# A Feature Analysis Based Identifying Scheme Using GBDT for DDoS with Multiple Attack Vectors
## 2 Background and Related Work
[32] proposed an effective intrusion detection framework based on enhanced \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Author** & **Feature Selection Method** & **Authentication Method** & **Datasets** \\ \hline [PERSON] et al. [15] & Information gain and chi-square method & Bayesian network & KDD-Cup 99 \\ \hline \multirow{3}{*}{[PERSON] et al. [16]} & Linear correlation coefficient and forward feature selection & \multirow{3}{*}{SVM, Bayes} & \multirow{3}{*}{KDD-Cup 99} \\  & algorithm (FFSA) and proposed modified mutual & & \\  & information feature selection (MMIFS) & & \\ \hline \multirow{2}{*}{[PERSON] et al. [17]} & Stepwise feature removal method GFR method & SVM & KDD-Cup 99 \\ \hline \multirow{2}{*}{[PERSON] [18]} & Random forest-forward selection sort (RF-SFR) and & \multirow{2}{*}{Decision tree, forest} & \multirow{2}{*}{KDD-Cup 99} \\  & Random forest-backward sorting (RF-BER) & & \\ \hline \multirow{2}{*}{[PERSON]. [PERSON] [19]} & \multirow{2}{*}{Consistency subset evaluation} & Extreme learning & \multirow{2}{*}{NSL-KDD} \\  & & machine & \\ \hline \multirow{2}{*}{[PERSON] [20]} & CFS Subset Evaluator is used as an attribute evaluator and & Random Forest, J48, and \\  & best first is used as a search method & Naive Bayes & \\ \hline [PERSON]. [PERSON] [21] & Genetic algorithm multisupport vector machine & SVM classifier & CICIDS 2017 \\ \hline \multirow{2}{*}{[PERSON] [22]} & Recursive feature addition (RFA) and bigram techniques & SVM classifier & \multirow{2}{*}{ICX} \\  & Genetic algorithm as feature search and logistic regression & & \\ \hline \multirow{2}{*}{[PERSON]. [23]} & \multirow{2}{*}{Decision tree} & KDD-Cup 99, \\  & as a packaging method for learning algorithms & & UNSW-NB15 \\ \hline \multirow{2}{*}{[PERSON] [24]} & Improved linear SVM & SVM & KDD-Cup 99 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Feature selection method. feature support vector machine (SVM). The logarithmic edge density ratio is transformed to form the original features, such that new and better quality transform features are obtained and the SVM-based detection model can achieve greatly improved detection ability. [PERSON], W, [PERSON] et al. [33] combined the SVM method with the self-organizing ant colony network cluster (CSOACN) to take full advantage of both approaches, and achieved an accuracy of 95.3% on the KDD-Cup 99 datasets. Approaches based on K-means DDoS detection have been employed. [PERSON] [34] fully integrated a SOM neural network and the K-means algorithm, and developed a two-stage classification system to correlate related alarms and further classify alarms. This method effectively reduces all redundant and noisy alarms. The author used the DARPA dataset to conduct experiments. The results show that the method can detect 96% of the false positives, and the false positive rate is much lower. [PERSON] et al. [35] proposed a hybrid technique that combines the K-Means clustering algorithm and the RBF kernel function of the support vector machine as a classification module. The main goal of the proposed technique is to reduce the number of attributes associated with each data point. The accuracy of the proposed technique in the KDDCUP'99 datasets reached 96.3%. BP-based DDoS attack detection was reported in the following work. [PERSON] et al. [36] proposed an optimal method for constructing anomalous NIDS(Network Intrusion Detection System) based on back propagation neural network using a back propagation learning algorithm. [PERSON] et al. [37] used BP to detect traffic in real time on a software defined network (SDN). They first obtained all the flow entries for each switch. After receiving the flow statistics of the flow entry sent by the switch, the controller parses the flow statistics and processes the flow entry in the message one by one.