DDoS Attack Detection Model Parameter Update Method Based on EWC Algorithm

Bin ZHANG; Yitao ZHOU

doi:10.11999/JEIT200682

Volume 43 Issue 10

Oct. 2021

Turn off MathJax

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2021 > 43(10): 2928-2935

Jiaao YU, Shirui PENG, Xiaokun CHEN, Youquan LI. Equivalent Circuit Method for Hexagonal Loop Composite Absorbing Material[J]. Journal of Electronics & Information Technology, 2018, 40(8): 1873-1878. doi: 10.11999/JEIT171103

Citation:

Bin ZHANG, Yitao ZHOU. DDoS Attack Detection Model Parameter Update Method Based on EWC Algorithm[J]. Journal of Electronics & Information Technology, 2021, 43(10): 2928-2935. doi: 10.11999/JEIT200682

Citation:

PDF( 1814 KB)

DDoS Attack Detection Model Parameter Update Method Based on EWC Algorithm

doi: 10.11999/JEIT200682

Bin ZHANG,
Yitao ZHOU^,

1.
PLA SSF Information Engineering University, Zhengzhou 450001, China
2.
Henan Key Laboratory of Information Security, Zhengzhou 450001, China

Funds: The Foundation and Frontier Technology Research Project of Henan Province (142300413201), The Open Fund Project of Information Assurance Technology Key Laboratory (KJ-15-109), The Research Project of Information Engineering University (2019f3303)

Received Date: 2020-08-04
Rev Recd Date: 2021-07-21

Available Online: 2021-09-06

Publish Date: 2021-10-18

Abstract

Abstract

For the problem in the existing Multi-Layer Perceptron (MLP) based DDoS detection model parameter update method that the old model parameter training dataset knowledge is forgettable and the time and space complexity are enormous, a novel model parameter UpDate method EWC-UD based on Elastic Weight Consolidation (EWC) is proposed. Firstly, the cluster center points of the old dataset are calculated as the calculation samples of Fisher information matrix by the K-Means algorithm. The coverage rates of clusters and sampling uniformity are raised effectively, which significantly reduces the amount of Fisher Information Matrix calculation and improves the efficiency of the model parameter updates. Secondly, according to the calculated Fisher information matrix, a secondary penalty item is added to the loss function, limiting the important weight and bias parameter changes in the neural network. Maintaining the detection performance of the old DDoS attack dataset, EWC-UD improves the detection accuracy of the new DDoS attack datasets. Then based on probability theory, the correctness of EWC-UD is proved, and the time complexity is analyzed. Experiments show that for the constructed test dataset, the detection accuracy of EWC-UD is 37.05% higher than the MLP-UD that only trains the new DDoS attack dataset, and compared with the time MLP-UD training both new and old DDoS attack datasets, the time and memory costs are reduced by 80.65% and 33.18 respectively.
- Distributed Denail of Service (DDoS),
- Model parameter update,
- Elastic Weight Consolidation (EWC) algorithm,
- Multi-Layer Perceptron (MLP)

FullText(HTML)

References(16)

