Detection of DDoS Attacks with Gaussian Mixture Model

A Distributed Denial of Service (DDoS) is an attack which aim is to stop or tamper with an online service incapacitating a server with a flood of packages or requests, using internet or intranet. The main aim of the DDoS attack is to collapse the network or server with abnormal traffic to make the service unavailable for the legitimate users. This problem is particularly profound, due to the development of emerging technologies, such as cloud computing, the Internet of Things or artificial intelligence techniques, from which attackers can take advantage by launching a huge volume of DDoS attacks at a lower cost, and it is much harder to detect and prevent DDoS attacks, because DDoS traffic is similar to normal traffic. In this paper we implement a novel technique implementing an unsupervised Gaussian Mixture Model (GMM) based algorithm. Using a real traffic dataset, the CIC-DDoS2019, for benchmark, the proposed GMM can achieve recall, precision, and accuracy up to 99%. Experiments reveal that this can be a promising solution for the detection of DDoS attacks.