Detection of Distributed Denial-of-Service Attacks Using Maching Learning

Cyber napadi postali dio svakodnevnog života, a jedni od njihovih najčešćih oblika su napadi uskraćivanjem usluge. U ovom radu objašnjeno je kako funkcioniraju napadi uskraćivanjem usluge, posebno oni distribuirani, te je dan pregled vrsta takvih napada i odgovarajućih načina obrane. Nadalje, uz pregled postojećih tehnika obrane koji koriste strojno učenje, predložili smo i svoj pristup. Fokusirali smo se na volumetričke napade, točnije napade SYN, ICMP i UDP poplave. Za potrebe rada generirali smo vlastiti skup podataka. Model koji je korišten bio je k-najbližih susjeda. Model je, s obzirom na svoju jednostavnost, pokazao zadovoljavajuće ponašanje na stvarnim podacima.The number of cyber attacks has been encreasing recently. One of the most common type of cyber attack is denial of service. This paper explains how denial of service attacks work, especially distributed denial of service attacks. An overview of this kind of attacks is given along with the defending mechanisms. Furthermore, an overview of existing defense mechanisms is given, and a new approach is suggested. The focus was placed on flooding attacks, such as SYN, ICMP and UDP floods. New dataset was generated. Used model was k-nearest neighbours. With regard to its simplicity, experimental results were satisfying