References

[1]	WANG Meng, LU Yiqin, and QIN Jiancheng. A dynamic MLP-based DDoS attack detection method using feature selection and feedback[J]. Computers & Security, 2020, 88: 101645. doi: 10.1016/j.cose.2019.101645
[2]	董书琴, 张斌. 基于深度特征学习的网络流量异常检测方法[J]. 电子与信息学报, 2020, 42(3): 695–703. doi: 10.11999/JEIT190266 DONG Shuqin and ZHANG Bin. Network traffic anomaly detection method based on deep features learning[J]. Journal of Electronics &Information Technology, 2020, 42(3): 695–703. doi: 10.11999/JEIT190266
[3]	KEMKER R, MCCLURE M, ABITINO A, et al. Measuring catastrophic forgetting in neural networks[J]. arXiv preprint, arXiv: 1708.02072, 2017.
[4]	KUMARAN D, HASSABIS D, and MCCLELLAND J L. What learning systems do intelligent agents need? Complementary learning systems theory updated[J]. Trends in Cognitive Sciences, 2016, 20(7): 512–534. doi: 10.1016/j.tics.2016.05.004
[5]	POLIKAR R, UPDA L, UPDA S S, et al. Learn++: An incremental learning algorithm for supervised neural networks[J]. IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews) , 2001, 31(4): 497–508. doi: 10.1109/5326.983933
[6]	ZRIBI M and BOUJELBENE Y. The neural networks with an incremental learning algorithm approach for mass classification in breast cancer[J]. Biomedical Data Mining, 2016, 5(118): 2. doi: 10.4172/2090-4924.1000118
[7]	SHIOTANI S, FUKUDA T, and SHIBATA T. A neural network architecture for incremental learning[J]. Neurocomputing, 1995, 9(2): 111–130. doi: 10.1016/0925-2312(94)00061-V
[8]	GEPPERTH A and HAMMER B. Incremental learning algorithms and applications[C]. The 24th European Symposium on Artificial Neural Networks, Bruges, Belgium, 2016: 357–368.
[9]	MALLYA A, DAVIS D, and LAZEBNIK S. Piggyback: Adapting a single network to multiple tasks by learning to mask weights[C]. The 15th European Conference on Computer Vision, Munich, Germany, 2018: 72–88. doi: 10.1007/978-3-030-01225-0_5.
[10]	PÉREZ-SÁNCHEZ B, FONTENLA-ROMERO O, GUIJARRO-BERDIÑAS B, et al. An online learning algorithm for adaptable topologies of neural networks[J]. Expert Systems with Applications, 2013, 40(18): 7294–7304. doi: 10.1016/j.eswa.2013.06.066
[11]	KIRKPATRICK J, PASCANU R, RABINOWITZ N, et al. Overcoming catastrophic forgetting in neural networks[J]. Proceedings of the National Academy of Sciences of the United States of America, 2017, 114(13): 3521–3526. doi: 10.1073/pnas.1611835114
[12]	CASTRO F M, MARÍN-JIMÉNEZ M J, GUIL N, et al. End-to-end incremental learning[C]. The 15th European Conference on Computer Vision, Munich, Germany, 2018: 241–257. doi: 10.1007/978-3-030-01258-8_15.
[13]	Canadian Institute for Cybersecurity. CIC-DoS-2016[EB/OL]. https://www.unb.ca/cic/datasets/dos-dataset.html, 2020.
[14]	Canadian Institute for Cybersecurity. CES-DDoS-2017[EB/OL]. https://www.unb.ca/cic/datasets/ids-2017.html, 2020.
[15]	Canadian Institute for Cybersecurity. CES-CIC-IDS2018-AWS[EB/OL]. https://www.unb.ca/cic/datasets/ids-2018.html, 2020.
[16]	SHARAFALDIN I, LASHKARI A H, HAKAK S, et al. Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy[C]. 2019 International Carnahan Conference on Security Technology, Chennai, India, 2019: 1–8. doi: 10.1109/CCST.2019.8888419.

Relative Articles

Supplements(0)

Cited By

Cited by

Periodical cited type(7)

1.	张聿远，闫文君，张立民. 基于多模态特征融合网络的空时分组码识别算法. 电子学报. 2023(02): 489-498 .
2.	张聿远，闫文君，林冲，姚成柱. 利用卷积-循环神经网络的串行序列空时分组码识别方法. 信号处理. 2021(01): 19-27 .
3.	张聿远，闫文君，张立民，张媛. 基于卷积神经网络的串行空时分组码盲识别算法. 系统工程与电子技术. 2021(11): 3360-3370 .
4.	闫文君，张聿远，凌青，于柯远，谭凯文，刘恒燕. 基于频域互相关序列与峰值检测的空频分组码盲识别算法. 系统工程与电子技术. 2021(12): 3709-3715 .
5.	张天骐，范聪聪，喻盛琪，赵健根. 基于JADE与特征提取的正交/非正交空时分组码盲识别. 系统工程与电子技术. 2020(04): 933-939 .
6.	方伟，闫文君，凌青，张立民. 传输损耗条件下基于循环平稳检测的空时分组码盲识别方法. 计算机与现代化. 2018(02): 6-11 .
7.	黄波，潘爽，李雪. 基于四阶循环平稳的STBC-OFDM信号盲识别. 信号处理. 2017(09): 1221-1229 .