Filtering DDoS Attacks from Unlabeled Network Traffic Data Using Online
  Deep Learning
  DDoS attacks are simple, effective, and still pose a significant threat even
after more than two decades. Given the recent success in machine learning, it
is interesting to investigate how we can leverage deep learning to filter out
application layer attack requests. There are challenges in adopting deep
learning solutions due to the ever-changing profiles, the lack of labeled data,
and constraints in the online setting. Offline unsupervised learning methods
can sidestep these hurdles by learning an anomaly detector $N$ from the
normal-day traffic ${\mathcal N}$. However, anomaly detection does not exploit
information acquired during attacks, and their performance typically is not
satisfactory. In this paper, we propose two frameworks that utilize both the
historic ${\mathcal N}$ and the mixture ${\mathcal M}$ traffic obtained during
attacks, consisting of unlabeled requests. We also introduce a machine learning
optimization problem that aims to sift out the attacks using ${\mathcal N}$ and
${\mathcal M}$. First, our proposed approach, inspired by statistical methods,
extends an unsupervised anomaly detector $N$ to solve the problem using
estimated conditional probability distributions. We adopt transfer learning to
apply $N$ on ${\mathcal N}$ and ${\mathcal M}$ separately and efficiently,
combining the results to obtain an online learner. Second, we formulate a
specific loss function more suited for deep learning and use iterative training
to solve it in the online setting. On publicly available datasets, our online
learners achieve a $99.3\%$ improvement on false-positive rates compared to the
baseline detection methods. In the offline setting, our approaches are
competitive with classifiers trained on labeled data.
