DITFEC: Drift Identification in Traffic-Flow Streams for DDoS Attack Defense Through Ensemble Classifier

Abstract

The overwhelming of the request flow beyond the target server capacity leads to the service denial to the legitimate users. Because of the server’s oversized potential, the act of flooding requests beyond the server capacity is carried by the malicious attackers from distributed environment called distributed denial-of-service attack. Hence, applying the knowledge gained from the findings of previous request distributions research works seems to be the suitable strategy to cease the DDOS attacks. This strategy indispensable limitation is skipping to detect the new patterns of request flooding dug by the attacker at the server from the previous knowledge on earlier attack distribution patterns. Therefore, this paper endeavors to contribute on how to handle the limitation by proposing a novel-trained ensemble classifier with new features which reflects in the traffic-flow properties, so that the traffic-flow tuple shows distribution diversity from each other which is considered and attached to individual classifier. With the application of KS test, the proposed model tries to find the distribution diversity among the traffic-flow tuples using the features set. Later, the similar policy is used to discover the distribution resemblance amid the renewed tuple as well as the tuples involved to the multiple classifiers in the ensemble classification model. The experiment worked out on the voluminous traffic flow with visible distribution variety.