The detection and identification of Distributed Denial-of-Service (DDoS) attacks remains a challenge in cloud/edge/fog computing environments. It usually requires network middleboxes, such as deep packet inspectors (DPI), for detection task mostly. But clouds and fogs have native powerful telemetry systems that are not yet fully exploited for DDoS detection; and provide so much information that could aid attack identification tasks as well. Machine Learning (ML) algorithms can help one diving into the richness of cloud’s native data collection services, which have a multitude of metrics from both physical and virtual hosts. This paper evaluates the use of ML algorithms over datasets collected from a experimental testbed based on OpenStack. Controlled attack scenarios were used to investigate the ability of ML for tasks such as detecting and identifying SYN_Flood and GET_Flood DDoS attacks mixed, in different proportions, with legitimate clients. kNN and Random Forest ML algorithms were trained and tested, and for evaluation the metrics accuracy, recall, precision, and F1-score were used. Our experiments presented about 87% of accuracy in the detection of SYN_Flood and GET_Flood DDoS attacks, whereas Snort IDS mostly fails to detect the latter attack by processing the corresponding packet traces. Also, the detection of PING_Flood DDoS attack was tested without training as an initial evaluation towards the generalization of the proposal.

中文翻译：

---

使用原生云遥测宏观监控进行基于 ML 的 DDoS 检测和识别

分布式拒绝服务 (DDoS) 攻击的检测和识别仍然是云/边缘/雾计算环境中的挑战。它通常需要网络中间件，例如深度数据包检查器 (DPI)，主要用于检测任务。但是云和雾具有强大的本地遥测系统，尚未完全用于 DDoS 检测；并提供大量有助于识别攻击任务的信息。机器学习 (ML) 算法可以帮助人们深入了解云原生数据收集服务的丰富性，这些服务具有来自物理和虚拟主机的大量指标。本文评估了 ML 算法对从基于 OpenStack 的实验测试台收集的数据集的使用。受控攻击场景用于研究 ML 执行任务的能力，例如检测和识别以不同比例与合法客户端混合的 SYN_Flood 和 GET_Flood DDoS 攻击。训练和测试 kNN 和随机森林 ML 算法，并使用度量准确度、召回率、精确度和 F1 分数进行评估。我们的实验在检测 SYN_Flood 和 GET_Flood DDoS 攻击方面的准确率约为 87%，而 Snort IDS 大多无法通过处理相应的数据包跟踪来检测后一种攻击。此外，PING_Flood DDoS 攻击的检测在没有经过培训的情况下作为对提案泛化的初步评估进行了测试。训练和测试 kNN 和随机森林 ML 算法，并使用度量准确度、召回率、精确度和 F1 分数进行评估。我们的实验在检测 SYN_Flood 和 GET_Flood DDoS 攻击方面的准确率约为 87%，而 Snort IDS 大多无法通过处理相应的数据包跟踪来检测后一种攻击。此外，PING_Flood DDoS 攻击的检测在没有经过培训的情况下作为对提案泛化的初步评估进行了测试。训练和测试 kNN 和随机森林 ML 算法，并使用度量准确度、召回率、精确度和 F1 分数进行评估。我们的实验在检测 SYN_Flood 和 GET_Flood DDoS 攻击方面的准确率约为 87%，而 Snort IDS 大多无法通过处理相应的数据包跟踪来检测后一种攻击。此外，PING_Flood DDoS 攻击的检测在没有经过培训的情况下作为对提案泛化的初步评估进行了测试。