DDoS Detection Research Articles

Improved Network Monitoring Using Software-Defined Networking for DDoS Detection and Mitigation Evaluation

The Software-Defined Networking (SDN) is termed to be a promising paradigm since it provides a perfect administration for the network separating the data plane from the control plane. This is unlike the traditional network that has worked with the coupled data and the control plane that allows no scope for innovation. The decoupling of the forwarding and the control plane allows many advantages, such as a programmable control plane, migration, protocols, etc. Despite the provisions in the SDN that provides flexibility and agility in the performance of the network. The network environment suffers from security threats that occur due to DDoS. As the traditional methods prove to be insufficient for DDoS detection and mitigation since they lag in simple and autonomous management. The article presents the fast and flexible method for the early identification of the abnormal traffic flow for detecting the DDoS attacks and the mitigation techniques in SDN will reduce the severity of the DDoS attacks. The proposed method is simulated using the Mininet to show the proficiency of the system in terms of reliability, flexibility, processing overhead, cost, and throughput.

Multi-layer Security Model for DDoS detection in the Internet of Things

IoT security is concerned with safeguarding the associated gadgets and systems on the Internet of things (IoT). The goal of this paper is that the conduct of various security-related issues encompassing the internet of things and proposed countermeasure. In the next few years, it is expecting that 50 billion new devices are to be connected to the IoT. Hence the Internet of Things will encounter highly security risks because of this continuing growing network. In this work, we plan on investigating some of these security issues as well as existing and proposed solutions for dealing with them. Also, the various DDoS attacks are classified in a multilayer approach and the reply attack is modeled which is the variation of DDoS attack that gives the practical perspective of tasks that is implemented on the occurrence of the DDoS assault. The work proposed a new countermeasure called TBC (Threshold Based Countermeasure) which detects the jamming in the communication environment and protects the network from the reply blocking attack, which is considered as the most catastrophic attack among all DDoS attacks. The proposed countermeasure is examined by considering the increasing number of blocking nodes in the network. The result shows that the proposed mechanism TBC works well in the existence of a reply attack with the increased malicious node in the environment thereby increasing the efficiency of energy and time delay.

Distributed Variational Bayes-Based In-Network Security for the Internet of Things

The past few years have witnessed the compelling applications of the Internet of Things (IoT) in our daily life. The explosive growth of the number of IoT devices also presents a great challenge in network security, especially the DDoS attack. Current DDoS defense mechanisms adopted out-of-band architecture, which is accomplished by a process that receives monitoring data from routers and switches, then analyzes that flow data to detect attacks. However, facing IoT devices growing rapidly, this out-of-band architecture confronted with limited processing capacity, bandwidth resources, and service assurance problems. Recently, with the development of the programming switch, it opens up new possibilities for in-network DDoS detection, where the detection algorithms could be directly implemented inside the routers and switches. Benefit from switch processing performance, the in-network mechanism could achieve high scalability and line speed performance. Therefore, in this article, we design a machine learning-based in-network DDoS detection framework. We implement the lightweight variational Bayes algorithm in each switch to detect the anomaly traffic. Besides, considering the shortage of training data in each switch, a centralized platform is introduced to synchronize parameters among distributed switches to realize collaborative learning. Extensive simulations are conducted to evaluate our proposed algorithm in comparison to some state-of-the-art schemes.

A Subset Feature Selection Based DDoS Detection Using Cascade Correlation Optimal Neural Network for Improving Network Resources in Virtualized Cloud Environment

Cloud computing offers a technological revolution to the end-users need less infrastructure costs with virtualizes resources, and storage remains the insecure to delivers the scalability. The most common type of Distributed Denial of Service DDoS attack, (denial of service), is a serious damage measure that affects virtual cloud users and Internet Service Providers (ISPs) are predominantly affects ongoing service attacks. I'm the recipient. These legacy of machine learning approach used to detect vulnerabilities to the attacker's leading network traffic intervention opening the door. By concentrating feature selection and classification approach with optimized neural network model to detect the DDoS type monitoring. This presents a deep neural network based DDoS detection system using Subset Feature Selection based Cascade Correlation Optimal Neural Network (SFS-C2ONN). The proposed approach is based on assumptions based on flow rate which is collected as dataset previously extracted from a model for network traffic. The test results shows that the sensitivity and specify based calcification approach which is suitable for the detection of neural network architecture and hyper parameters, and the optimizer DDoS attack. The results are obtained by calculating the accuracy of the attack detection.

