Data distribution of DDoS SDN data set.

Software Defined Networking (SDN) is an emerging network architecture and management method, whose core idea is to separate the network control plane from the data transmission plane. It is precisely because of this characteristic that SDN controllers are susceptible to external malicious attacks, the most common of which are Distributed Denial of Service (DDoS) attacks. This paper suggests a way to find DDoS attacks called ConvLTSM-MHA-TWD. It is based on the Convolutional Long Short-Term Memory Network (ConvLSTM) and three-way decision (TWD). It solves the problem of insufficient feature extraction in SDN environment and improves classification accuracy. This method uses ConvLSTM to extract data features, and uses multi-head attention (MHA) mechanism to learn the long-distance dependence relationship in the input data, and then constructs multi-granularity feature space. ConvLSTM and MHA outputs are added to form a residual connection to further enhance feature extraction and timing modeling capabilities and solve the problem of gradient disappearance during model training. Then the three-way decision theory is used to make decisions on network behaviors immediately. For the network behaviors that cannot be made immediately, the delayed decision is made, and the feature extraction and decision are made on this part of the network behaviors again. Finally, the classification results are output. This paper conducted experiments on data sets CICIDS2017 and DDoS SDN, with accuracy rates of 0.994 and 0.977, respectively, which has better overall performance, and is suitable for training large amounts of data.软件定义网络（Software Defined Networking, SDN）是一种新兴的网络架构与管理方法，其核心思想是将网络控制平面与数据传输平面相分离。正是由于这一特性，SDN控制器极易遭受外部恶意攻击，其中最常见的即为分布式拒绝服务（Distributed Denial of Service, DDoS）攻击。本文提出了一种名为ConvLTSM-MHA-TWD的DDoS攻击检测方法，该方法基于卷积长短期记忆网络（Convolutional Long Short-Term Memory Network, ConvLSTM）与三支决策（three-way decision, TWD），解决了SDN环境下特征提取不足的问题，提升了分类准确率。该方法首先利用ConvLSTM提取数据特征，并通过多头注意力（multi-head attention, MHA）机制学习输入数据中的长距离依赖关系，进而构建多粒度特征空间；将ConvLSTM与MHA的输出进行拼接以形成残差连接，进一步强化特征提取与时序建模能力，同时解决模型训练过程中的梯度消失问题。随后借助三支决策理论对网络行为进行即时决策，对于无法即时判定的网络行为则采用延迟决策，并对该部分网络行为再次进行特征提取与决策，最终输出分类结果。本文在CICIDS2017与DDoS SDN数据集上开展了实验，准确率分别达到0.994与0.977，整体性能更优，适用于大规模数据的训练任务。