ICACT20210143 Slide.15
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
That's all for my presentation. Thanks for your attention! Any question for me?
|
|
ICACT20210143 Slide.14
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In the paper, we develop a novel semi-supervised locality sensitive incremental TSVM method for resolving LDDoS issue based on Mirai botnet and its variants issues. The results based on KDD-CUP prove LS-ITSVM has better performance, and it can differ bots from normal users. But during experiment, we find the KDD-CUP dataset was not developed for LDDoS attacks. Thus, soon, we will focus on setting up an IOT LDDoS test bed to collect data and retest these indicators in simulated environment and apply above algorithms into real data center. Secondly, In order to verify the validation for involving samples, we plan to investigate Generative Adversarial Networks (GAN) for generating adversarial samples.
|
|
ICACT20210143 Slide.13
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The training and detecting CPU time is the other critical parameter to evaluate the performance of locality sensitive ITSVM method. We define it as the time when method trains with semi-supervised incremental data and detects whether malicious flows exist or not. As the following figure shown, the CPU time of ISVM is increased continually with the growth of increase set size, and bumps to almost 100s from 60s. Same to accuracy, LPA method is stopped when size is bigger than 15k. Compared with them, our proposed method training and detecting time is stable in 50s. Thus, take both detection accuracy score and CPU time into account, locality sensitive ITSVM, which has better performance, can detect DDoS with higher accuracy and shorter CPU time.
|
|
ICACT20210143 Slide.12
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In order to explain that the proposed method is better than others, we compare two indicators: detection accuracy score, training and response CPU time. In the following picture, the proposed locality sensitive ITSVM almost has the same accuracy with ISVM, even if we bump the semi-supervised increase set size to 100k. but locality sensitive ITSVM method has far better detection accuracy than LPA method. The accuracy of LPA is stick to 80% or so. And even worst, LPA is a huge memory-consumed method. It reports memory is not enough when it calculates label. Thus, there is not statistical data when size is bigger than 15k.
|
|
ICACT20210143 Slide.11
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Experiences are done with KDD CUP-99 dataset. In the dataset, each of samples has 41 features. 38 features of them are character and number related features. Thus, we pre-process them by reflecting and normalization. And then, we generate PSD by FFT and add them as new dimensions. In the following two pictures, the time domain features and NCAS value of dst_bytes are shown. After above operations, dimensions of features are bumped to 110. In order to avoid the influence of the dimension of feature attribute on the experiment, it is necessary to unify the dimension of the experimental data. Thus, we normalize the feature attributes between 0 and 1. After above necessary dimensionality expand and normalize. The entropies of them are calculated for feature extraction. We well tune the threshold to 50, whose entropy values are bigger than 0.1, and chose them as training features.
|
|
ICACT20210143 Slide.10
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Now that we have worked out locality sensitive features extraction method for locating and pre-labeling examples, at the same time, we have incremental TSVM for quickly incremental learning. Thus, we further integrate them together for semi-supervised learning quickly more and trying to improve classification accuracy by a small margin.
|
|
ICACT20210143 Slide.09
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In order to obtain the optimal solution, before the algorithm, we should set well-tuned C and C* by historical experiment, and to learn the initialized SVM classifier based on labeled samples through induction method. The second step is to use this SVM classifier to classify all unlabeled samples, and mark only pairwise labels of positive and negative samples in support vectors nearby. The last step is to re-train SVM based on new chosen samples and labeled samples. Training procedure is repeated between step two and three, until all unlabeled samples have their own classification.
|
|
ICACT20210143 Slide.08
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
TSVM extend SVMs in that they could treat partially labeled data in semi-supervised learning by following the principles of transduction. The key idea of TSVM is that it can be treated as seeking an optimal solution in given labeled dataset and unlabeled dataset. But there are two disadvantages of transduction method. The one is that TSVM builds no predictive model. And the other one is if a previously unknown point is added to the set, the entire transductive algorithm would need to be repeated with all of the points in order to predict a label. After investigation, we find the set of support vectors can fully describe the features of the whole training set, learning in the set of support vectors is equivalent to learning in whole training set. In every iterable training, only the support vectors are mentained and combined with the new added samples for new classifier. With this, TSVM has the capacity of incremental learning.
|
|
ICACT20210143 Slide.07
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
This is the locality sensitive features extraction algorithm. There are two input parameters. They are all the samples of network dataset and entropy’s thresh. Firstly, we initialize FeatureList based on NetworkDataSet, and Set well-tuned EntropyThresh. And then, we Calculate frequency-domain features based on time-domain features (PSD) based on DFT/FFT, and add it into FeatureList. Third, we calculate features’ entropy and sort them for final features. At last, we generate hash buckets with same hash values, and generate HashTable based on buckets.
