雲端環境下設計混合式泛濫攻擊防禦機制之研究

雲端運算的虛擬化技術是透過網際網路把計算資源量化後以使用量付費的方式提供給使用者。然而多租戶和共享資源雖是特點，但也隱含資安的風險。在攻擊事件中，造成較嚴重的後果又較難防禦之一就是泛濫攻擊（flooding attack）。為此，本文提出一種基於特徵篩選結合隨機森林分類模型以偵測混合式泛濫攻擊機制，稱為HFADS。此機制主要分為三個模組：（1）資源監控模組：此模組主要的功能在於監控CPU的使用率，當它低於門檻值時以便觸發命令行工具TShark中執行程序擷取網路封包；（2）資料特徵篩選模組：此模組即利用TShark擷取的封包，匯入資料探勘軟體工具Weka後，進行三種特徵的篩選，去除不相關的特徵並選出比重高的特徵後，再由機器學習評估；（3）機器學習評估模組：此模組則使用隨機森林分類模型以偵測UDP、ICMP、HTTP此三類常見的泛濫攻擊。根據上述三個模組進行模擬實驗，提出精確率、召回率、總正確率和平均處理時間等四種關鍵績效指標並與Alkasassbeh等（M.A.）所提出的隨機森林演算法以偵測混合式泛濫攻擊進行模擬比較，實驗結果顯示本文所提出的HFADS機制比M.A.在偵測網路層UDP、ICMP和應用層HTTP（使用TCP）等通訊協定上，均有較佳的精確率與召回率外，以及其總正確率為99.98%提升了2%和平均處理時間為65.34秒亦改善了5.14%。

關鍵字

雲端運算； HFADS ；混合式泛濫攻擊；特徵選擇；機器學習

並列摘要

Purpose-Cloud computing is integrated lots of computing resources which are provided to users over the internet on a Pay-As-You-Go mode. While multi-tenants and resources sharing are its advantages under the cloud computing environment, it also brings new risks in information security. One of the more difficult consequences of an attack is a flooding attack. Hence, this paper proposes a new scheme: HFADS for detecting and resolving the hybrid flooding attacks. Design/methodology/approach-Based on the existing DDoS detection technology, this paper enhances the Alkasassbeh et al.'s (M.A.) Random Forest algorithm and combines feature selection and random forest classification to propose a new scheme HFADS for detecting and resolving the hybrid flooding attacks. The proposed HFADS scheme is mainly divided into three modules: (1) Resource Monitor Module, (2) Data Feature Selection Module and (3) Machine Learning Evaluation Module: Findings - Based on three modules in HFADS, we did perform some simulations to analyze and compare with Alkasassbeh et al. (M.A.) to detect hybrid flood attacks according to four key performance indicators including precision rate, recall rate, total accuracy rate and average processing time. The final experimental results indicate that HFADS has better precision rate and recall rate than the method of M.A. for detecting the protocols: UDP, ICMP and HTTP (with TCP). In addition, the HFADS can obtain 99.98% and 65.34 Seconds in total accuracy rate and average processing time, respectively, thus to increase the 2% in total accuracy rate and shorten the 5.14% in average processing time than the M.A. method. Research limitation/implications - The hybrid flooding attacks are assumed to be exhausted the network bandwidth and the computing resources of the server, causing the server to fail to provide services due to heavy workload and may affect the service. Other servers in the same infrastructure cause unpredictable losses. Practical implications-The HFADS scheme is mainly divided into three modules: (1) Resource Monitor Module: This module is to monitor the CPU utilizations to trigger script procedure in a command-line tool TShark in which is to capture network packets, when the CPU usage ratio is lower than threshold value. (2) Data Feature Selection Module: This module uses the network traffic drawn by TShark and imports it into data mining tool Weka to perform three feature selections, remove irrelevant features and select features with high proportion, and then evaluate by machine learning. (3) Machine Learning Evaluation Module: This module utilizes a random forest classification model to detect three common types of flooding attacks: UDP, ICMP, and HTTP. Originality/value-The proposed HFADS scheme is to combine feature selection and random forest classification to enhance the method of M.A. for detecting and resolving the hybrid flooding attacks. The final experimental results prove that HFADS are much better and more efficient than the method of M.A. in terms of precision rate, recall rate, total accuracy rate, and average processing time.

並列關鍵字

cloud computing ； HFADS ； hybrid flooding attacks ； features selection ； machine learning

參考文獻

Somani, G., Gaur, M.S., Sanghi, D., Conti, M. and Buyya, R. (2017), ‘DDoS attacks in cloud computing: Issues, taxonomy, and future directions’, Computer Communications, Vol. 107, pp. 30-48.

Google Scholar

TechRepublic (2018), ‘GitHub hit with massive 1.35 Tbps DDoS attack, could be world@@$$s largest’, https://www.techrepublic.com/article/github-hit-with –massive-1-35-tbps-ddos-attack-could-be-worlds-largest/

Google Scholar

Wikipedia contributors (2016), ‘Random forest’, https://en.wikipedia.org/wiki/Random_forest

Google Scholar

Wikipedia contributors (2018), ‘Feature selection’, https://en.wikipedia.org/wiki/Feature_selection

Google Scholar

Wikipedia contributors (2018), ‘DDoS’, https://zh.wikipedia.org/wiki/%E9%98%BB%E6%96%B7%E6%9C%8D%E5%8B%99%E6%94%BB%E6%93%8A

Google Scholar

國際替代計量

雲端環境下設計混合式泛濫攻擊防禦機制之研究

全文下載

主題瀏覽