An efficient DDoS detection method based on packet grouping via online data flow processing

Distributed Denial of Service attacks are considered to be one of the most common and effective threats in the security field, aiming to deny or weaken the service providing of its victims. Most traditional solutions are only for DDoS detection in offline scenarios, which are challenging to detect real-time DDoS attacks. Therefore, the application scenarios are limited. In this paper, we propose a packet grouping-based DDoS detection method, which uses an online data flow processing mechanism to focus on data collection and processing efforts, which is suitable for online and offline detection. The proposed method simulates the process of real-time packet capture by grouping packets through a time window and realizes the binary classification of traffic through the lightweight CNN model. Most crucially, selecting the optimal number of packets per time window minimizes the time overhead without affecting detection accuracy. To further improve the accuracy in offline scenarios, we perform ensemble learning on the prediction results of packet groups. The proposed method attains 99.99% accuracy on the CICIDS2017 offline dataset and demonstrates a latency of only 1.05 seconds with a 99.86% accuracy in online testing, surpassing other methods in terms of response speed.