LTC: A Fast Algorithm to Accurately Find Significant Items in Data Streams

Finding top- <inline-formula><tex-math notation="LaTeX">$k$</tex-math></inline-formula> frequent items has been a hot issue in databases. Finding top- <inline-formula><tex-math notation="LaTeX">$k$</tex-math></inline-formula> persistent items is a new issue, and has attracted increasing attention in recent years. In practice, users often want to know which items are significant, <i>i.e.</i> , not only frequent but also persistent. No prior art can address both of the above two issues at the same time. Also, for high-speed data streams, prior art cannot achieve high accuracy when the memory is tight. In this paper, we define a new issue, named finding significant items, and propose a novel algorithm namely LTC to address this issue. It includes two key techniques, Long-tail Restoring and CLOCK, as well as three optimizations. In addition, LTC is extended to support finding significant items with thresholds. We theoretically derive the correct rate and error bound, and conduct extensive experiments on three real datasets to test the performance of LTC. Our experimental results show that LTC can achieve <inline-formula><tex-math notation="LaTeX">$10^5$</tex-math></inline-formula> times higher accuracy in terms of average relative error than other related algorithms. Lastly, LTC is applied to a DDoS detection task and it shows that finding significant items is more powerful than finding frequent items.

Survey on DDoS Detection in Software Defined Network Using Machine Learning Techniques

This paper is a survey on existing techniques of machine learning used for DDoS detection in software-defined networks. A software-defined network that has a centralized controller is prone to DDoS attacks and so a mechanism to detect it at earliest and perform mitigation is required. This paper describes the datasets used, the detection technique used, and a comparison of their results.

Detection of distributed denial of service attacks based on information theoretic approach in time series models

DDoS is becoming one of the most powerful and dangerous cyber-attacks. Tremendous research efforts have already been carried out in the detection of DDoS attacks. Entropy is a statistical measure of attack detection. A study on variation in the distribution of network traffic features is undertaken in this work. The network traffic parameters that are used for DDoS detection include the destination port, protocol, source IP and destination IP. The entropy of the traffic features are passed through time series models so as to avoid the prediction errors. This work uses a nonlinear model called GARCH model (Generalised ARMA model) to improve detection efficiency as it is more suitable for long range non-stationary data series like network traffic. This work focuses on efficient low and high rate DDoS attacks detection based on network traffic entropy and time series models with dynamic threshold algorithm. A stochastic gradient algorithm with a dynamic threshold is used to detect DDoS. The experimental results show higher detection rate and lower false positive rate.

A survey on stateful data plane in software defined networks

Software Defined Networking (SDN), which decouples control plane and data plane, normally stores states on controllers to provide flexible programmability and convenient management. However, recent studies have shown that such configuration may cause frequent and unnecessary interactions between data plane and controllers in some cases. For example, a DDoS detection installed on a controller needs to fetch information from data plane periodically, introducing additional network delay and controller overhead. Thus, stateful data plane is proposed to offload states and operation logics from controller to data plane. Stateful data plane allows switches to perform some operations independently, accelerating packets processing while reducing overhead on both controllers and networks. However, stateful data plane increases the complexity of network devices and imposes many new challenges to the management and schedule of SDN enabled networks. This paper conducts a comprehensive survey on the latest research works and provides insights into stateful data plane. Both stateful data plane platforms and compilers are extensively summarized and analyzed, as well as explicit design of applications based on them. Afterwards, we dwell on the fundamental technologies and research challenges, including implementation considerations of stateful data plane. Finally, we conclude this survey paper with some future works and discuss open research issues.

