Multischeme feedforward artificial neural network architecture for DDoS attack detection

Arif Wirawan Muhammad,Kamaruddin Malik Bin Mohammed,Cik Feresa Mohd Foozy

doi:10.11591/eei.v10i1.2383

Abstract

Distributed denial of service attack classified as a structured attack to deplete server, sourced from various bot computers to form a massive data flow. Distributed denial of service (DDoS) data flows behave as regular data packet flows, so it is challenging to distinguish between the two. Data packet classification to detect DDoS attacks is one solution to prevent DDoS attacks and to maintain server resources maintained. The machine learning method especially artificial neural network (ANN), is one of the effective ways to detect the flow of data packets in a computer network. Based on the research that has carried out, it concluded that ANN with hidden layer architecture that contains neuron twice as neuron on the input layer (2n) produces a stable detection accuracy value on Quasi-Newton, Scaled-Conjugate and Resilient-Propagation training functions. Based on the studies conducted, it concluded that ANN Architecture sufficiently affected the Scaled-Conjugate and Resilient-Propagation training functions, otherwise the Quasi-Newton training function. The best detection accuracy achieved from the experiment is 99.60%, 1.000 recall, 0.988 precision, and 0.993 f-measure using the Quasi-Newton training function with 6-(12)-2 neural network architecture.

Highlights

Distributed denial of service attacks (DDoS) is a type of attack that has a quite fatal impact on the target server [1]
DDoS attacks originate from a collection of small-sized data packet streams sourced from a large number of bot computers to produce a massive data flow directed at a target server [2]
From the research that has carried out, it found that the neural network architecture of hidden layer neurons is 2n, (6-(12)-2) (n is the neural network input layer neurons numbers), combined with training function of Quasi-Newton gives the best accuracy results=99.60%; recall=1.000; precision=0.988; f-measure=0.993

Summary

Introduction

Distributed denial of service attacks (DDoS) is a type of attack that has a quite fatal impact on the target server [1]. DDoS attacks originate from a collection of small-sized data packet streams sourced from a large number of bot computers to produce a massive data flow directed at a target server [2]. Detection of the packet flow is one of the techniques to prevent DDoS attacks. Machine learning methods can be used as network packet detection techniques utilizing artificial neural network (ANN). DDoS attacks detection using ANN was once carried out by [7] by utilizing sinusoidal functions to extract essential features from network packet flow resulted in 95.56% accuracy. A neural network with resilient-propagation training function, pooled with the collective classifier output method and Journal homepage: http://beei.org

Methods

Results

Conclusion