Training and testing

It first identifies if the traffic is normal or an attack, if it is an attack, it identifies if it is part of a high rate or low rate DDoS attack. The system can be configured to provide the specific attack name.

Input

Normal, high rate, and low rate data whose features were extracted using KDD99 Feature extractor

Output

Classification

Training system specifics

Tools used:

• Weka
• Wireshark
• Low Orbit Ion Cannon
• SlowHTTPTest
• Hping

Uses 5 machine learning algorithms:

• J48
• IBk
• Naive Bayes
• Random Forest
• SMO

5 feature selection methods

• None (baseline)
• Information gain
• Attribute correlation
• J48 wrapper
• Naive Bayes wrapper

Database compatibility

• Mysql

Live system specifics

Input

A trained model

Output

Probability of being in a certain class as well as the IP addresses involved in the flow