DDoS Attack Detection Based on CNN and Federated Learning

Dingyang Lv, Xinyu Cheng, Jinghui Zhang, Wei Zhang, Wei Zhao, He Xu

Abstract: Distributed Denial of Service (DDoS) attack, which seriously affects the availability of the Internet, is one of the most dangerous network attacks. Machine learning is widely used in DDoS attack detection. However, due to data privacy and transmission overhead problems, the traffic data distributed on different network devices will not be easily concentrated together, which leads to difficulties in model training. In this paper, we combine federated learning (FL) and neural network and propose a FLDDoS system to counter DDoS attacks. We designed a CNN model and a data preprocessing algorithm to fully mine the features of DDoS traffic data. The federated learning framework is used for the model training, which can make full use of the data and computing performance of the terminal devices, and protect the data privacy. In addition, we also consider non-IID cases of the data and use a model mixing approach to provide a more personalized model for each client. The experimental results show that the proposed FLDDoS has a good performance. The accuracy of DDoS attack detection and multiclass classification is 99% and 90%, respectively. And the personalized method can overcome the non-IID problem of data in FL effectively. The accuracy of the CNN model proposed in this paper is 20% higher than that of the traditional model. Under the condition of using the same model, the model accuracy obtained by FL is basically the same as that obtained by centralized training.