OPEN-SET RECOGNITION IN UNKNOWN & KNOWN DDOS ATTACKS DETECTION WITH RECIPROCAL POINTS LEARNING

Abstract

Distributed Denial of Service (DDoS) attacks continue to evolve, with novel and previously unseen variants posing significant challenges to traditional detection systems. Most existing DDoS detection approaches operate under a closed-set assumption, limiting their ability to identify unknown or zero-day attacks. In this paper, we propose a novel open-set recognition framework for DDoS detection based on Reciprocal Points Learning (RPL). Our method enhances the model's ability to distinguish between known attack classes and previously unseen attack patterns by leveraging the concept of reciprocal points in the feature space to improve class separability and detect anomalies. Specifically, RPL dynamically learns feature representations that pull intra-class samples closer while pushing inter-class and unknown samples apart, improving the robustness of the classifier in open-set scenarios. We evaluate our approach using benchmark DDoS datasets, including both known and synthetic unknown attack types. Experimental results demonstrate that our method significantly outperforms state-ofthe-art baselines in detecting unknown attacks while maintaining high accuracy on known classes. This work provides a promising direction for adaptive and resilient DDoS defense systems in the face of increasingly sophisticated threats.