰。针对高维网络流量数据中存在的特征维度冗余使模型检测性能降低的问题,提出了一种基于顺序注意力机制(SA)的动态特征选择机制,并将其与门控循环单元(GRU)融合,构建协同检测模型。SA机制对预处理后的数据集进行了特征选择,通过动态调整各特征权重,有效过滤了无关噪声,达到了特征降维的目的,GRU模块通过捕获网络流量中长短期时序依赖关系,建模数据流的状态转移规律,增强模型对攻击流量的敏感性。相较于传统模型和近年提出的DDoS攻击检测方法,本文所提模型在数据集CICIDS2017、CICDDoS2019上的检测F1分数分别达到了99.84%和99.91%,优于现有方法,且在测试中表现出较高的效率,满足了DDoS攻击检测对准确性与实时响应的要求。

     

    Abstract: Software-defined networking (SDN), due to its centralized architecture, is vulnerable to distributed denial of service (DDoS) attacks. Many detection methods prioritize model performance while neglecting the impact of feature dimensions, resulting in models being disturbed by noise. To address the issue of redundant feature dimensions in high-dimensional network traffic data degrading model detection performance, this study proposes a dynamic feature selection mechanism based on sequential attention (SA), and integrates it with gated recurrent units (GRU) to construct a collaborative detection model. The SA mechanism performs feature selection on preprocessed datasets by dynamically adjusting feature weights, effectively filtering irrelevant noise to achieve dimensionality reduction. The GRU module captures short- and long-term temporal dependencies in network traffic, models state transition patterns in data streams, and enhances the model's sensitivity to attack traffic. Compared with traditional models and recently proposed DDoS attack detection methods, the proposed model in this paper achieves detection F1 scores of 99.84% and 99.91% on CICIDS2017 and CICDDoS2019 datasets, significantly outperforming existing methods. It also demonstrates high efficiency in testing, meeting the requirements for both accuracy and real-time response in DDoS attack detection.

     

/

返回文章
返回