Open Access

ARTICLE

A DDoS Attack Information Fusion Method Based on CNN for Multi-Element Data

Jieren Cheng^{1, 2}, Canting Cai^{1, *}, Xiangyan Tang¹, Victor S. Sheng³, Wei Guo¹, Mengyang Li¹

1 School of Information Science and Technology, Hainan University, Haikou, 570228, China.
2 Key Laboratory of Internet Information Retrieval of Hainan Province, Hainan University, Haikou, 570228, China.
3 Department of Computer Science, University of Central Arkansas, Conway, AR 72035, US.

* Corresponding Author: Canting Cai. Email: .

Computers, Materials & Continua 2020, 63(1), 131-150. https://doi.org/10.32604/cmc.2020.06175

Received 23 January 2019; Accepted 13 June 2019; Issue published 30 March 2020

Abstract

Traditional distributed denial of service (DDoS) detection methods need a lot of computing resource, and many of them which are based on single element have high missing rate and false alarm rate. In order to solve the problems, this paper proposes a DDoS attack information fusion method based on CNN for multi-element data. Firstly, according to the distribution, concentration and high traffic abruptness of DDoS attacks, this paper defines six features which are respectively obtained from the elements of source IP address, destination IP address, source port, destination port, packet size and the number of IP packets. Then, we propose feature weight calculation algorithm based on principal component analysis to measure the importance of different features in different network environment. The algorithm of weighted multi-element feature fusion proposed in this paper is used to fuse different features, and obtain multi-element fusion feature (MEFF) value. Finally, the DDoS attack information fusion classification model is established by using convolutional neural network and support vector machine respectively based on the MEFF time series. Experimental results show that the information fusion method proposed can effectively fuse multi-element data, reduce the missing rate and total error rate, memory resource consumption, running time, and improve the detection rate.

---

Keywords

---

Citations