A hybrid deep learning model based low-rate DoS attack detection method for software defined network

The low-rate DoS (LDoS) attack is a new kind of network attack which has the characteristics such as low speed and good concealment. The software defined network, as a new type of network architecture, also faces the threat from LDoS attacks. In this article, we propose a detection method of LDoS attacks based on a hybrid deep learning model CNN-GRU: the convolutional neural network (CNN) and the gated recurrent unit (GRU). First, we extract field values such as n_packets and n_bytes, from the flow rule, and construct the average numbers of packets and bytes as the input data of the hybrid model. Then, to enhance the detection performance of the hybrid model, we improve the sailfish algorithm to optimize the hyperparameters of CNN and GRU automatically in the training process. Finally, we adopt hyperparameter optimized CNN and GRU to extract deeper spatial and temporal features of input data, respectively, which achieves accurate detection of the LDoS attack. The experimental results demonstrate that the proposed hybrid deep learning model-based method outperforms other traditional machine learning algorithms in terms of detection efficiency and accuracy.