DDoS attack detection using semi-supervised hyperparameter optimized federated learning in software defined internet of drones

The architecture of SDN helps in early detection and mitigation of DDoS attacks, which is a challenge in the traditional network. With appropriate identification patterns and detection scheme, the SDN controller detects DDoS attacks in infant stages and suppresses their impact on the entire network. This paper proposes a feature set for classification of DDoS attacks from normal traffic. Further, a system model for detection of DDoS attacks implemented with SDN controller is proposed. The detection module in system model is based on RBF network having PSO optimized learning that is further compared with several schemes. The effectiveness of the system model has been verified by its real-time emulation with mininet emulator. The proposed system model is efficient in classifying heavy traffic load in the network from that of DDoS attacks and is capable of handling the DDoS attacks in their early stages itself.

Software Defined Networking (SDN) is a dynamic architecture that employs a variety of applications for making networks more adaptable and centrally controlled. It is easy to attack the entire network in SDN because the control plane and data plane are separated. DDoS attack is major danger to SDN service providers because it can shut down the entire network and stop services to all customers at any time. One of the key flaws of most SDN architectures is lack of susceptibility to DDoS attacks with its types like TCP flooding, UDP flooding, SYN flooding, ICMP flooding and DHCP flooding for detecting those kinds of attacks. The machine learning algorithms are widely used in recent years to identify DDoS attacks. This research utilizes Decision Tree Classifier for detection and classification of DDoS attacks on SDN. The Forward Feature Selection technique is also used in the research to select the best features from the dataset and from that dataset the data are employed to train and test the model by Decision Tree Classifier Algorithm. The decision Tree Classifier technique is a supervised method used to forecast desired values of observations using rudimentary machine learning decision rules derived from training data. Based on the accuracy of decision tree techniques, in future, a hybrid learning model will be designed for detecting the Distributed Denial of Services in an SDN environment with high accuracy and a low false negative rate.

Distributed denial of service or DDoS attack is a kind of network attack that is used to destroy the normal operations of the server and its responses. There are several approaches through which we can detect the abnormal behaviour of the network traffic. However, machine learning techniques are best used techniques for the detection and identification of DDoS attack. This attack is regarded as one of the most serious threats to the internet. Supervised machine learning algorithms rely on the availability of labelled network traffic datasets. Attacks, on the other hand, are identified in unsupervised approaches by analysing incoming network traffic. These techniques face challenges like less accuracy, classification issue, falser positive rate and more network data. The semi supervised ML approaches are presented in this work for the detection of DDoS which is based on the estimation of network entropy, information gain ratio, co clustering as well as Random Forest algorithm. The irrelevant normal traffic data is reduced with the unsupervised part of this approach for the detection of DDoS which also allow the reduction of false positive rates and also the accuracy is increased. On the other hand, further reduction of false positive rates of unsupervised part is done by the part which is supervised and the DDoS traffic is also accurately classified.

Aiming at the problem of DDoS attack detection in internet of things (IoT) environment, statistical and machine-learning algorithms are proposed to model and analyze the network traffic of DDoS attack. Docker-based virtualization platform is designed and configured to collect IoT network traffic data. Then the packet-level, flow-level, and second-level network traffic datasets are generated, and the importance of features in different traffic datasets are sorted. By SKlearn and TensorFlow machine-learning software framework, different machine learning algorithms are researched and compared. In packet-level DDoS attack detection, KNN algorithm achieves the best results; the accuracy is 92.8%. In flow-level DDoS attack detection, the voting algorithm achieves the best results; the accuracy is 99.8%. In second-level DDoS attack detection, the RNN algorithm behaves best results; the accuracy is 97.1%. The DDoS attack detection method combined with statistical analysis and machine-learning can effectively detect large-scale DDoS attacks on the internet of things simulation experimental environment.

