An intelligent behavioral-based DDOS attack detection method using adaptive time intervals

Dealing with network attacks is becoming more uphill as we go further due to the complexity of computer networks. Among all the network attacks, DDoS attacks are widespread and challenging to detect. Because launching these attacks requires no vulnerability in the target network and they are like legitimate traffic, there is no certain solution for detecting them. Analyzing network users’ behavior can be a well-founded solution for detecting anomalies in network resource usage. Since, in most networks, the users’ behavior differs at different times of the day, in this paper, we proposed a DDoS attack detection method that clusters the network users’ behavior based on adaptive time intervals in a single day. Our contribution is introducing the Timestamp feature as a primary indicator of normal behavior during different times of the day. Time intervals are computed adaptively by clustering the network IP flow using DBSCAN. This process leads to the extraction of a new feature that helps to detect DDoS attacks more accurately. To demonstrate the importance and impact of our new feature, several attack classification models have been trained using prevalent shallow machine algorithms such as Support Vector Machine (SVM), Random Forest (RF), and XGBoost. The method is also validated with the CICDDoS2019 and the CICIoT2023 datasets, which are the most popular and latest DDoS attack datasets. The results showed that our new feature has improved the evaluation metrics impressively with both datasets.