Fast and Accurate Traffic Measurement With Hierarchical Filtering

Sketches have been widely used to record traffic statistics using sub-linear space data structure. Most sketches focus on the traffic estimation of elephant flows (i.e., heavy hitters) due to their importance to many network optimization tasks, e.g., traffic engineering and load balancing. In fact, the information of aggregate mice flows (e.g., all the mice flows with the same source IP) is also crucial to many security-associated tasks, e.g., DDoS detection and network scan detection. However, the previous solutions, e.g., measuring each individual flow or using multiple sketches for independent measurement tasks, will result in worse estimation error or higher computational overhead. To conquer the above disadvantages, we propose an accurate traffic measurement framework with multiple filters, called Sketchtree, to efficiently measure both elephant flows and aggregate mice flows. These filters in Sketchtree are organized in a hierarchical manner, and help to alleviate the hash collision and improve the measurement accuracy, as the number of flows through hierarchical filters in turn will be decreased gradually. We also design some mechanisms to improve the resource utilization efficiency. To validate our proposal, we have implemented Sketchtree and conducted experimental evaluation using real campus traffic traces. The experimental results show that Sketchtree can increase the processing speed by 100 percent, and reduce the measurement error by over 30 percent compared with state-of-the-art sketches.

An improved rule induction based denial of service attacks classification model

For assessing the quality of any internet and cloud computing services; accessibility is presusmed a significant factor among other Quality of Service (QoS) factors. Distributed Denial of Service attack (DDoS) is considered a significant threat pertaining to all contemporary and emerging online-based services. Intelligent solutions centered on the utilization of data mining methods are looming on the horizon as possible solutions to counter this kind of attacks. Rule Induction (RI), which is a well-known data mining method is regarded as a possible approach for developing an intelligent DDoS detection system. The current article offers an “Improved RI algorithm” (IRI) which decreases the searching space for generating classification rules by removing all unimportant candidate rule-items along the way of creating the classification model. The main advantage of IRI is producing a group of rules that can be described as concise, easy to understand, and easy-to-implement. In addition, the classifiers generated by IRI are more compact in size which is heavily weighted when producing any classification system. The proposed algorithm is then applied for detecting DDoS attacks (IRIDOS). Empirical evaluations using the UNSW-NB15 dataset that has been obtained from the University of New South Wales confirmed the robustness of IRIDOS.

DDoS Detection and Protection Based on Cloud Computing Platform

Currently, the distributed denial service attacks (DDoS) are increased rampantly on the internet, the threshold of such attacks is relatively low for the malicious attackers. Therefore, the DDoS attacks are serious threats to the security availability of the cloud computing. Aiming at the threats, this paper studies the malicious traffic identification and the detection scheme of the denial service attack under the soft-ware-defined Network (SDN), which uses the SDN forwarder to distinguish the DDoS attack traffic and adopt the corresponding filtering means to achieve protection for the distributed denial service attack. This paper firstly implements cloud platform resource calls, then an attack detection technology based on information entropy is proposed and implemented to carry out the DDoS attack detection, because the size of the entropy value can show the discrete or aggregated characteristics of the current data set, which can be used to detect abnormal data traffic. At last, the experiments are also carried out to verify and analyze the effectiveness of the DDoS attack detection and the protection methods.

A Multi-layer Security approach for DDoS detection in Internet of Things

PurposeThe purpose of the paper is to analyze the layer wise security issues in IoT and to obtain the effective security mechanism for jamming attack .Design/methodology/approachIn this study, the authors proposed a multi layer security approach for the detection of DDoS in IoT environment, which protects the smart devices from DDoS, this scheme also reduces the computational cost in the network under mobility condition.FindingsEven though many works have been done for the security of wireless sensor network (WSN), all works have focused on encryption which depends on the key management strategy. In this study, the authors proposed a multilayer approach to analyze the layer wise security issues and also proposed a threshold-based countermeasure (TBC) for replay attack in each layer.Originality/valueThe results indicate that the proposed algorithm lowers the computational costs and energy consumption than in modern schemes. Also, the proposed research work improves the scalability of sensor networks using the TBC.

