Detection of Application Layer DDoS attack by feature learning using Stacked AutoEncoder

An Application Layer Distributed Denial of Service Attack (DDoS) is one of the biggest concerns for web security. Many detection methods are designed to mitigate DDoS attack based on IP and TCP layer instead of the Application layer. These methods are not suitable for detection of Application layer DDoS attack since most of the IP and TCP layer DDoS attacks are based on request flooding attack. But Application layer DDoS attacks consist of request flooding, session flooding, and asymmetric attack. The solutions available to detect Application layer DDoS attack, detect only limited number of Application layer DDoS attacks. The solutions that detect all types of Application layer DDoS attacks have huge algorithm complexity. One of the major challenges in the detection of an Application layer DDoS attack is the non-availability of features to detect such attacks. Hence it is difficult to model normal user behavior from attack behavior. In this paper, Deep learning architecture is introduced to learn deep features of Application layer DDoS attack. Deep learning architecture consist of very deep neural network, typically more than three layers. In the proposed work the concept of AutoEncoder is applied, which is one of the deep learning based models that learns deep useful features in the Application layer DDoS attack dataset. The Stacked AutoEncoder deep learning architecture, is aimed to receive high level features. The performance of the proposed method was evaluated in terms of the metrics such as false positive rate and detection rate. Comparison of the proposed method with the existing methods reveals that the proposed method performs better than the existing methods.