Detecção de ameaças DDoS com aprendizagem de máquina

Abstract

The exponential development of telecommunications promotes the appearance of several applications that benefit from the high transmission rates. Streaming services and companies that use digital monetary transactions are some examples among the infinity of possible applications based on these technological advances. However, this growing development in telecommunications has had a negative impact: criminals who use high transmission rates to carry out brute force attacks. Among these attacks, a class that has become popular is DDoS attacks, where criminals send multiple requests to the victim to overload their servers, directly impacting the services provided by them. This work proposes two different approaches to perform the task of detecting attacks of this nature: a methodology based on the analysis of time series in the entropy of certain network flow attributes and another approach using principal component analysis in conjunction with artificial neural networks and a support vector machine to perform the classification between normal situations and attack situations. Finally, a comparison will be made between the two proposed approaches using the appropriate metrics.