Power Communication System DDoS Attack Detection Based on ARIMA-CNN Model

Distributed Denial of Service (DDoS) attack is a hidden danger of electric power communication system. In order to fix the issue of poor detection effect of traditional machine learning methods and low real-time performance of deep learning methods in DDoS attack detection research, we proposed a DDoS traffic detection method combining Autoregressive Differential Moving Average model (ARIMA) and Lightweight Convolutional Neural Network (LWCNN). This method uses ARIMA model to regression model the traffic, filters out most of the normal traffic, and then uses LWCNN model to further detect and classify the remaining traffic, which effectively improves the performance on the basis of reducing the amount of model calculation. As a regression model, ARIMA has good computational performance, and can achieve a high recall rate of DDoS traffic through threshold adjustment. The LWCNN model reduces the complexity of the model by depthwise separable convolution, and compensates the feature extraction ability of the network by residual connection. Experiments show that the combination of the two methods can effectively improve the detection effect and performance, so that the model is close to the machine learning algorithm in performance, and close to the deep learning algorithm in effect.