# A Feature Analysis Based Identifying Scheme Using GBDT for DDoS with Multiple Attack Vectors
## 7 Conclusions  
This paper first used 102 features to detect DDoS attacks based on TCP protocol and 49 features to detect DDoS attacks based on UDP protocol. In this paper, the GBDT algorithm was compared with the following four algorithms in terms of detection accuracy and running time: KNN, NB, SVM and MLP. The results show that the detection accuracy using the GBDT algorithm is higher than the other algorithms, and the test time is shorter than other algorithms. The RFPW feature selection algorithm combines random forest scores with Pearson correlation coefficients as a search strategy, using the GBDT algorithm as the evaluation criteria. This paper compared RFPW with the traditional dimensionality reduction algorithms and feature selection algorithms. Experiments show that the number of features selected by the RFPW algorithm is small. As long as the DDoS hybrid attack based on the TCP protocol has only 10 features and the DDoS hybrid attack of the UDP protocol requires  
Figure 14: Attack vector feature tree. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Model** & **ACC** & **TPR** & **FPR** & **PR** & **RR** & \(\mathbf{F_{1}}\) \\ \hline GBDT1 & 0.9548 & 0.9784 & 0.1499 & 0.9365 & 0.9784 & 0.9569 \\ GBDT2 & 0.9516 & 0.9801 & 0.1455 & 0.9555 & 0.9803 & 0.9677 \\ GBDT3 & 0.9997 & 0.9997 & 0.0007 & 0.9997 & 0.9997 & 0.9997 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Performance comparison of three models of 100 k WIDE TCP flow datasets. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Model** & **ACC** & **TPR** & **FPR** & **PR** & **RR** & \(\mathbf{F_{1}}\) \\ \hline GBDT1 & 0.9221 & 0.8706 & 0.0270 & 0.9695 & 0.8706 & 0.9174 \\ GBDT2 & 0.9214 & 0.8598 & 0.0256 & 0.9666 & 0.8598 & 0.9101 \\ GBDT3 & 1.0000 & 0.9999 & 0.00003 & 1.0000 & 0.9999 & 0.9999 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Performance comparison of three models of 100 k WIDE UDP flow datasets. only six features, the detection accuracy remains the same or increases. At the end of this paper, the parameters of the GBDT algorithm were tuned, so that the accuracy of DDoS attack detection based on the TCP protocol reaches 0.9997, and the false positive rate is only 0.0007. The detection rate of DDoS attacks based on the UDP protocol reached 100%, and the false detection rate was only 0.00003. The experimental results show that with the detection features and feature selection algorithms proposed in this paper, the GBDT detection classifier and GBDT parameter tuning can provide fast and accurate detection for DDoS attacks, which is meaningful for DDoS mitigation. At the end of the article, the attack special certificate tree was given, and the attack range was quickly locked according to the attack characteristics. DDoS hybrid attack detection will greatly help DDoS mitigation. In reality, it is based on mixed DDoS attacks. Constructing a DDoS attack tree with a small number of different traffic characteristics is useful for quickly locating DDoS attack types and then issuing policies or switching mitigation DDoS models. [PERSON] proposed to amend the comments and deepen the theoretical part of the thesis. [PERSON] designed the main method of the thesis and did all the experiments. [PERSON] helped us to modify the small errors and experimental data collection of the paper. [PERSON] helped us review the paper. This research was funded by Research on Theory and Method of Intelligent Monitoring of Service State of High Speed Railway Infrastructure Based on Machine Vision, grant number U1734208. And the APC was funded by National Natural Science Foundation of China Youth Science Fund Project, Flexible Distribution and Scheduling of Memory in Cloud Computing Environment, grant number 61602523. The authors declare no conflict of interest