|
|
ICACT20210143 Slide.06
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
After analysis, in LDDoS attacks scenarios, attack flows almost have same classified features with normal flows, and they can fire long term attacked-target insensitive attacks. As a result, the traffic volume analysis method cannot detect such a stealthy attack any more. Thinking about the LDDoS dataset is mixed by labeled and unlabeled samples. Thus, we use locality sensitive incremental TSVM method in this paper. “Locality sensitiveness” helps to quickly locate which cluster the unlabeled data belongs to and speed up training. “Incremental TSVM” can help to do incremental learning by support vectors and prior classified unlabeled data. The idea of locality sensitive is for solving the approximate in high dimensional spaces. It can help to map similar items to the same buckets with high probability. With it, the problem of “searching the similar samples in a huge data set” is turned to “searching them in a small bucket”. Thus, the searching can speed up. if we review the picture in slide 4, we find that there are always periodic low-rate rectangle shape waves. Discrete Fourier Transform (DFT) and Fast Fourier Transformation (FFT) is exactly the mathematics method to convert a finite sequence of equally-spaced samples of a function into a same-length sequence of equally-spaced samples of the discrete-time Fourier transform. Thus, we add frequency-domain representations of time-domain features Power Spectrum Density (PSD) converted by DFT/FFT as new features. After that, features subset is chosen by enhanced information entropy.
|
|
ICACT20210143 Slide.05
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Before our proposal, I would like to give a brief review of existing methods. In traditional detection methods, researchers developed the variant of the Shiryaev-Roberts's procedure, Checkpoint Anomaly Detection techniques, and multifractal detrended fluctuation analysis (MF-DFA) and so on. Researchers also used ML and AI into LDDoS, such as BIRTH algorithm, wavelet transform, propagation back (BP) model of neural network, ANN and the optimizer-based ANN technology, convolution neural network, SVM, LPA etc. Although these methods have high accuracy, they need more training and detecting time when new samples were labeled. Thus, we propose and develop a novel semi-supervised locality sensitive incremental TSVM method for higher detecting accuracy and fast training and response time.
|
|
ICACT20210143 Slide.04
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In phase three, with more and more feasible detection methods for above high rate DDoS, it begins to hide it as low rate one, and is becoming a serious threat to Internet. As we know, a successful DDoS attack needs to tune a tuple (T, R, L) of TCP at least. T is an integer multiple coincides with minRTO value of TCP; R is the peak rate and L is the burst length. In order to cause TCP packet loss and begin slow-start, R should be large enough and L should be longer than RTT value. In this picture, we simulated a LDDoS attacks of 4 Mirai Bots with the R of 50Kb/sec. Obviously, we can see that the LDDoS attack stream hides itself among normal traffic by making its peak rate even lower than the normal traffic rate. it is becoming harder and harder to be detected. In our paper, we will propose a method with high detection accuracy, fast response time to detect LDDoS Attacks.
|
|
ICACT20210143 Slide.03
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In Phase two, with the emergence of IOT, DDoS attacks sources become to IoT devices, that have weak security configurations, lacked computational capabilities to run anti-virus, and constantly connected to Internet. As a result, it becomes soon a powerful amplifying platform for DDoS attacks. The recent prominent examples are Mirai botnet. According to the French webhost and cloud service provider OVH, a DDoS attack using Mirai malware hit them with 1.1 Tbps at peak by about 145K hacked cameras. Obviously, the result of this kind of DDoS lead to huge peak, but it is easy to be detected.
|
|
ICACT20210143 Slide.02
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Distributed Denial-of-Service (DDoS) attacks have a long history. We split them into 3 phases. In phase one, it is about DDoS based on PCs. It is characterized by brute-force, sustained high rate or specifically designed to explore the protocol limitations or software vulnerabilities in services. Its attack sources are mainly the PCs, that have strong password, updated anti-virus software regularly, and unexpected off-line. Thus, the difficulty of this phase is how to control as many as desktop computers. As a result, the DDoS of this phase has a lower peak and easy to be detect.
|
|
ICACT20210143 Slide.01
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Hi everybody, my name is Zengguang Liu. Today，my presentation is about "Early Detection of LDDoS Attacks in IOT Utilizing Locality Sensitive Incremental TSVM Method". It is finished by Xiaochun Yin, Ruiping Yang, Anming Dong and me.
|
