現今的網路基礎設施不斷的成長，從實體網路到SDN(Software-Defined Networking)，從3G到4G甚至5G，還有雲端運算(Cloud computing)，其中車聯網、物聯網(Internet of Things, IoT)等應用會在這些網路基礎之上。但網路攻擊卻是層出不窮，不論是舊有攻擊DoS(denial-of-service)或是DDoS(Distributed denial-of-service)等，這些攻擊都造成財物損失該行為同時也利用殭屍電腦進行欺騙，以避開資安技術的檢測。
近年深度學習的興起，需多的研究將深度學習技術應用於偵測網路攻擊。有許多的研究都是基於閉集(Closed set)建立研究，卻未考慮這些數據集之外的類別，這問題可以說是開集識別(Open Set Recognition)，該問題可以說是研究都是基於自身數據集稱閉集該模型會對閉集有很好的泛化能力，但是對開集(Open set)有泛化能力降低的問題，我們都知道網路攻擊是日新月異的，因次有必要注重開集識別的問題。
本論文提出使用時間序列的神經網路加上前後向傳播關係進而形成BI-LSTM(Bidirectional Long Short-Term Memory)神經網路再結合高斯混合模型解決開集識別問題，稱作BI-LSTM_GMM模型，該方法使得未知流量能夠藉由本文的架構被挖掘出來，並由專家進行流量標記，再利用漸進式學習(Incremental learning) 不斷擴展現有模型的知識，以增加更新模型效率，解決傳統資安設備受限於閉集識別之問題。

The network infrastructure continues to evolve, from physical networks to SDN, from 3G to 5G, as well as cloud computing. Applications such as the Internet of Vehicles and the Internet of Things will base on these networks. However, cyber-attacks are endless, whether they are old DoS or DDoS attacks. These attacks cause property damage. This behavior also uses bots to avoid being detected by security technology.
In recent years, the rise of deep learning encourages more research to apply deep learning technology in the detection of network attacks. Many studies are based on closed set studies but do not consider new data sets. This problem can be said to be an open set recognition problem. The problem is that the research bases on its own data set called a closed set. The model has good generalization ability for closed sets, but it has a problem of reduced generalization ability for new data. We all know that cyber-attacks are changing rapidly, so it is necessary to pay attention to the problem of open-set identification.
This paper proposes to use a time series neural network plus forward and backward propagation relationships to form a BI-LSTM (Bidirectional Long Short-Term Memory) neural network. Together with a Gaussian mixture model to solve the open set recognition problem, called the BI-LSTM_GMM model. This method enables unknown traffic to be mined out through the framework of this paper. After that, traffic marking is performed by experts. Then incremental learning is used to continuously expand the knowledge of existing models to increase the efficiency of updating the model and solve the problem of traditional security equipment limited to closed sets.

目錄
第一章 緒論 1
1.1 前言 1
1.2 研究動機與目的 5
1.3 論文架構 6
第二章 文獻探討與技術分析 7
2.1 網路攻擊介紹 7
2.1.1 DoS攻擊 7
2.1.2 殭屍網路 8
2.1.3 IP欺騙 9
2.1.4 DDoS攻擊 10
2.1.5 網路層攻擊 11
2.1.6 傳輸層攻擊 11
2.1.7 應用層攻擊 14
2.2 DDoS偵測與防禦手法 16
2.3 DDoS代價 18
2.4 機器學習 19
2.5 深度學習 20
2.5.1 時間序列 23
2.6 Open Set Recognition 25
2.7 Anomaly Detection 25
2.8 Gaussian Distribution 26
2.9 DDoS未知攻擊偵測技術現況 27
第三章 研究方法 30
3.1 系統架構BI-LSTM_GMM 30
3.2 資料前處理 31
3.2.1 特徵處理 32
3.2.2 數據正規化 36
3.3 BI-LSTM Module 37
3.4 高斯混合模組(GMM Module) 41
3.5 更新模型 44
3.5.1 重新訓練 45
3.5.2 漸進式學習 45
3.6 小結 45
第四章 實驗結果與分析 47
4.1 數據集分析 47
4.2 評估指標 48
4.3 訓練模型 49
4.4 高斯混合模組 57
4.4.1 高斯混合模組未知流量預測與分析 59
4.4.2實驗分析與實驗結論 68
4.5 漸進式學習 75
4.6 小結 76
第五章 結論與未來展望 78
5.1 結論 78
5.2 未來展望 79

[1]趨勢科技, ” DDoS攻擊和IoT漏洞攻擊殭屍網路” , 2019, [Online]. Available: https://blog.trendmicro.com.tw/?p=62968, [2019]
