Виявлення DDOS атак при недосконалості даних за допомогою алгоритмів машинного навчання

The issue of DDoS (Distributed Denial of Service) attacks remains a prevalent one even in recent years. Modern environment is highly dynamic and is characterized by a large amount of traffic flow. Existing research covers several models, techniques and approaches to detecting DDoS traffic, which aim to optimize the detection in controlled datasets. However, unintentional noise or data corruption may lower the efficacy of such methods. As such, determining most effective ways to detect DDoS traffic in conditions of data imperfections is necessary for reliable network performance. Therefore, the object of this research Is the usage of machine learning algorithms for detection of incoming DDoS attacks. The purpose of this research is to determine the performance of ways to detect incoming DDoS attacks with machine learning algorithms based on detection accuracy, while simulating imperfect data conditions. The study also examines the impact of class rebalancing on modified data. To achieve the aim of this research a variety of machine learning algorithms were implemented and tested on a CIC-DDoS2019 dataset. The data is modified by removing values and introducing noise, tested, the classes are resampled and the dataset is tested again. The goal is to achieve over 90% accuracy in a classification task of the type of DDoS attack and to determine how much the changes affect the performance of the algorithms. The results of the testing indicated that several solutions reach the target mark and changes to the dataset in realistic conditions do not significantly affect the final result. However, all models tested show a decrease in accuracy compared to unmodified data with more complex models showing higher resilience (smaller decrease in accuracy). In addition, resampling of the data shows comparable decrease in accuracy of the models with more complex models being affected less. The results of this study may be used in development of an algorithm of repairing the corrupted data or development of models more resistant to such data changes. Additionally, the results of this study may be used when considering models for practical implementations of a DDoS traffic classification system.