{'fraction_non_alphanumeric': 0.018556701030927835, 'fraction_numerical': 0.0027491408934707906, 'mean_word_length': 5.358078602620087, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Source-side DoS attack detection with LSTM and seasonality embedding

As the denial of service attacks become sophisticated, source-side detection methods are being studied to address the limitation of target-side detection methods such as delayed detection and difficulty in tracking an attacker. Recently, some source-side detection methods are studied to use the adaptive attack detection threshold by considering seasonal behavior of network traffic. However, recent network traffic usage patterns have become irregular, and the performance of the adaptive threshold technique has deteriorated due to the increase in randomness and burstiness of the traffic. In this paper, an LSTM(Long Short Term Memory) based source-side DoS attack detection technique is proposed in order to keep high performance under irregular seasonal traffic usage. The proposed LSTM based detection model was designed with the input feature vector consisting of an index of unit time, a normal traffic volume, and a traffic trend. Specifically, in order to make LSTM learn irregular seasonal pattern effectively, several embedding methods were proposed to embed the irregular seasonal pattern as a traffic trend of the input vector. Through extensive experiments with actual network traffic, it is observed that the proposed LSTM-based technique achieved high attack detection rate of 92% and a low false positive rate of 20% under a network with irregular and burst traffic.