GMCB: An Efficient and Light Graph Analysis Model for Detecting Carpet Bombing DDoS Attacks

Carpet Bombing is a hard-to-detect and more damaging Distributed Denial of Service(DDoS) attack that has dramatically increased in recent years, posing a significant threat to various network infrastructures. Unlike traditional DDoS that attacks only a single IP address, Carpet Bombing attacks target multiple IP addresses within the same subnet. And the low rate but high number of Carpet Bombing usually makes it difficult for traditional DDoS detection systems to detect. In this paper, we propose a detection model for Carpet Bombing, which consists of three phases: graph construction, graph simplification and anomaly detection. In the first two stages, we classify the traffic flows and cluster them to form various graphs where vertices and edges contain the source IPs, destination IPs, and interaction patterns of the traffic flows. Moreover, we remove some vertices and edges in the graph to ensure that the model has high detection efficiency in detecting Carpet Bombing. In the last stage, we select the key vertices and then analyse the interaction patterns of various traffic flows and data distribution characteristics for anomaly detection. To test our model, we get a Carpet Bombing detection dataset by mixing the CICDDoS2019 and MAWI datasets with modifications. And experimental results show that our model significantly outperforms the state-of-the-art detectors for DDoS attacks, with AUC and F1 values of 0.9894 and 0.9927, respectively. Moreover, our model consumes less system resources(mainly memory and CPU) compared to other models.