Modern Machine Learning for Cyber-Defense and Distributed Denial-of-Service Attacks

Abstract

In computer networks, denial-of-service (DoS) attacks attempt to make computers or network resources unavailable for their intended use. DoS attacks are difficult to detect and mitigate since they normally do not attempt to access the private data of their intended victim, but rather intend to disrupt the publicly available resources their victims provide. This article discusses methods for detecting and mitigating DoS attacks with a focus on techniques that leverage machine learning algorithms. Such algorithms promise to: (a) detect when computer services are being used in an adversarial fashion, (b) separate network traffic into nominal and anomalous components, and (c) provide opportunities for mitigating the attacks while maintaining the integrity of the effected services. The key ingredient of the ideas presented here is the use of correlations and dependencies in computer access patterns, and the larger context in which they exist, to separate the “wheat” – the real users of the services – from the “chaff” –the perpetrators who are attempting to disrupt the services.