S-DDoS: Apache spark based real-time DDoS detection system

S-DDoS: Apache spark based real-time DDoS detection system

DDoS detection based on graph structure features and non‐negative matrix factorization

AbstractDistributed denial of service (DDoS) attacks are the most common and harmful attack in the field of network security, the purpose of this paper is to predict the occurrence of DDoS attacks quickly, accurately and effectively. In this paper, the characteristics of DDoS attacks are analyzed in detail, graph model is used to express the structural characteristics of traffic data between the victims and bots, at the same time, considering data characteristics of traffic itself, 11 characteristics are selected at last. The method of nonnegative matrix factorization (NMF) is adopted to mine the behavior pattern of DDoS attacks, and then the DDoS bots is detected by clustering according to the projection value of nodes on the behavior pattern. By extracting the attack behavior pattern, the attack behavior can be detected. Experimental results of real dataset verify the effectiveness and validity of the method.

Feature selection for DDoS detection using classification machine learning techniques

Computer system security is a factor that needs to be considered in the era of industrial revolution 4.0, namely by preventing various threats to the system, as well as being able to detect and repair any damage that occurs to the computer system. DDoS attacks are a threat to the company at this time because this attack is carried out by making very large requests for a site or website server so that the system becomes stuck and cannot function at all. DDoS attacks in Indonesia and developed countries always increase every year to 6% from only 3%. To minimize the attack, we conducted a study using Machine Learning techniques. The dataset is obtained from the results of DDoS attacks that have been collected by the researchers. From the datasets there is a training and testing of data using five techniques classification: Neural Network, Naïve Bayes and Random Forest, KNN, and Support Vector Machine (SVM), datasets processed have different percentages, with the aim of facilitating in classifying. From this study it can be concluded that from the five classification techniques used, the Forest random classification technique achieved the highest level of accuracy (98.70%) with a Weighted Avg 98.4%. This means that the technique can detect DDoS attacks accurately on the application that will be developed.

Analysis of Features Dataset for DDoS Detection by using ASVM Method on Software Defined Networking

The impact of Distributed Denial of Service (DDoS) attack is one of the major concerns for Software Defined Networking (SDN) environments. Support Vector Machine (SVM) has been used in a DDoS attack detection mechanism on SDN. The advantages of SVM algorithms in DDoS attack detections are high accuracy and low false positive rate. However, SVM algorithm takes too long for training and testing time. A large number of literatures have been tried to get better results in a SVM-based DDoS attack detection. They proposed various kinds of SVM-based detection methods. Their results were measuring and evaluating by using various evaluation metrics. As a result, a SVM-based detection performance depends on the nature of traffic datasets. In this paper, our focus is to analyze the extracted features from the SDN traffics dataset resulting on a reduction of bias data from the dataset. SDN traffics features dataset were validated by using 10-fold cross-validation method. The effectiveness of our created dataset was validated by comparing with other dataset, e.g. Knowledge Discovery and Data Mining Tools Competition (KDDCUP) 99 dataset. In conclusion, our proposed dataset can be used effectively for SVM on SDN.

Hybrid DDoS Detection Framework Using Matching Pursuit Algorithm

Although a considerable amount of research has been done on DDoS attacks, it still poses a severe threat to many businesses and internet service providers. DDoS attacks commonly generate a high amount of network traffic. However, the resource depletion DDoS attacks can deny the target service, although it generates much less traffic than legitimate traffic. We propose a novel DDoS detection framework using the Matching Pursuit algorithm to detect resource depletion type DDoS attacks. We use multiple characteristics of network traffic simultaneously in order to detect low-density DDoS attacks efficiently. The proposed method uses the dictionary produced from the parameters of the network traffic using the K-SVD algorithm.Dictionary generation using network traffic, provides legitimate and attack traffic models, and adds adaptability of the proposed method to network traffic. We also implement DDoS detection approaches that use Matching Pursuit and Wavelet techniques and compare them using two different data sets. Additionally, we offer a hybrid DDoS detection framework that combines these approaches with a decision-making mechanism using an artificial neural network. We evaluate the proposed methods with two different data sets. The proposed approaches perform over 99% true positive rate with a false positive rate lower than 0.7% with a low-density DDoS attack dataset. In the hybrid intrusion detection system with more than one attack, the detection performances of other methods have decreased, while the proposed approach achieves true positive rates higher than 99% with a false positive rate lower than 0.7%.

