DDoS Mitigation Research Articles

A Deep Ensemble Framework for DDoS Attack Recognition and Mitigation in Cloud SDN Environment

A Deep Ensemble Framework for DDoS Attack Recognition and Mitigation in Cloud SDN Environment

Online and Predictive Coordinated Cloud-Edge Scrubbing for DDoS Mitigation

Online and Predictive Coordinated Cloud-Edge Scrubbing for DDoS Mitigation

Machine learning-based DDOS attack detection and mitigation in SDNs for IoT environments

Software-defined network (SDN) platforms play a key role in providing security against today's Internet attacks. SDNs decouple the control plane from the data plane to maximize network performance. A DDOS attack is one of several in cloud-based networks. SDNs play a crucial role in controlling DDoS attacks and protecting end nodes like IoT nodes, as well as other computing devices, in large-scale cloud networks. This paper provides an efficient approach to DDoS attack detection and prevention using machine learning algorithms. The paper analyses the performance of SDNs in IoT systems, incorporating a huge set of computing devices that use multi-controllers. It also proposes an effective method to handle DDoS attacks. DDoS attacks are generated from IoT end devices in the infrastructure layer, which targets resources via an SDN-controlled testbed. The proposed ML method outperforms existing methods in terms of accurately and effectively detecting and mitigating flooding DDoS attacks with 99.99% accuracy. The proposed work's results are also compared to the results of other articles to prove the effectiveness of the results.

Detection and mitigation of DDoS attacks based on multi-dimensional characteristics in SDN

Due to the large computational overhead, underutilization of features, and high bandwidth consumption in traditional SDN environments for DDoS attack detection and mitigation methods, this paper proposes a two-stage detection and mitigation method for DDoS attacks in SDN based on multi-dimensional characteristics. Firstly, an analysis of the traffic statistics from the SDN switch ports is performed, which aids in conducting a coarse-grained detection of DDoS attacks within the network. Subsequently, a Multi-Dimensional Deep Convolutional Classifier (MDDCC) is constructed using wavelet decomposition and convolutional neural networks to extract multi-dimensional characteristics from the traffic data passing through suspicious switches. Based on these extracted multi-dimensional characteristics, a simple classifier can be employed to accurately detect attack samples. Finally, by integrating graph theory with restrictive strategies, the source of attacks in SDN networks can be effectively traced and isolated. The experimental results indicate that the proposed method, which utilizes a minimal amount of statistical information, can quickly and accurately detect attacks within the SDN network. It demonstrates superior accuracy and generalization capabilities compared to traditional detection methods, especially when tested on both simulated and public datasets. Furthermore, by isolating the affected nodes, the method effectively mitigates the impact of the attacks, ensuring the normal transmission of legitimate traffic during network attacks. This approach not only enhances the detection capabilities but also provides a robust mechanism for containing the spread of cyber threats, thereby safeguarding the integrity and performance of the network.

A comprehensive survey on DDoS detection, mitigation, and defense strategies in software-defined networks

A comprehensive survey on DDoS detection, mitigation, and defense strategies in software-defined networks

DDoS Mitigation in IoT Using Machine Learning and Blockchain Integration

DDoS Mitigation in IoT Using Machine Learning and Blockchain Integration

Enhancing Cybersecurity in Software-Defined Networking: A Hybrid Approach for Advanced DDoS Detection and Mitigation

Enhancing Cybersecurity in Software-Defined Networking: A Hybrid Approach for Advanced DDoS Detection and Mitigation

SDN-based detection and mitigation of DDoS attacks on smart homes

The adoption of the Internet of Things (IoT) has proliferated across various domains, where everyday objects like refrigerators and washing machines are now equipped with sensors and connected to the internet. Undeniably, the security of such devices, which were not primarily designed for internet connectivity, is of utmost importance but has been largely neglected. In this paper, we propose a framework for the real-time DDoS attack detection and mitigation in SDN-enabled smart home networks. We capture network traffic during regular operations and during DDoS attacks. This captured traffic is used to train several machine learning (ML) models, including Support Vector Machine (SVM), Logistic Regression, Decision Trees, and K-Nearest Neighbors (KNN) algorithms. These trained models are executed as SDN controller applications and subsequently employed for real-time attack detection. While we utilize ML techniques to protect IoT devices, we propose the use of SNORT, a signature-based detection technique, to secure the SDN controller itself. Real-world experiments demonstrate that without SNORT, the SDN controller goes offline shortly after an attack, resulting in a 100% packet loss. Furthermore, we show that ML algorithms can efficiently classify traffic into benign and attack traffic, with the Decision Tree algorithm outperforming others with an accuracy of 99%.

A framework for the detection of distributed denial of service attacks on network logs using ML and DL classifiers

Despite the promise of machine learning in DDoS mitigation, it is not without its challenges. Attackers can employ adversarial techniques to evade detection by machine learning models. Moreover, machine learning models require large amounts of high-quality data for training and continuous refinement. Security teams must also be vigilant in monitoring and fine-tuning these models to adapt to new attack vectors. Nonetheless, the integration of machine learning into cybersecurity strategies represents a powerful approach to countering the persistent threat of DDoS attacks in an increasingly interconnected world. This paper proposed Machine Learning (ML) models and a Deep Learning (DL) model for the detection of Distributed Denial of Service Attacks (DDOS) on network system. The DDOS dataset is highly imbalanced because the number of instances of the various classes of the dataset are different. To solve the imbalance problem, we performed random under-sampling using under sampling technique in python called random under-sampler. The down sampled dataset was used for the training of the ML and DL classifiers. The trained models are random forest, gradient boosting and recurrent neural network algorithms on the DDOS dataset. The model was trained on the DDOS dataset by fine tuning the hyper parameters. The models was used to make prediction in an unseen dataset to detect the various types of the DDOS attacks. The result of the models were evaluated in terms of accuracy. The results of the models show an accuracy result of 79% for random forest, 82%, for gradient boosting, and 99.47% for recurrent neural network. From the experimental results.

