Search

Low-rate denial-of-service (DoS) attacks, which can exploit vulnerabilities in Internet protocols to deteriorate the quality of service, are variants of DoS attacks. It is challenging to identify low-rate DoS attacks using traditional DoS defence mechanisms due to their low attack rate and stealthy nature. Most of the existing attack detection techniques are based on statistical analysis and signal processing. They usually show a high false negative rate and are only applicable to small-scale data. We propose a new low-rate DoS attack detection scheme based on the self-adaptive density-based spatial clustering of applications with noise (SADBSCAN) algorithm. The SADBSCAN algorithm provides a solution to adaptively identify clusters in multidensity datasets. We use the SADBSCAN algorithm to group network traffic according to the characteristics of the network traffic subject to low-rate DoS attacks. Then, we use cosine similarity to determine whether the groups contain low-rate DoS attacks. To evaluate performance, we conducted experiments and compared the results with those of other detection solutions. The experimental data include data generated by the NS-2 and TestBed simulations and the WIDE public dataset. The results show that our scheme improves the detection accuracy, reduces the false negative rate, and can be adapted to large-scale complex network environments. [ABSTRACT FROM AUTHOR]

Feature selection (FS) is one of the most critical tasks in data mining, which aims to reduce the dimensionality of the data and maximize classification accuracy. The FS problem can be treated as an NP-hard problem. Recently, various swarm intelligent (SI) algorithms have been employed to deal with the FS problem to solve the expensive computation of the exact method. However, the performance of the SI algorithms is limited because these algorithms do not comprehensively take the characteristics of the FS problem into consideration. Therefore, a promising salp swarm algorithm called NCSSA is presented to solve this problem. In NCSSA, multi-perspective initialization strategy, Newton interpolation inertia weight, improved followers' update model and cosine opposition-based learning (COBL) are proposed. In the majority of the SI algorithm-based FS method, the initial search agents are randomly generated or using a single filter method. However, a single filter method has different performance on various datasets. Therefore, a multi-perspective initialization strategy based on minimal redundancy maximal relevance (MRMR) and ReliefF is proposed, which can select the optimal subsets from different perspectives. Furthermore, Newton interpolation inertia weight is presented to balance the algorithm's exploration and exploitation. Compare with the existing inertia weights, the adjustment flexibility of the proposed inertia weight is enhanced. Additionally, the followers update their positions according to the values of ReliefF and MRMR, which can make full use of the relationship between data and labels. Finally, the COBL is introduced to accelerate the convergence rate and helps the algorithm jump out of the local best solutions. The COBL is better than opposition-based learning (OBL) in terms of randomness, and considers the characteristics of the FS problem. The proposed NCSSA is compared to a series of non-SI-based methods and SI-based methods employing the standard datasets from the UCI Machine Learning Repository. Experimental results show that the NCSSA is a promising algorithm for the FS problem. The contribution analysis of each strategy indicates that the COBL is the most effective strategy in improving the SSA. [ABSTRACT FROM AUTHOR]