Today attackers are turning to mobile and Internet of Things (IoT) technologies to diversify and strengthen DDoS Attacks. Many methods exist for detecting different types of DDoS attacks. In this paper, the authors proposed HCTDDA (hybrid classification technique for detection of DDoS attacks) for detecting DDoS attacks by using machine learning and deep learning methods (Random Forest, Decision Tree, SNN, DNN and XGBoost) in combination with various feature selection methods. The goal of proposing HCTDDA is early and accurate detection of DDoS attacks. To achieve this goal, we apply the feature selection methods (Chi-Square, Extra Tree, ANOVA and Mutual Information) to determine the appropriate attributes that are better deliverables for the prediction model. After analyzing the results Mutual Information Feature selection at 45 features gives 96.77 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">%</sup> as the highest accuracy with a feature reduction rate of 43.04% for early detection of DDoS attacks.

Machine learning-based DDoS attack detection methods are mostly implemented at the packet level with expensive computational time costs, and the space cost of those sketch-based detection methods is uncertain. This paper proposes a two-stage DDoS attack detection algorithm combining time series-based multi-dimensional sketch and machine learning technologies. Besides packet numbers, total lengths, and protocols, we construct the time series-based multi-dimensional sketch with limited space cost by storing elephant flow information with the Boyer-Moore voting algorithm and hash index. For the first stage of detection, we adopt CNN to generate sketch-level DDoS attack detection results from the time series-based multi-dimensional sketch. For the sketch with potential DDoS attacks, we use RNN with flow information extracted from the sketch to implement flow-level DDoS attack detection in the second stage. Experimental results show that not only is the detection accuracy of our proposed method much close to that of packet-level DDoS attack detection methods based on machine learning, but also the computational time cost of our method is much smaller with regard to the number of machine learning operations.

Software-defined networking is one of the fast-growing and emerging technology which separates the control plane from the data plane. The control plane enables global network management, preventing the need for individual controllers in each networking system. Though SDN has many advantages, it has a serious threat from DDoS attack due to the centralized nature of the controller. DDoS are widely used cyberattack in SDN environment where in controller may be slowed down or shutdown. Detection of DDoS attack is addressed in the literature using machine learning and deep learning. However, most of the authors have addressed the detection of DDoS attack either in control plane or data plane. In this paper, we propose a hybrid approach to detection of the attack in control and data plane using the combination of entropy and machine learning approaches. We use Mininet emulator with POX controller to create a trained and test model. The results reveal that the combined approach achieves better accuracy with less overhead.

In the area of cloud security, detection of DDoS attack is a challenging task such that legitimate users use the cloud resources properly. So in this paper, detection and classification of the attacking packets and normal packets are done by using various machine learning classifiers. We have selected the most relevant features from NSL KDD dataset using five (Information gain, gain ratio, chi-squared, ReliefF, and symmetrical uncertainty) commonly used feature selection methods. Now from the entire selected feature set, the most important features are selected by applying our hybrid feature selection method. Since all the anomalous instances of the dataset do not belong to DDoS category so we have separated only the DDoS packets from the dataset using the selected features. Finally, the dataset has been prepared and named as KDD DDoS dataset by considering the selected DDoS packets and normal packets. This KDD DDoS dataset has been discretized using discretize tool in weka for getting better performance. Finally, this discretize dataset has been applied on some commonly used (Naive Bayes, Bayes Net, Decision Table, J48 and Random Forest) classifiers for determining the detection rate of the classifiers. 10 fold cross validation has been used here for measuring the robustness of the system. To measure the efficiency of our hybrid feature selection method, we have also applied the same set of classifiers on the NSL KDD dataset, where it gives the best anomaly detection rate of 99.72% and average detection rate 98.47% similarly, we have applied the same set of classifiers on NSL DDoS dataset and obtain the average DDoS detection of 99.01% and the best DDoS detection rate of 99.86%. In order to compare the performance of our proposed hybrid method, we have also applied the existing feature selection methods and measured the detection rate using the same set of classifiers. Finally, we have seen that our hybrid approach for detecting the DDoS attack gives the best detection rate compared to some existing methods.

