Trusted Multi-Domain DDoS Detection Based on Federated Learning.

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Existing distributed denial of service (DDoS) detection methods suffer from single detection targets, incomplete datasets, and privacy concerns.
• Federated learning offers a privacy-preserving approach but requires robust mechanisms against malicious participants and data poisoning.

Purpose of the Study:

• To propose a trusted multi-domain DDoS detection method using federated learning.
• To enhance the comprehensiveness of DDoS detection while preserving data privacy across domains.
• To improve the robustness of federated learning against poisoning attacks through a novel reputation evaluation system.

Main Methods:

• Dividing DDoS attacks into sub-types and designing federated learning datasets for each domain.
• Implementing a blockchain-based reputation evaluation system (interaction, data, resource reputation) to identify trusted and malicious participants.
• Combining multi-domain detection with a distributed knowledge base and designing a malicious behavior feature graph.

Main Results:

• The multi-domain DDoS detection method achieves over 95% accuracy for most attack categories while protecting dataset privacy.
• The proposed reputation evaluation method effectively identifies malicious participants in the face of data poisoning attacks, especially with a threshold of 0.6.
• The feature graph enhances the memory of multi-domain feature knowledge for improved detection.

Conclusions:

• The proposed federated learning approach provides a comprehensive and privacy-preserving solution for multi-domain DDoS detection.
• The blockchain-based reputation system significantly enhances the security and trustworthiness of federated learning in DDoS detection.
• The integration of multi-domain detection and knowledge graphs offers a promising direction for advanced network security.