[2]A10 Network, “The State of DDoS Weapons”, 2019, [Online]. Available: https://www.a10networks.com/marketing-comms/reports/state-ddos-weapons/, [2019]
[3] Ericsson, “愛立信5G行動趨勢報告”, 2019, [Online]. Available:https://www.ericsson.com/zh-tw/press-releases/2/2019/12/20191204-ericsson-report, [2019]
[4]ithome, “Netscout威脅趨勢報告”, 2020, [Online]. Available: https://www.ithome.com.tw/news/135912, [2020]
[5]Imperva Research Labs, “2019 Global DDoS Threat Landscape Report”, 2019, [Online]. Available: https://www.imperva.com/blog/2019-global-ddos-threat-landscape-report/, [2019]
[6]Akamai, “State of the Internet: Security | DDoS and Application Attacks (Volume 5, Issue 1) Executive Summary”, 2019
[7]link11, “DDoS Statistics (infographic) for the 1st Quarter of 2020”, 2020, [Online]. Available: https://www.link11.com/en/downloads/ddos-statistics-infographic-for-the-1st-quarter-of-2020/, [2019]
[8]cloudflare, “Network-Layer DDoS Attack Trends for Q1 2020”, 2020, [Online]. Available: https://blog.cloudflare.com/network-layer-ddos-attack-trends-for-q1-2020/, [2020]
[9]CSO, “DDoS explained: How distributed denial of service attacks are evolving”, 2020, [Online]. Available: https://www.csoonline.com/article/3222095/ddos-explained-how-denial-of-service-attacks-are-evolving.html, [2020]
[10]CloudOak, “How Denial of Service Attacks can Impact Business Continuity Planning”, 2019, [Online]. Available: https://www.cloudoakchannel.com/how-denial-of-service-attacks-can-impact-business-continuity-planning/, [2019]
[11]Akamai, “MEMCACHED-FUELED 1.3 TBPS ATTACKS”, 2018, [Online]. Available: https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html, [2019]
[12]ithome, “歐洲 DDoS 攻擊”, 2014, [Online]. Available: https://www.ithome.com.tw/node/85144, [2019]
[13]ithome, ” 如何抵擋Tb級DDoS攻擊”, 2016, [Online]. Available: https://www.ithome.com.tw/news/110137, [2019]
[14]網管人, “骨幹環境建置清洗中心在地緩解惡意攻擊流量”, 2018, [Online]. Available: https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/0BA7D4C8F16F4FD2872CC3EE743B4EB4, [2019]
[15]cisco, “Cisco Annual Internet Report (2018–2023) White Paper”, 2020, [Online]. Available: https://www.cisco.com/c/en/us/solutions/collateral/executive-perspectives/annual-internet-report/white-paper-c11-741490.html, [2020]
[16]Incapsula,” What DDoS Attacks Really Cost Businesses”, 2019, [Online]. Available: http://lp.incapsula.com/rs/incapsulainc/images/eBook%20-%20DDoS%20Impact%20Survey.pdf, [2020]
[17]newtalk, “魔獸世界DDoS攻擊報導”, 2019, [Online]. Available: https://newtalk.tw/news/view/2019-09-08/296276, [2019]
[18]ithome, “Dyn 遭受 DDoS 攻擊報導”, 2016, [Online]. Available:https://www.ithome.com.tw/news/109225, [2019]
[19]R. Doshi, N. Apthorpe and N. Feamster, 2018, “Machine Learning DDoS Detection for Consumer Internet of Things Devices,” In 2018 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, 24 May, pp. 29-35.
[20]Z. He, T. Zhang and R. B. Lee, 2017, “Machine Learning Based DDoS Attack Detection from Source Side in Cloud,” 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud), New York, NY, 26-28 June, pp. 114-120.
[21]O. Rahman, M. A. G. Quraishi and C.-H. Lung, 2019, “DDoS Attacks Detection and Mitigation in SDN Using Machine Learning,” 2019 IEEE World Congress on Services (SERVICES), Milan, Italy, 8-13 July, pp. 184-189.
