# A Feature Analysis Based Identifying Scheme Using GBDT for DDoS with Multiple Attack Vectors
## 3 System Model and Problem Statement  
The overall framework of this paper is shown in Figure 1. The first step is to extract the data from the pcap file, that is, parse the data packets of each pcap file. Then, the data packet is synthesized into a TCP flow or a UDP flow from which features are extracted. Finally, each datum is tagged, and one datum is formed by a TCP flow or a UDP flow. The specific generation steps are discussed in detail at the end of this section. In the second step, before the feature selection, we first determine the GBDT algorithm as the classifier for DDoS detection and recognition, which is discussed in detail in the fourth part. In the third step, the feature selection method of the random forest feature score and Pearson correlation coefficient is used to select each attack type. In the fourth step, each of the attack vectors are characterized by a feature subset, and an attack vector feature tree is constructed. DDoS attacks are constantly changing, and each time a DDoS attack occurs, it is often accompanied by multiple attack methods. At present, there are 45 kinds of DDoS attacks based on TCP and UDP protocols [38; 39; 40]. Many researchers have proposed DDoS attack classification methods [41; 42; 43; 44]. In view of the current types of DDoS attacks, this paper extracts 102 features by summarizing the research results of these researchers [8; 9; 10; 11]. As shown in Table 1, the features corresponding to sequence numbers 1-102 are based on 102 features of the TCP flow, and the features corresponding to sequence numbers 54-102 are based on 49 features of the UDP flow. These features serve as a collection of original features for detecting DDoS attacks. Extracting the important features of the DDoS attack type is very important for early detection of DDoS attacks [11]. A type of DDoS attack tends to highlight several important features. In other words, several features can characterize a DDoS attack. If we can acquire some features, we can lock the DDoS attack type range, which will greatly help the later DDoS mitigation. According to the method proposed by researchers in [41; 42; 43; 44], each attack vector can be characterized by feature subsets to construct the attack vector feature tree. When a DDoS attack occurs, the attack feature tree can be used to quickly locate the DDoS attack type. The goal of constructing a feature tree is to quickly locate which types of attacks appear when a hybrid attack occurs. To clearly describe the construction process of the feature tree, the details are shown in Figure 1 (1) First, the feature of the mixed attack is extracted, and the obtained feature subset is used as the root of the feature tree. (2) Then, the mixed traffic corresponding to the root node is separated into various attack types, and the traffic of each attack type is mixed with the normal traffic. Then, feature extraction is performed, and the obtained feature subset is used as a leaf node (3). Subsequently, iterating through all the leaf nodes is performed and steps (1) and (2) are repeated. Finally, steps (1), (2), and (3) are performed to obtain a feature tree. According to the attack vector feature tree, as shown in Figure 1, when the feature subset 1 changes, the attack type's range can be quickly locked, that is, the node where the feature subset 1 is located and the DDoS attack type that corresponds to the child node is determined. The attack vector feature tree has the characteristics of a fast perceptual attack and is beneficial to DDoS mitigation. Additionally, it saves time regarding feature selection because machine learning directly uses the changed feature set's learning and prediction. **Definition 1**. : _Feature Set: A collection of features consisting of several features in Appendix A Table A1. A feature set \(A\) is represented by [a1, a2, a3,..., an], \(n\in\) (1, 2, 3,..., 102), where \(n\) represents the sequence number in Appendix A Table A1, and an represents the feature corresponding to the sequence number \(n\) in Appendix A Table A1.