Design and Performance Evaluation of a Two-Stage Detection of DDoS Attacks Using a Trigger with a Feature on Riemannian Manifolds

The DDoS attack remains one of the leading attacks today. To reduce the number of resource-consuming detection algorithm calls, the trigger-based two-stage detection approach has been proposed. In such systems, trigger mechanisms, including trigger features and threshold update algorithms, play an important role in detection performance. It is also important what features are used in the second stage of detection. In this study, 1) we introduce a Riemannian manifold metric (work) as a trigger feature for the first time since it was proven that traffic data is a Riemannian manifold; 2) we propose a new mechanism to update the trigger threshold based on historical flow data and the feedback of the second-stage detection results; 3) the feature selection algorithm ECOFS is used for the second stage detection. Experimental results using public datasets show that our proposal calls much less of the second-stage detection than the latest trigger-based two-step detection systems.