Anti-DDoS research part 4: an information-gain oracle. Practical Python example
Brief
﷽
Hello, cybersecurity enthusiasts and white hackers!
In part 1 and part 2 , I looked at wavelet-based traffic anomalies. In part 3 , I used handshake asymmetry to detect SYN-flood campaigns.
Today the question is different: which question should a detector ask next?
We will build a small tree of questions about network flows, run it against the local CICDDoS2019 CSV files, and measure the trade-off between detection quality and the number of questions. The code and the measurements below use completed flow records. This is an offline classifier experiment, not a measurement of detection latency during a live flood.
idea - what is our oracle?
Call any yes/no probe that narrows down a set of hypotheses an oracle : it answers one question, and the algorithm keeps only the hypotheses consistent with that answer before asking the next one.