Abstract: Feature selection is an important method for attack detection algorithms.This method mostly uses cross-validation recursive feature elimination (Recursive Feature Elimination with Cross-Validation,RFECV) technology,and is usually combined with machine learning algorithms.However,this algorithm is mostly used to select single-model features,and its performance is also very susceptible to fluctuations due to changes in feature quantities and learners.Due to the large amount of calculation,the classification accuracy of this algorithm still needs to be improved.In response to the above problems,this paper proposes a random forest detection method for DDoS attacks based on the secondary screening of feature importance.Firstly,the algorithm preprocesses the original data set and extracts features.Secondly,in order to select the most relevant variables from the selected model,the algorithm uses the RF variable importance criterion and the random forest importance score to rank the variables.Then,on the basis of random forest feature ranking,the cumulative importance of the variables is calculated and the most important variables are obtained.Then,the most important variables selected are used for training again to generate a classification model,and a new set of important variables is defined as the current variable.Finally,the final optimal variable is obtained through the importance criterion and the cumulative importance again,which effectively removes the abnormal points and avoids the local optimum,thereby realizing accurate classification and detection of DDOS attacks.Experimental results show that this method has high accuracy and precision,can accurately classify normal traffic and various DDoS attack traffic,and is suitable for detecting DDoS attacks under big data.

Key words: DDoS attack detection, Feature extraction, Importance criterion, Machine learning, Random forests