一种混合机器学习方法,用于检测软件定义网络中的DDoS攻击
Iftekhar Ahmed Mahar1, Kamran Aziz2, Prasun Chakrabarti3
1School of Computer Science, Wuhan University, Wuhan, 430000, China.
Scientific reports
|January 28, 2026
概括
本研究介绍了一种机器学习框架,用于在软件定义网络 (SDN) 中检测分布式拒绝服务 (DDoS) 攻击. 一种混合的Random Forest-XGBoost模型实现了99.36%的准确性,为可编程网络提供可靠的早期检测.
科学领域:
- 计算机科学 计算机科学
- 网络安全 网络安全
- 机器学习 机器学习
背景情况:
- 软件定义网络 (SDN) 提供了可编程性,但引入了分布式拒绝服务 (DDoS) 等攻击的漏洞.
- 现有的检测方法往往缺乏SDN环境的特异性,需要SDN意识到的流量特征.
- 基于OpenFlow的网络需要量身定制的方法来有效识别威胁.
研究的目的:
- 在SDN中开发和评估用于早期DDoS攻击检测的机器学习框架.
- 为改进威胁识别设计新的SDN特定流量功能.
- 评估混合随机森林 (RF) 和XGBoost (XGB) 分类模型的性能.
主要方法:
- 从使用Ryu控制器和Open vSwitch的SDN测试平台构建了一个数据集.
- 通过OpenFlow监控消息收集流量和端口级统计数据.
- 设计了SDN特定的功能,并开发了一个混合RF-XGB分类模型.
主要成果:
- 混合RF-XGB模型在区分良性流量和恶意流量方面实现了99.36%的准确性.
- 与个人随机森林和XGBoost分类器相比,表现优越.
- 在接受器操作特征 (ROC) 曲线下面的区域 (AUC) 和混矩阵评估中显示出近乎完美的歧视.
结论:
- 将SDN特定的功能工程与集体学习 (RF-XGB) 结合起来,对于早期DDoS检测非常有效.
- 拟议的框架为增强可编程网络安全提供了可靠的解决方案.
- SDN意识的功能对于准确识别复杂的网络威胁至关重要.
相关概念视频
Sequence Networks of Rotating Machines
488
A Y-connected synchronous generator, grounded through a neutral impedance, is designed to produce balanced internal phase voltages with only positive-sequence components. The generator's sequence networks include a source voltage that is exclusively in the positive-sequence network. The sequence components of line-to-ground voltages at the generator terminals illustrate this configuration.
Zero-sequence current induces a voltage drop across the generator's neutral impedance and other...
Zero-sequence current induces a voltage drop across the generator's neutral impedance and other...
488
Acid Attack on Concrete
750
When acids come into contact with concrete, they initiate a chemical reaction that dissolves the hydrated cement paste. This process leads to softening and structural weakening of the concrete. This issue is commonly observed in environments such as chimneys, sewers, and industrial settings. The severity of the damage increases as the pH of the water interacting with the concrete drops below 6.5. In particular, a pH under 4.5 can cause significant concrete damage.
The rate at which hydrogen...
The rate at which hydrogen...
750
Network Covalent Solids
16.2K
Network covalent solids contain a three-dimensional network of covalently bonded atoms as found in the crystal structures of nonmetals like diamond, graphite, silicon, and some covalent compounds, such as silicon dioxide (sand) and silicon carbide (carborundum, the abrasive on sandpaper). Many minerals have networks of covalent bonds.
To break or to melt a covalent network solid, covalent bonds must be broken. Because covalent bonds are relatively strong, covalent network solids are typically...
To break or to melt a covalent network solid, covalent bonds must be broken. Because covalent bonds are relatively strong, covalent network solids are typically...
16.2K
Sulfate Attack on Concrete
730
Sulfate attack on concrete is a deterioration process characterized by a whitish discoloration beginning at the edges and corners, accompanied by cracking and spalling. This phenomenon occurs when sulfates react with the components of hardened concrete, forming compounds like calcium sulfate and calcium sulfoaluminate which occupy more space than the substances they replace, causing the concrete to expand and disrupt.
Sulfates from sources like soil, groundwater, or industrial effluents...
Sulfates from sources like soil, groundwater, or industrial effluents...
730
Hybrid Zones
21.8K
Hybrid zones are narrow regions where two closely related species interact, mate, and produce hybrids. Relative to either parent species, hybrids may possess distinct phenotypic or genetic differences that impact their survival and reproductive success. The genetic variances introduced by hybridization influence species diversity and speciation processes within the hybrid zone.
21.8K
Protein Networks
4.5K
An organism can have thousands of different proteins, and these proteins must cooperate to ensure the health of an organism. Proteins bind to other proteins and form complexes to carry out their functions. Many proteins interact with multiple other proteins creating a complex network of protein interactions.
These interactions can be represented through maps depicting protein-protein interaction networks, represented as nodes and edges. Nodes are circles that are representative of a protein,...
These interactions can be represented through maps depicting protein-protein interaction networks, represented as nodes and edges. Nodes are circles that are representative of a protein,...
4.5K