Cloud computing provides a great platform for the users to utilize the various computational services in order accomplish their requests. However it is difficult to utilize the computational storage services for the file handling due to the increased protection issues. Here Distributed Denial of Service (DDoS) attacks are the most commonly found attack which will prevent from cloud service utilization. Thus it is confirmed that the DDoS attack detection and load balancing in cloud are most extreme issues which needs to be concerned more for the improved performance. This attained in this research work by measuring up the trust factors of virtual machines in order to predict the most trustable VMs which will be combined together to form the trustable source vector. After trust evaluation, in this work Bat algorithm is utilized for the optimal load distribution which will predict the optimal VM resource for the task allocation with the concern of budget. This method is most useful in the process of detecting the DDoS attacks happening on the VM resources. Finally prevention of DDOS attacks are performed by introducing the Fuzzy Extreme Learning Machine Classifier which will learn the cloud resource setup details based on which DDoS attack detection can be prevented. The overall performance of the suggested study design is performed in a Java simulation model to demonstrate the superiority of the proposed algorithm over the current research method.

Distributed denial of service (DDoS) attacks are common attacks that limit casual users from cracking critical network resources. A method to find the DDoS attack comes to light as an essential and hot research issue. Therefore, the increment in network usage scale demands more challenges to see the DDoS attack. Non‐real‐time collection of network traffic will make sincere complications inaccuracy; DDoS attack detection, and efficiency. Lately, sketch data structures play an excellent role in high‐speed networks to suppress and combine network traffic issues. However, the sketch data structure has issues rebuilding the reverse keys that behave abnormally due to the reversible hash function. To rectify the above difficulties, we include the Chinese Remainder Theorem‐based Reverse Sketching (CRTRS). However, Reverse Sketching is not good at suppressing and combining heavy network traffic, but it can easily detect abnormal keys. According to the network traffic records setup by CRTRS, we add the Modified Cumulative Sum Quality Control Scheme (MCSQCS) that encourages DDoS attack detection. The enforcement of the proposed work with DDoS attack detection has two kind of different data sets. The result of the experiments shows that it gives more accuracy and efficiency in detecting DDoS attacks. Therefore, comparing other DDoS detecting methods with the sketch data structure has fewer computational complications. Improving the anomalous keys is the most critical challenge in this proposed work. To illustrate the accuracy rate, we experiment with a new technique called CIC‐Friday Heavy network traffic fragment. We also explain the experimental results of the MAWI heavy network fragment with the various parameter setups. To compare our proposed method with other similar existing methods, we use a sketch data structure to manage the network traffic data. It also uses the MSPCA method to detect the DDoS attack. The information‐based analysis helps to see the DDoS attack. The result analysis of True Positive Value (TPV) and False Positive Value (FPV) with MSPCA techniques has 79% and .1% accuracy. Similarly, information‐based detection has an accuracy of about 90% and 5%. Hence, the proposed method gives more accuracy for the detection of DDoS attacks.

An Application Layer Distributed Denial of Service Attack (DDoS) is one of the biggest concerns for web security. Many detection methods are designed to mitigate DDoS attack based on IP and TCP layer instead of the Application layer. These methods are not suitable for detection of Application layer DDoS attack since most of the IP and TCP layer DDoS attacks are based on request flooding attack. But Application layer DDoS attacks consist of request flooding, session flooding, and asymmetric attack. The solutions available to detect Application layer DDoS attack, detect only limited number of Application layer DDoS attacks. The solutions that detect all types of Application layer DDoS attacks have huge algorithm complexity. One of the major challenges in the detection of an Application layer DDoS attack is the non-availability of features to detect such attacks. Hence it is difficult to model normal user behavior from attack behavior. In this paper, Deep learning architecture is introduced to learn deep features of Application layer DDoS attack. Deep learning architecture consist of very deep neural network, typically more than three layers. In the proposed work the concept of AutoEncoder is applied, which is one of the deep learning based models that learns deep useful features in the Application layer DDoS attack dataset. The Stacked AutoEncoder deep learning architecture, is aimed to receive high level features. The performance of the proposed method was evaluated in terms of the metrics such as false positive rate and detection rate. Comparison of the proposed method with the existing methods reveals that the proposed method performs better than the existing methods.

