Using Hybrid Neural Networks to Detect DDOS Attacks

The results of the development of a denial of service network attack detection method for various services of storing, processing, and transmitting data on the Internet are presented. The focus is on the detection of low-level denial of service attacks. The opinion is refuted that special means for detecting denial of service attacks are not required since the fact of a detecting denial of service attacks cannot be overlooked. It is shown that for effective counteraction it is necessary to know the type, nature, and other indicators of a denial of service attack, and distributed attack detection systems allow you to quickly obtain this information. Also, the use of this type of attack detection system can significantly reduce the time it takes to determine the fact of an attack from 2-3 days to several tens of minutes, which reduces the cost of traffic and the downtime of the attacked resource. A hybrid neural network based on the Kohonen network and a multilayer perceptron is used as a detection module. The work of the created prototype of the attack detection system, the methodology for the formation of the training sample, the course of experiments, and the topology of the experimental stand are described. The results of an experimental study of the prototype are presented, during which errors of the first and second kind, respectively.