[22]K. Gurulakshmi and A. Nesarani, 2018, “Analysis of IoT Bots Against DDoS Attack Using Machine Learning Algorithm,” 2018 2nd International Conference on Trends in Electronics and Informatics (ICOEI), Tirunelveli, India, 11-12 May, pp. 1052-1057.
[23]S. Das, A. M. Mahfouz, D. Venugopal and S. Shiva, 2019, “DDoS Intrusion Detection Through Machine Learning Ensemble,” 2019 IEEE 19th International Conference on Software Quality, Reliability and Security Companion (QRS-C), Sofia, Bulgaria, 22-26 July, pp. 471–477.
[24]E. Nazarenko, V. Varkentin, T. Polyakova, 2019, “Features of Application of Machine Learning Methods for Classification of Network Traffic (Features, Advantages, Disadvantages),” 2019 International Multi-Conference on Industrial Engineering and Modern Technologies (FarEastCon), Vladivostok, Russia, 1-4 Oct, pp. 1-5.
[25]N. Gao, L. Gao, Q. Gao and H. Wang, 2014, “An Intrusion Detection Mode Based on Deep Belief Networks,” 2014 Second International Conference on Advanced Cloud and Big Data, Huangshan, 20-22 Nov, pp. 247-252.
[26]T. A. Ahanger, 2017, “An effective approach of detecting DDoS using Artificial Neural Networks,” 2017 International Conference on Wireless Communications, Signal Processing and Networking (WiSPNET), Chennai, 22-24 March, pp. 707-711.
[27]S. Alzahrani and L. Hong, 2018, “Detection of Distributed Denial of Service (DDoS) Attacks Using Artificial Intelligence on Cloud,” 2018 IEEE World Congress on Services (SERVICES), San Francisco, CA, 2-7 July, pp. 35-36.
[28]C. Li, Y. Wu, X. Yuan, Z. Sun, W. Wang, X. Li, et al., 2018, “Detection and defense of DDoS attack–based on deep learning in OpenFlow-based SDN”, International Journal of Communication Systems, vol. 31, no. 5, 25 March.
[29]A. SUNGUR UNAL1, M. HACIBEYOGLU1, 2018, “Detection of DDOS Attacks in Network Traffic Using Deep Learning”, International Conference on Advanced Technologies, Computer Engineering and Science (ICATCES’18), Safranbolu, Turkey, 11-13 May, pp. 722-726.
[30]Y. Bengio, P. Simard, and P. Frasconi., 1994, “Learning long-term dependencies with gradient descent is difficult,” IEEE Transactions on Neural Networks, vol. 5, no. 2, pp. 157–166, March.
[31]L. Bontemps, V. L. Cao, J. McDermott and N.-A. Le-Khac, 2016, “Collective Anomaly Detection based on Long Short Term Memory Recurrent Neural Network,” Future Data and Security Engineering, pp. 141-152.
[32]C. Yin, Y. Zhu, J. Fei and X. He, 2017 , “A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks,” in IEEE Access, vol. 5, pp. 21954-21961.
[33]X. Yuan, C. Li and X. Li, 2017, “DeepDefense: Identifying DDoS Attack via Deep Learning,” 2017 IEEE International Conference on Smart Computing (SMARTCOMP), Hong Kong, 29-31 May, pp. 1-8.
[34]S. Hochreiter and J. Schmidhuber., 1997, “Long short-term memory,” Neural computation, vol. 9, no. 8, pp. 1735-1780, November.
[35]C. D. McDermott, F. Majdani and A. V. Petrovski, 2018, “Botnet Detection in the Internet of Things using Deep Learning Approaches,” 2018 International Joint Conference on Neural Networks (IJCNN), Rio de Janeiro, 8-13 July, pp. 1-8.
[36]Roopak, M.; Tian, G.Y.; Chambers, J., 2020, “An Intrusion Detection System Against DDoS Attacks in loT Networks,” 10th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA, 6-8 Jan , pp. 0562-0567.
[37]R. Priyadarshini and R. K. Barik, 2019, “A Deep Learning Based Intelligent Framework to Mitigate DDoS Attack in Fog Environment.” Journal of King Saud University - Computer and Information Sciences, Apr.
[38]W. Scheirer, A. Rocha, A. Sapkota and T. E. Boult, 2013, “Toward Open Set Recognition, “ IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 35, no. 7, July, pp. 1757-1772.
