基於機器學習之分散式阻斷攻擊偵測與分類之FPGA系統分析與實現

隨著網際網路的快速發展與分散式阻斷攻擊的日益猖獗，如何在最短的時間內偵測出攻擊的種類並做出對應的措施一直是網路安全領域重要的研究課題。本論文對現有的分散式阻斷攻擊資料集以流量合成的手法進行資料擴增，以提供足夠的資料變異性訓練機器學習模型。提出"基於原始資訊"與"基於統計值"兩種特徵的機器學習模型，在攻擊分類上皆取得了良好的結果，並於 Xilinx Alveo U200 上實現具備處理 100Gbps 網路流量之分散式阻斷攻擊之偵測與分類神經網路 RTL 設計。最後進一步討論兩種模型於硬體實現的資源消耗與成本。

關鍵字

分散式阻斷攻擊偵測；機器學習； FPGA加速； NetFPGA

並列摘要

With the increasing threat of Distributed Denial-of-Service(DDoS) attacks, detecting and responding to the attacks in the shortest possible time has been an important research topic in network security. In this dissertation, we propose machine learning models based on the features of the raw packet header, empirical Shannon entropy, and statistical-based attributes. The data augmentation on an existing DDoS attack dataset is performed by synthesizing the background network traffic to provide sufficient data variability for training and testing these machine learning models.Moreover, we also present the RTL implementation of selected neural network models to conduct the DDoS detection and classification on the Xilinx Alveo U200 FPGA, which can handle 100Gbps throughput of network traffic. We further present the discussion and compare the performance with implementation costs. Discussions and insightful comments are also provided for future works.