Error-Robust Distributed Denial of Service Attack Detection Based on an Average Common Feature Extraction Technique.

João Paulo Abreu Maranhão,Elnaz Javidi,Edison Pignaton De Freitas,Rafael Timóteo De Sousa Júnior,João Paulo Carvalho Lustosa Da Costa

doi:10.3390/s20205845

Abstract

In recent years, advanced threats against Cyber–Physical Systems (CPSs), such as Distributed Denial of Service (DDoS) attacks, are increasing. Furthermore, traditional machine learning-based intrusion detection systems (IDSs) often fail to efficiently detect such attacks when corrupted datasets are used for IDS training. To face these challenges, this paper proposes a novel error-robust multidimensional technique for DDoS attack detection. By applying the well-known Higher Order Singular Value Decomposition (HOSVD), initially, the average value of the common features among instances is filtered out from the dataset. Next, the filtered data are forwarded to machine learning classification algorithms in which traffic information is classified as a legitimate or a DDoS attack. In terms of results, the proposed scheme outperforms traditional low-rank approximation techniques, presenting an accuracy of , detection rate of and false alarm rate of for a dataset corruption level of with a random forest algorithm applied for classification. In addition, for error-free conditions, it is found that the proposed approach outperforms other related works, showing accuracy, detection rate and false alarm rate of , and , respectively, for the gradient boosting classifier.

Highlights

Cyber–Physical Systems (CPSs) consist of a set of networked components including sensors, control processing units and communication devices applied to the monitoring and management of physical infrastructures [1]
The Relative Loss of Accuracy is adopted as error-robustness evaluation metric
Such metrics are based on the values of true positives (TP), true negatives (TN), false positives (FP) and false negatives (FN)

Summary

Introduction

Cyber–Physical Systems (CPSs) consist of a set of networked components including sensors, control processing units and communication devices applied to the monitoring and management of physical infrastructures [1]. CPSs are typically used for safety-critical applications, such as in avionics, instrumentation, defense systems and critical infrastructure control, for instance, electric power, water resources and communications systems [2]. Potential cyber and physical attacks can lead to information leakage, extensive economic damage and critical infrastructure destruction [3]. A CPS architecture is typically composed of five layers, namely, physical layer, sensor/actuator layer, network layer, control layer, and information layer. The physical layer consists of the physical objects or processes monitored by CPSs. In addition, the sensor/actuator layer is composed of sensors, which measure data obtained from the physical layer, and by actuators, which execute specific

Results

Discussion

Conclusion