DDoS detection based on graph structure features and non‐negative matrix factorization.

Distributed denial of service (DDoS) attacks are the most common and harmful attack in the field of network security, the purpose of this paper is to predict the occurrence of DDoS attacks quickly, accurately and effectively. In this paper, the characteristics of DDoS attacks are analyzed in detail, graph model is used to express the structural characteristics of traffic data between the victims and bots, at the same time, considering data characteristics of traffic itself, 11 characteristics are selected at last. The method of nonnegative matrix factorization (NMF) is adopted to mine the behavior pattern of DDoS attacks, and then the DDoS bots is detected by clustering according to the projection value of nodes on the behavior pattern. By extracting the attack behavior pattern, the attack behavior can be detected. Experimental results of real dataset verify the effectiveness and validity of the method. [ABSTRACT FROM AUTHOR]