Random Forest Detector and Classifier of Multiple IoT-based DDoS Attacks

Abstract

In this paper two new models for Random Forest (RF) classifiers are presented. The first one discriminates Distributed Denial of Service (DDoS) network attacks from normal IP (Internet Protocol) traffic and the second one classifies 10 types of attacks. General optimization procedures are proposed based on the parameters of the RF classifiers. The observed DDoS attacks are typical for botnets, comprised of IoT (Internet of Things) devices. Bot-master plays central role into coordinating the bots. The explicit aim is either resource exhaustion of the targeted machine or bandwidth saturation of the supporting channels to it. Both activities render the legitimate services unavailable. The detection process has an accuracy of 0.9999. The classification process deviates between 0.9992 and 0.9999. Processing times allow the proposed approach to be used in real-world applications.