Multi-view DDoS Network Flow Feature Extraction Method via Convolutional Neural Network

Distributed Denial of Service (DDoS) has caused tremendous damage to the network in large data environment. The features extracted by existing feature methods can not accurately represent the characteristics of network flow, and have the characteristics of high false alarm rate and high false alarm rate. This paper presents a multi-view distributed denial of service attack network flow feature extraction method based on convolutional neural network. According to the different characteristics of attack flow and normal flow in TCP/IP protocol, the related attributes of network flow are transformed into binary matrix, and the IP address and port number are reorganized into dual-channel matrix. Then, the multi-view perspective is composed of IP dual-channel matrix, port number dual-channel matrix, packet size grayscale matrix and TCP flag grayscale matrix. According to the characteristics of each attribute, different convolutional neural network models are used to extract the local features of each view, and the extracted local features are fused to form quaternion features to describe the characteristics of network flow. We use MVNFF to train the model, a distributed denial of service (DDoS) classifier based on multiple views is constructed. Experiments show that the features extracted by this method can more accurately represent the characteristics of network traffic and it can improve the robustness of the classifier and reduce the false alarm rate and false alarm rate.