Detection and analysis types of DDoS attack

Abstract

The problem of detecting types of DDOS attacks in large-scale networks is considered. The complexity of detection is explained by the presence of a large number of connected and diverse devices, the high volume of incoming traffic, the need to introduce special restrictions when searching for anomalies. The technology of developing information security models using data mining (DM) methods is proposed. The features of machine learning of DM algorithms are related to the choice of methods for preprocessing big data (Big Data). A technique for analyzing the structure of relations between types of DDOS attacks has been developed. Within the framework of this technique, a procedure for pairwise comparison of data by types of attacks with normal traffic is implemented. The result of the comparison is the stability of features, the values of which are invariant to the measurement scales. The analysis of the structure of relations by grouping algorithms was carried out according to the stability values on the determined sets of features. When forming the sets, the stability ranking was used. For classification, various existing methods of machine learning are analyzed.