 |
After analysis, in LDDoS attacks scenarios, attack flows almost have same classified features with normal flows, and they can fire long term attacked-target insensitive attacks. As a result, the traffic volume analysis method cannot detect such a stealthy attack any more. Thinking about the LDDoS dataset is mixed by labeled and unlabeled samples. Thus, we use locality sensitive incremental TSVM method in this paper. ¡°Locality sensitiveness¡± helps to quickly locate which cluster the unlabeled data belongs to and speed up training. ¡°Incremental TSVM¡± can help to do incremental learning by support vectors and prior classified unlabeled data. The idea of locality sensitive is for solving the approximate in high dimensional spaces. It can help to map similar items to the same buckets with high probability. With it, the problem of ¡°searching the similar samples in a huge data set¡± is turned to ¡°searching them in a small bucket¡±. Thus, the searching can speed up. if we review the picture in slide 4, we find that there are always periodic low-rate rectangle shape waves. Discrete Fourier Transform (DFT) and Fast Fourier Transformation (FFT) is exactly the mathematics method to convert a finite sequence of equally-spaced samples of a function into a same-length sequence of equally-spaced samples of the discrete-time Fourier transform. Thus, we add frequency-domain representations of time-domain features Power Spectrum Density (PSD) converted by DFT/FFT as new features. After that, features subset is chosen by enhanced information entropy. |
IEEE/ICACT20210143 Slide.06
[Big Slide]