Machine Learning for QUIC Traffic Flood Detection

In order to ensure dependability of connected devices, machine learning is used in the analysis of network traffic to enable faster detection of abnormal behavior and congestion. The use of machine learning techniques enhances the capacity for handling traffic and helps to maintain service quality. Additionally, the purpose of machine learning on securing networks is to detect anomalies, classify traffic in real time, in order to optimize network performance and detect potential threats. This work emphasizes the positive impact of employing machine learning techniques to enhance network reliability and security. Our contributions include an analysis of sample traffic interacting with a web server using HTTP/3. We applied machine learning algorithms to distinguish between normal traffic and potential HTTP/3 flood. Additionally, we created a dataset of traffic samples with 23 features classified into six subcategories. From traffic captured from an emulated environment, we also assessed the relevance of these features and find that leveraging machine learning techniques has the potential to significantly improve both network security and reliability. We used four supervised classification algorithms, namely Support Vector Machine (SVM), Logistic Regression, Random Forest, and K-Nearest Neighbors (KNN). These algorithms are a type of supervised classification algorithm. They were instrumental in training datasets of network traffic, which were meticulously labeled to differentiate between Distributed Denial-of-Service (DDoS) attacks and regular traffic. The findings of this study showcase the effectiveness of machine learning algorithms when applied to network traffic for detecting specific types of DDoS attacks, particularly those utilizing QUIC traffic. This demonstrates the considerable potential of machine learning techniques in bolstering the overall security and dependability of networks.