[39]Schlachter, P., Liao, Y., Yang, B., 2019, ” Open-Set Recognition Using Intra-Class Splitting,” 2019 27th European Signal Processing Conference (EUSIPCO), A Coruna, Spain, 2-6 Sept, pp. 1-5.
[40]A. Bendale and T. E. Boult, 2016, “Towards Open Set Deep Networks, ” Proceedings of the IEEE conference on computer vision and pattern recognition, Las Vegas, NV, pp. 1563-1572.
[41]K. Saito, S. Yamamoto, Y. Ushiku and T. Harada, 2018 ,“Open Set Domain Adaptation by Backpropagation, ” Proceedings of the European Conference on Computer Vision (ECCV), September, pp. 156-171.
[42]A. Bendale and T. Boult, 2015, “Towards Open World Recognition,”. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Boston, MA, June, pp. 1893–1902.
[43]E. M. Rudd, L. P. Jain, W. J. Scheirer and T. E. Boult, 2019, “The Extreme Value Machine,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 40, no. 3, pp. 762-768, Jan.
[44]P. Oza and Vishal M Patel, 2019, “Deep CNN-based Multi-task Learning for Open-Set Recognition,” CoRR, abs/1903.03161.
[45]C. Geng, S. Huang and S. Chen, 2018 , “Recent Advances in Open Set Recognition: A Survey,” IEEE transactions on pattern analysis and machine intelligence, pp. 1-1.
[46]J. Guo, G. Liu, Y. Zuo, and J. Wu, 2018 ,“An Anomaly Detection Framework Based on Autoencoder and Nearest Neighbor,” 2018 15th International Conference on Service Systems and Service Management (ICSSSM), Hangzhou, 21-22 July, pp. 1-6.
[47]Z. Chen, C. K. Yeo, B. S. Lee and C. T. Lau, 2018 , “Autoencoder based network anomaly detection”, 2018 Wireless Telecommunications Symposium (WTS), Phoenix, AZ, 17-20 April, pp. 1-5.
[48]A. Legrand, B. Niepceron, A. Cournier and H. Trannois, 2018, “Study of Autoencoder Neural Networks for Anomaly Detection in Connected Buildings,” 2018 IEEE Global Conference on Internet of Things (GCIoT), Alexandria, Egypt, 5-7 Dec, pp. 1–5.
[49]W. Lu and I. Traore, 2005, “An unsupervised approach for detecting DDOS attacks based on traffic-based metrics,” 2005 IEEE Pacific Rim Conference on Communications, Computers and signal Processing, Victoria, BC, Canada, 24-26 Aug, p. 462-465.
[50]A. Reddy, M. Ordway-West, M. Lee, M. Dugan, J. Whitney, R. Kahana, et al., 2017, “Using Gaussian Mixture Models to Detect Outliers in Seasonal Univariate Network Traffic,” 2017 IEEE Security and Privacy Workshops (SPW), San Jose, 25-25 May , pp. 229-234.
[51] N. Moustafa, G. Creech, E. Sitnikova and M. Keshk, 2017, ”Collaborative anomaly detection framework for handling big data of cloud computing,” 2017 Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, 14-16 Nov, pp. 1-6.
[52]U. Sabeel, S. S. Heydari, H. Mohanka, Y. Bendhaou, K. Elgazzar and K. El-Khatib, 2019, “Evaluation of Deep Learning in Detecting Unknown Network Attacks,” 2019 International Conference on Smart Applications, Communications and Networking (SmartNets), Sharm El Sheik, Egypt, 17-19 Dec, pp. 1-6.
[53]A. Saied, R. E. Overill and T. Radzik, 2016, “Detection of known and unknown DDoS attacks using Artificial Neural Networks,” Neurocomputing, vol. 172, pp. 385-393, January.
[54]X. Liang and T. Znati, 2019, “A Long Short-Term Memory Enabled Framework for DDoS Detection,” 2019 IEEE Global Communications Conference (GLOBECOM), Waikoloa, HI, USA, 9-13 Dec, pp. 1-6.
[55]R. Ma and S. Qin, 2017, “Identification of unknown protocol traffic based on deep learning”, 2017 3rd IEEE International Conference on Computer and Communications (ICCC), Chengdu, 13-16 Dec, pp. 1195-1198.
[56]CICFlowMeter, “CICFlowMeter 工具”, [online]. Available: https://github.com/ISCX/CICFlowMeter, 2017, [2019]