基于一维卷积神经网络的HTTP慢速DoS攻击检测方法

为解决HTTP慢速拒绝服务（SHDoS）攻击流量检测在攻击频率变化时出现的准确率降低的问题，提出一种基于一维卷积神经网络（CNN）的SHDoS攻击流量检测方法。首先，该方法在多种攻击频率下对三种类型的SHDoS攻击流量进行报文采样和数据流提取；之后，设计了一种数据流转换算法，将采集的攻击数据流转换为一维序列并进行去重；最后，使用一维CNN构建分类模型，该模型通过卷积核来提取序列片段，并从片段中学习攻击样本的局部模式，从而使模型对多种攻击频率的数据流都具备检测能力。实验结果显示，与基于循环神经网络（RNN）、长短期记忆（LSTM）网络及双向长短期记忆（Bi-LSTM）网络构建的分类模型相比，该模型对未知攻击频率的样本同样具有较好的检测能力，在验证集上的检测准确率和精确率分别达到了96.76%和94.13%。结果表明所提方法能够满足对不同攻击频率的SHDoS流量进行检测的需求。

Slow HTTP DoS attack detection method based on one-dimensional convolutional neural network

In order to solve the problem that the accuracy of Slow HTTP Denial of Service (SHDoS) attack traffic detection decreases when the attack frequency changes, a method of SHDoS attack traffic detection method based on one-dimensional Convolutional Neural Network (CNN) was proposed. First, the message sampling and data stream extraction were performed on three types of SHDoS attack traffic under multiple attack frequencies by the method. Then, a data stream conversion algorithm was designed to convert the collected attack data streams into one-dimensional sequences and remove the duplicated sequences. Finally, a one-dimensional CNN was used to construct a classification model. The model was used to extract sequence fragments through the convolution kernels, and the local patterns of attack samples were learned from fragments. Therefore, the model would have the ability to detect attack traffic with multiple attack frequencies. Experimental results show that, compared with the classification models based on Recurrent Neural Network (RNN), Long Short-Term Memory (LSTM) network, and Bidirectional LSTM (Bi-LSTM) network respectively, the proposed model has advantages in detection performance on unknown frequency samples, and has the accuracy and precision reached 96.76% and 94.13% respectively on the validation set. It can be seen that the proposed method can meet the needs of detecting SHDoS traffic with different attack frequencies.