Unmanned Aerial Vehicles (UAV) network has been explored widely in recent years. The deployment of small to medium-scale UAVs are being considered for several real-time applications such as monitoring, surveillance, search and rescue services. Throughput in the communication model plays a vital role in improvising available capacity and balancing the data traffic loads. Often UAVs carry real-time sensitive data which are vulnerable to cyber-attacks and the UAVs’ wireless communication networks become more vulnerable to various forms of cyber-attacks. In this paper, we propose a secure machine learning-based approach to maximize the throughput of a Software Defined Network (SDN) controller for better UAV communications and security. The proposed approach consist of three steps, a) optimal placement and user association of UAVs using Genetic algorithm b) SDN controller placement using shortest path via single connected graph and c) creation and detection of DDoS attack using Feedforward neural network classifier. The best position of UAVs as base stations is obtained from the energy’s estimation of previous base station and users. After UAVs optimal placement, the availability of network capacity under SDN controller is done by finding the shortest path using bellman ford algorithm. It intends to balance the loads and generate traffic-free data transmission. Additionally, detection of DDoS attacks is also studied. The combination of two feature reduction techniques, Principal Component Analysis (PCA) and Linear Discriminant Analysis (LDA) are employed to find the features relevant to DDoS attacks. These features are then fed into the Feedforward neural network classifier that classifies the normal and abnormal network traffic data of UAVs. The proposed approach is evaluated using simulations. Experimental results show high efficiency and security measures in SDN-based UAV networks.

The traditional infrastructures are assisted by introducing the promising applications of Internet of things (IoT) (smart cities, smart homes, smart girds and smart health) with smart objects. In cloud servers, DDoS attacks happened and cause a problem of overwhelming. But Internet of things (IoT) devices increase in number which leads to cause the large-scale DDoS attacks influence from the IoT devices. Therefore, design and implementation of efficient counter-based IoT DDoS attack detection system using machine learning is proposed in this paper. Different network parameters values are used in detection of abnormal defense activities and DDoS attacks by the proposed framework. With the help of wired or wireless networks, the required dataset as sensor data is collected from the different sensors which are equipped on the eight smart poles which are constructed on certain campus. According to types of DDoS attacks, the features are extracted. Different machine learning classifiers are used in this proposed DDoS attack detection method as neural network, LSVM, random tree and decision tree (J-48). In the real IoT environment, DDoS attack detection method with best accuracy is obtained by using feature selection. Therefore, from the experimental results, the accuracy performance is having or achieving the higher accuracy. IoT DDoS attacks detection system results effectively block the harmed devices.KeywordsDDoS attacksMachine learning (ML)Internet of things (IoT)Software defined networks (SDN)

Aiming at the problem of insufficient searching ability of Quantum Genetic Algorithms (QGA), this paper proposes a method to improve QGA by dynamically changing the rotation angle of quantum revolving gates. Thirteen typical standard functions are used to test the improved QGA, and to further verify the improved QGA. In this paper, a DDoS attack detection model based on quantum genetic optimization BP neural network (DQGA-BP) is constructed. The model combines improved quantum genetic algorithm with BP neural network, and uses KDD-Cup 1999 data set (9-week network connection collected from the USAF LAN) to detect DDoS attacks. It effectively improves the accuracy of DDoS attack detection. The experimental results show that the improved quantum genetic algorithm has faster convergence speed and stronger optimization ability. Under DDoS attack detection, the average detection rate of DQGA-BP is 0.51491% higher than that of the original quantum genetic optimization BP neural network (QGA-BP), and the average false alarm rate is 0.37%.

With the advent of the "Internet +" era, network viruses, hacker attacks, and personal data breaches have gradually become the cybersecurity issues that people are concerned about. Blockchain technology has the advantages such as decentralization, immutability, and smart contracts. It can be used in network infrastructure protection to prevent computers from being hacked illegally, ensuring the integrity and security of users' personal data. In this paper, we propose a DDoS attack detection method based on the attention mechanism of LSTM that involves using a deep learning model to analyze network traffic data and identify DDoS attacks, named A-LSTM. The attention mechanism in LSTM helps to focus on the most important features in the data, which are critical for accurate DDoS attack detection. This method has the potential to improve the accuracy of DDoS attack detection compared to traditional methods by leveraging the powerful pattern recognition capabilities of deep learning models.