Abstract: DDoS attacks pose a great threat to personal and national data security.How to accurately detect and identify DDoS attacks is of great significance.Aiming at the problems such as low prediction efficiency,overfitting and poor generalization ability in traditional DDoS attack detection,a new DDoS attack detection algorithm based on multi-scale spatiotemporal fusion attention network is proposed.Firstly,the features of heterogeneous data are distinguished and supplemented,and white noise is injected to enhance the robustness of the model to random disturbance.Secondly,at the algorithm level,a hierarchical strategy of multi-scale TCN and BiLSTM in parallel is proposed to cover multiple dependencies from short time to long time,and the layered output feature matrix is compressed by deep separable convolution to extract core timing patterns and effectively control network complexity.Finally,the compressed vector sequence is transferred to Transformer self-attention mechanism to realize global correlation modeling of cross-scale and cross-channel features,dynamically highlight timing context slices with high discriminating power,and identify abnormal traffic of DDoS attacks.Comparison experiments and ablation experiments are conducted based on the CIC-IDS-2017 dataset respectively.The results show that the prediction accuracy of the multi-scale spatial-temporal fusion attention network algorithm can reach 99.82%,the recall rate is 99.35%,and the F1 value is 99.58%,which is 4.28% higher than the accuracy of TCN and BiLSTM models and it can effectively identify DDoS attacks.

Key words: Distributed denial of service, Multi-scale space-time fusion, Self-attention mechanism, Bidirectional long short-term memory network