DOI
10.34229/KCA2522-9664.25.6.13
UDC 004.047
A. Kachynsky
Institute of Physics and Technology of National Technical University
of Ukraine “Igor Sikorsky Kyiv Polytechnic Institute,” Kyiv, Ukraine,
akachynsky@gmail.com
M. Stremetska
Institute of Physics and Technology of National Technical University
of Ukraine “Igor Sikorsky Kyiv Polytechnic Institute,” Kyiv, Ukraine,
mira.stremetska@gmail.com
PRINCIPAL COMPONENT ANALYSIS AS A TOOL OF NETWORK TRAFFIC
ANALYSIS FOR DETECTION OF DDoS ATTACKS
Abstract. To analyze network traffic based on the principal component method, a high- dimensional feature space was investigated. Using the developed score space, cluster analysis and visualization of network connections were performed using observations of network traffic flows recorded during six different types of DDoS attacks: DDoS Syn Flood, UDP Lag DDoS, UDP Flood DDoS, NetBIOS DDoS, LDAP DDoS, MSSQL DDoS. The results of the study were validated through cross-checking. The principal component method is a powerful data intelligence analysis tool for supporting the monitoring and detection of suspicious events in cyberspace.
Keywords: principal component analysis (PCA), cross-validation, cluster analysis, estimate, anomaly, cyber threat.
full text
REFERENCES
- 1. Jolliffe I.T. Principal component analysis. Springer Series in Statistics. 2nd ed. New York: Springer, 2002. 487 p.
- 2. Bruce P., Bruce A. Practical statistics for data scientists: 50 essential concepts. Sebastopol, CA: O’Reilly Media, Inc., 2017. 315 p.
- 3. Sharafaldin I., Lashkari A.H., Hakak S., Ghorbani A.A. Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy. Proc. 2019 International Carnahan Conference on Security Technology. IEEE, 2019. P. 1–8. https://doi.org/10.1109/CCST.2019.8888419.
- 4. DDoS evaluation dataset (CIC-DDoS2019). URL: https://www.unb.ca/cic/datasets/ddos-2019.html.
- 5. Nesterenko E.S., Stremetska M.S. The problem of choosing a system of indicators for analyzing PCAP files. Theoretical and applied problems of physics, mathematics and computer science: Materials of the XVIII All-Ukrainian scientific and practical conference of students, postgraduates and young scientists (May 12–13, 2020, Kyiv, Ukraine). Kyiv: Igor Sikorsky Kyiv Polytechnic Institute, Publishing house "Polytechnica", 2020. С. 97–100.
- 6. Lopez A.D., Mohan A.P., Nair S. Network traffic behavioral analytics for detection of DDoS attacks. SMU Data Science Review. 2019. Vol. 2, Iss. 1. Article number 14.
- 7. Toupas P., Chamou D., Giannoutakis K.M., Drosou A., Tzovaras D. An intrusion detection system for multi-class classification based on deep neural networks. 18th IEEE Int. Conf. Mach. Learn. Appl. (ICMLA) (December 16–19, 2019). IEEE, 2019. P. 1253–1258. https://doi.org/10.1109/ICMLA.2019.00206.
- 8. Collins M. Network security through data analysis: From data to action. 2nd ed. Sebastopol, CA: O’Reilly Media, Inc., 2017. 425 р.
- 9. Kachynskyi A.B., Stremetska M.S. Operational analytics as a tool for data monitoring and event management of cybersecurity systems. Reports of the National Academy of Sciences of Ukraine. 2021. No. 1. P. 9–16. https://doi.org/10.15407/dopovidi2021.01.009.
- 10. Rousseeuw P.J. Silhouettes: A graphical aid to the interpretation and validation of cluster analysis. Journal of Computational and Applied Mathematics. 1987. Vol. 20. P. 53–65. https://doi.org/10.1016/0377-0427(87)90125-7.
- 11. Chio C, Freeman D. Machine learning and security. Sebastopol, CA: O’Reilly Media, Inc., 2018. 383 p.
- 12. T., Harabasz J. A dendrite method for cluster analysis. Communications in Statistics. 1974. Vol. 3, Iss. 1. P. 1–27. https://doi.org/10.1080/03610927408827101.
- 13. Bro R., Kjeldahl K., Smilde A.K., Kiers H.A.L. Cross-validation of component models: A critical look at current methods. Analytical and Bioanalytical Chemistry. 2008. Vol. 390. Iss. 5. P. 1241–1251. http://dx.doi.org/10.1007/s00216-007-1790-1.
- 14. Bilokon B.S., Stremetska M.S. The problem of choosing a system of indicators for analyzing PCAP files under cross-validation conditions. Materials of the XIX All-Ukrainian Scientific and Practical Conference “Theoretical and Applied Problems of Physics, Mathematics and Informatics” (May 12–14, 2021). Kyiv: Polytechnica, 2021. P. 73–76.