Machine Learning for DDoS Attack Classification Using Hive Plots

Abstract

Cyberattacks have been on the increase as computing power and data storage have become more accessible. The use of recent advances in machine learning across different fields has increased the potential adoption of new algorithms in solving important technological problems. In this paper we describe a novel application of machine learning for the detection and classification of distributed denial of service (DDoS) cybersecurity attacks. Attack pattern training data is obtained from honeypots which we created to impersonate various APIs on a cloud computing network. Attack characteristics including source IP address, country of origin, and time of attack are collected from our honeypots and visualized using a three-axis hive plot. We then implemented and trained a non-probabilistic binary linear attack pattern classifier. A support vector machine and a convolutional neural network were trained using a supervised learning model with labeled data sets. Experimental results suggest that our models can detect DDoS attacks with high accuracy rates.