CNN-AttBiLSTM Mechanism: A DDoS Attack Detection Method Based on Attention Mechanism and CNN-BiLSTM

DDoS attacks occur frequently. This paper proposes a DDoS attack detection method that integrates self attention mechanism and CNN-BiLSTM to address the problem of low accuracy and high false positive rate in classification tasks due to the high and multiple feature dimensions of raw traffic data. Firstly, the random forest algorithm is combined with Pearson correlation analysis to select important features as model inputs to reduce the redundancy of input data. Secondly, one-dimensional convolutional neural networks and bidirectional long-term and short-term memory networks are used to extract spatial and temporal features respectively, and the extracted features are then "parallel" to obtain fused features.Thirdly, the attention mechanism is introduced to ensure that the useful input information features are fully and completely expressed, and different weights are given according to the importance of different features. Finally, the softmax classifier is used to obtain the classification results. In order to verify the effectiveness of the proposed method, tests were conducted on the CIC-ISD2017 and CIC-DOS2019 datasets. The experimental results show that compared with common models, the performance of this model has been significantly improved. Not only does it effectively reduce computational costs and accelerate model training speed, but it also has broad engineering application prospects and certain theoretical reference value.