Dual‐collaborative DoS/DDoS mitigation approach in information‐centric mobile Internet

SummaryThe amount of wireless traffic is increasing at an overwhelming speed. Information‐centric networking (ICN) has been proposed as a promising Future Internet Architecture, which can reduce network traffic by putting data objects toward the edge. It is expected that in information‐centric mobile Internet (ICMI), the wireless traffic can be significantly reduced. Yet, DoS/DDoS attack becomes a critical issue in ICMI by causing wireless gateway blockade. To tackle the problem, we propose a dual‐collaborative DoS/DDoS mitigation approach (DCMA) and advanced DCMA to protect wireless gateways. In the algorithm, the attackers' visiting information including international mobile equipment identity (IMEI) and data object name (DON) are analyzed jointly to accurately identify potential attackers through the collaboration between the Internet and mobile network. In addition, the attacker's behaviors are analyzed centrally, and security strategies are applied distributively throughout wireless edge through the collaboration between wireless core network (CN) and radio access network (RAN). Extensive simulations are performed to verify the effectiveness of the proposed algorithms. The results demonstrate that advanced DCMA can achieve high DDoS and attacker detection probability and small false positive probability.

On the performance of intelligent techniques for intensive and stealthy DDos detection

Distributed Denial of Services (DDoS) attacks continue to be one of the most challenging threats to the Internet. The intensity and frequency of these attacks are increasing at an alarming rate. With the promising results presented by Machine Learning (ML) techniques in variety fields, researchers have proposed numerous intelligent schemes to defend against DDoS attacks and mitigate their impact. This paper presents a taxonomy of the ML-based DDoS detection schemes, focusing on the important features and mechanisms that each scheme uses to detect and mitigate the impact of these attacks. The taxonomy is developed based on a thorough and extensive review of the literature, focusing on the most prominent and highly cited schemes that have been proposed over the last decade. The taxonomy is then used as a basis for the development of a framework to conduct a comprehensive empirical evaluation of the basic mechanisms underling the design of the selected ML-based DDoS defense schemes against a variety of attack scenarios. Rather than dealing with the specific details of a particular DDoS defense scheme, this work focuses on the “building blocks” of the intelligent DDoS detection and prevention schemes. The intelligent mechanisms underlying the selected schemes are implemented and evaluated using different performance metrics. The impact of different influential factors are also explored, including the observable traffic proportions, attack intensities and the “Class Imbalance Problem” of ML-based DDoS detection. The results of the comparative analysis show that no single technique outperforms all others in all test cases. Furthermore, the results underscore the need for a method oriented feature selection model to enhance the capabilities of ML-based detection techniques. Finally, the results show that the class imbalance problem significantly impact performance, underscoring the need for further research to address this problem and ensure high-quality DDoS detection in real-time.

DDoS attack aware environment with secure clustering and routing based on RPL protocol operation

Routeing protocol for low-power and lossy networks (RPL) are widely used in dynamic wireless sensor network. Several types of researches worked on RPL and designed hybrid energy-efficient cluster-parent-based RPL, queue utilisation (QU)-RPL, improved RPL, attack detection RPL etc. to support from vulnerable threats, provide efficient routeing and balance dynamic nodes in the network. Previous research findings dealt with certain limitations and problems. In this study, a new coordinative-balanced clustering algorithm is proposed which is enabled to balance destination-oriented directed acyclic graph (DODAG) that is formed in each cluster. Pruning of nodes from DODAG effectively maintains cluster with minimised complexity. This study also resolves the problem of two common security attacks such as distributed denial of service attack (DDoS) and version number attack. Then, enriched-ant colony optimisation is used for DDoS detection and a secure route is chosen to perform data transmission. At the instance of selecting best parent for forwarding data, the authors use residual energy and scoring factor. Scoring factor of each node denotes the legitimacy to be selected as the best parent. Finally, results obtained from Network Simulator 3 indicate better performances on the following metrics: packet delivery ratio, end-to-end delay, node death minimisation, packet loss rate and power consumption.