1. NDP-FD6:一种 IPv6 网络 NDP 洪泛行为多分类检测框架.
- Author
-
夏文豪, 张连成, 郭毅, 张宏涛, and 林斌“
- Subjects
- *
MACHINE learning , *TRANSFORMER models , *ELECTRONIC data processing , *ACQUISITION of data , *DEEP learning , *DENIAL of service attacks - Abstract
Current researches on NDP flooding behavior detection mainly focus on detecting RA flooding and NS flooding behaviors, and there is insufficient flooding detection for other messages of the NDP protocol. Moreover, traditional threshold rule detection methods suffer from poor dynamics and low accuracy, while most of the Al-based detection methods can only perform binary classification detection, and there are still challenges in performing multi-classification detection. In short, there is a lack of corresponding research in multi-classification flooding detection of all messages of NDP protocol. Therefore, this paper proposed a multi-classification detection framework for NDP protocol flooding behaviors, and proposed a flooding behavior detection method for NDP protocol based on time interval characteristics. The framework constructed the first multiclassification dataset for NDP flooding detection through the processes of traffic collection and data processing, it compared and used 5 machine learning and 5 deep learning algorithms to train the detection model. The experimental results show that the detection accuracy of the XGBOOST algorithm in machine learning can reach 99.18%, and the detection accuracy of the Transformer algorithm in deep learning can reach 98.45%. Compared with the existing detection methods, the accuracy is higher. Meanwhile, the detection framework can detect 9 types of flooding behaviors for all 5 types of messages of NDP protocol and classify the flooding behaviors into multiple types. [ABSTRACT FROM AUTHOR]
- Published
- 2024
- Full Text
- View/download PDF