Abstract: With IPv6 network traffic rapidly increasing,the traditional intrusion detection systems,such as Snort,based on speci-fic rules to detect DoS intrusion attacks,have the poor performance and adaptability in detecting DoS attacks.In order to solve the problem of detecting DoS attacks in IPv6,the KNN algorithm is improved in this paper.First,in order to decrease the number of low influential sub-features of discrete type features,the approach of selecting and clustering of sub-feature is implemented by information gain ratio,which can decrease the number of features and improve the efficiency in detecting DoS attack in IPv6.Se-cond,the improved algorithm GR-AD-KNN using information gain ratio as the weight of features to change Euclidean distance is proposed to achieve DoS attack detection.Based on a metric about reverse distance influence,the classification decision method in KNN algorithm is optimized,then the accuracy of detection approach is further improved.Experiments show that,compared with the TAD-KNN algorithm based on the average distances to classify attacks and the GR-KNN algorithm which only optimizes the Euclidean distance definition,the GR-AD-KNN algorithm not only improves the overall detection performance in IPv6 network traffic features detection,but also has better detection results on small population attack samples.

Key words: Average increment distance classification, GR-AD-KNN algorithm, Information gain ratio, IPv6, Twice reducing dimensionality of features