Developing approaches to increase the robustness of machine learning models for detecting distributed denial of service attacks

Abstract

This paper analyzes and develops approaches to improve the resilience of machine learning models used to detect distributed denial of service attacks to adversarial attacks. To improve the resilience of machine learning models, the training set was augmented with relevant examples obtained using the GAN model generator. The 2019 DDoS Evaluation Dataset (CIC-DDoS2019) is used as a dataset. The dataset was developed by the Canadian Institute for Cybersecurity (CIC) and is intended for use in research and development in the field of DDoS attack detection and prevention. The data contains 128,027 attack sets and 97,718 normal requests. The abnormal requests contain various types of DDoS attacks, such as SYN flood, UDP flood, ICMP flood, and HTTP flood. Supervised learning is used. The transformation of sample feature values is implemented. XGBoost gradient boosting, which shows good results on standard metrics, is chosen as a model. An analysis of adversarial attacks was performed on the model trained on the original training dataset and on the model trained on an extended dataset supplemented with relevant examples generated using the GAN model over the training data. The generator was the G-part of the Wasserstein GAN network with a gradient penalty (WGAN-GP). To perform adversarial black box attacks, a modified ART library of the ZooAttack class was used. To preserve the semantics of malicious data, a modification of the library from IBM Adversarial Robustness Toolbox (ART) was performed. Standard quality metrics for models were used. The results obtained show that adding relevant examples to the training set increases the model's resistance to adversarial attacks. However, at 200 iterations, even a more robust model could not show quality comparable to the original test set, which suggests that with sufficient time and unlimited access to the model's inputs and outputs, it is possible to select adversarial examples on which the classifier will make mistakes.