DoS-Dam: a Hierarchical Method for Identifying and Mitigating DDoS Attacks in High-Speed Network Traffic

As the prevalence of high-speed networks with augmented transmission capacities expands, the security technologies devised to shield these networks lag behind the rapid advancements. This disparity leads to many issues, with Distributed Denial of Service (DDoS) attacks representing the most harmful. In such attacks, hackers exploit numerous bots to flood the target with a torrent of vicious traffic or spurious requests, leading to the paralysis of the communication framework and the interruption of essential services. Existing defense mechanisms against DDoS attacks struggle to reconcile detection speed, lead time, and accuracy, revealing several deficiencies. Our method begins by employing a sketch-based algorithm characterized by minimal computational demands paired with considerable swiftness. This strategy significantly mitigates the intensity of DDoS attacks and reduces the imbalance rate of benign traffic and attacks. Subsequently, the deployment of the CatBoost classifier augments the detection's F1-score to <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$9 9. 6 4 \%$</tex>. The experimental findings corroborate the efficacy of DDoS-Dam in the expeditious detection and mitigation of DDoS attacks in high-speed networks.