DDoS Attack Detection Method using Entropy and Attention-based BiGRU

Distributed denial of service (DDoS) attacks have become a major security threat in data center scenarios, and the rapid growth of the traffic volume and the sophistication of DDoS attacks further increases the difficulty of DDoS detection. Most of the existing works are hard to distinguish DDoS attacks from legitimate flash crowds, and suffer from high computational cost in detecting DDoS attacks. In this paper, we propose an efficient DDoS detection method based on Renyi cross entropy and attention-based BiGRU, which uses a prescreening-and-detection framework to detect DDoS attacks quickly and accurately. Firstly, we choose the most essential feature of DDoS and use an efficient entropy-based method to prescreen the traffic to leave only the suspicious flows for further detection, which can help to reduce the computational cost. Secondly, based on the fine-grained traffic behavior characteristics of the suspicious flows, we apply BiGRU model with attention mechanism to detect DDoS attacks accurately. Finally, we conduct a series of experiments and the experimental results demonstrate that our method achieves both high detection accuracy and efficiency.