CHC-DDoS: A DDoS Attacks Detection Scheme Using Host-Connection Graph Representation and GCN
摘要
Recent years have seen exponential growth in cyber-attacks, particularly Distributed Denial of Service (DDoS) attacks, which can disrupt critical services and cause significant damage. Enhancing network detection capabilities for these attacks is crucial. While deep learning (DL) techniques have achieved high performance in DDoS detection, most existing solutions treat each flow independently. However, DDoS attacks involve multiple hosts and flows, motivating the use of graph representations and Graph Neural Networks (GNNs) for their detection. This paper proposes “CHC-DDoS”, a GNN-based scheme that uses host-connection graphs (HCGs) to represent hosts and their connections. The graph is then input into a GNNs model that accounts for its heterogeneity by employing (1) a message-passing process with a specific Graph Convolutional Network (GCN) for each edge type, and (2) a learnable update function for each node type. A readout function predicts the label of nodes representing flows based on their final embeddings. CHC-DDoS was trained and evaluated using the CIC-DDoS-2019 dataset and stratified k-fold cross-validation, achieving an accuracy of 0.999.