Recent years have seen exponential growth in cyber-attacks, particularly Distributed Denial of Service (DDoS) attacks, which can disrupt critical services and cause significant damage. Enhancing network detection capabilities for these attacks is crucial. While deep learning (DL) techniques have achieved high performance in DDoS detection, most existing solutions treat each flow independently. However, DDoS attacks involve multiple hosts and flows, motivating the use of graph representations and Graph Neural Networks (GNNs) for their detection. This paper proposes “CHC-DDoS”, a GNN-based scheme that uses host-connection graphs (HCGs) to represent hosts and their connections. The graph is then input into a GNNs model that accounts for its heterogeneity by employing (1) a message-passing process with a specific Graph Convolutional Network (GCN) for each edge type, and (2) a learnable update function for each node type. A readout function predicts the label of nodes representing flows based on their final embeddings. CHC-DDoS was trained and evaluated using the CIC-DDoS-2019 dataset and stratified k-fold cross-validation, achieving an accuracy of 0.999.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

CHC-DDoS: A DDoS Attacks Detection Scheme Using Host-Connection Graph Representation and GCN

  • Ahmed Saidane,
  • Ali El Kamel,
  • Habib Youssef

摘要

Recent years have seen exponential growth in cyber-attacks, particularly Distributed Denial of Service (DDoS) attacks, which can disrupt critical services and cause significant damage. Enhancing network detection capabilities for these attacks is crucial. While deep learning (DL) techniques have achieved high performance in DDoS detection, most existing solutions treat each flow independently. However, DDoS attacks involve multiple hosts and flows, motivating the use of graph representations and Graph Neural Networks (GNNs) for their detection. This paper proposes “CHC-DDoS”, a GNN-based scheme that uses host-connection graphs (HCGs) to represent hosts and their connections. The graph is then input into a GNNs model that accounts for its heterogeneity by employing (1) a message-passing process with a specific Graph Convolutional Network (GCN) for each edge type, and (2) a learnable update function for each node type. A readout function predicts the label of nodes representing flows based on their final embeddings. CHC-DDoS was trained and evaluated using the CIC-DDoS-2019 dataset and stratified k-fold cross-validation, achieving an accuracy of 0.999.