DDoS mitigation using blockchain and machine learning techniques

DDoS mitigation using blockchain and machine learning techniques

Synchronizing DDoS detection and mitigation based graph learning with programmable data plane, SDN

The availability of SD-IoT is now under complex and serious cyber threats, especially distributed denial-of-service attacks. However, traditional defense schemes suffer from coarse-grained centralized sampling approaches, low accuracy of detection models, and inefficient mitigation methods. In this paper, a novel DDoS defense scheme is proposed, which consists of a high-accuracy detection mechanism based on a Graph Convolutional Neural Network learning model and a mitigation mechanism based on fast traffic migration. In the detection stage, a fine-grained INT sampling approach is utilized to obtain multidimensional network topology and status information. The Graph Convolutional Neural Network learning model detects switches containing DDoS attack traffic with high accuracy because the detection model not only extracts and utilizes multiple temporal and spatial features of the collected information, but also has a better learning and representation capability. In the mitigation stage, the enhanced whitelist with dynamic threshold-based values is automatically adapted to the real-time state of the network environment for enhanced mitigation flexibility. The fast programmable segment rerouting strategy can block attack traffic in time and ensure the continuity of network services. The results of several comparison experiments show that the proposed scheme can detect DDoS attacks more accurately and mitigate them more effectively than traditional schemes.

The Economics of DDoS Mitigation and Changing Internet Protocols

The Economics of DDoS Mitigation and Changing Internet Protocols

A Novel DDoS Mitigation Strategy in 5G-Based Vehicular Networks Using Chebyshev Polynomials

A Novel DDoS Mitigation Strategy in 5G-Based Vehicular Networks Using Chebyshev Polynomials

Retracted: Lightweight Statistical Approach towards TCP SYN Flood DDoS Attack Detection and Mitigation in SDN Environment

Retracted: Lightweight Statistical Approach towards TCP SYN Flood DDoS Attack Detection and Mitigation in SDN Environment

A novel DDoS detection and mitigation technique using hybrid machine learning model and redirect illegitimate traffic in SDN network

A novel DDoS detection and mitigation technique using hybrid machine learning model and redirect illegitimate traffic in SDN network

SDN/NFV-based framework for autonomous defense against slow-rate DDoS attacks by using reinforcement learning

The unforeseen and skyrocketed shift in the number of connections to the Internet during the last years has created vast and critical vulnerabilities in networks that cybercriminals have quickly seized to launch high-volume DDoS attacks. Existing tools, such as advanced firewalls or intrusion prevention systems (IPS), cannot handle such an elevated volume of attacks because these solutions are dependent on humans. Therefore, adaptation of the current network security solutions to automated ones is more significant than ever to foster the development of the zero-touch networks and service management (ZSM) paradigm. Building on our preliminary work in this field, in this study, we provide a software-defined networking (SDN)-based framework that automates the detection and mitigation of slow-rate DDoS attacks. The framework uses deep learning (DL) to detect attacks and reinforcement learning (RL) to mitigate them. Furthermore, a network function virtualization (NFV)-assisted moving target defense (MTD) mechanism is included to amplify the effectiveness and flexibility of the solution. The framework is tested on a simulated network using open-source tools, namely Open Network Operating System (ONOS), Containernet, Apache Web Server, and Docker. The source code of a prototype of the framework is shared, which can be used and improved by interested researchers. Finally, the experimental results demonstrate that RL agents learn optimal DDoS mitigation policies in different scenarios and that they quickly adapt to new conditions that vary in short periods of time.

Toward Joining DDoS Mitigation and Image Segmentation

Toward Joining DDoS Mitigation and Image Segmentation

LRDADF: An AI enabled framework for detecting low-rate DDoS attacks in cloud computing environments

DDoS attacks, also known as distributed denial-of-service attacks, pose a significant risk to networks in the cloud. The attackers aim to flood the target system with an overwhelming amount of data and requests until it becomes completely overloaded and unable to function properly. These attacks are becoming smarter and more dangerous all the time. A low-rate DDoS attack is one such strategy that makes detection difficult. At the same time, cloud infrastructure is rapidly evolving. Container-based technology makes it possible for cloud computing to use resources efficiently and scale services in a flexible way. Existing methods for detecting DDoS attacks in cloud computing are insufficient when adversaries use low-rate DDoS attacks. A method is required that can not only identify the attack but also prevent it to some extent. A Low-Rate DDoS Attack Detection Framework (LRDADF) was proposed for this purpose when adversaries use low-rate DDoS attacks. A comprehensive approach is required because low-rate DDoS attacks are difficult to detect. In addition to employing deep learning methods to detect such attacks, we proposed a mathematical model to realize a mitigation strategy. As a result, we proposed a new algorithm called the Hybrid Approach for Low-Rate DDoS Detection (HA-LRDD). The algorithm employs an AI-enabled method comprised of deep convolutional neural networks (CNN) and a deep auto encoder. We defined another algorithm called Dynamic Low-Rate DDoS Mitigation (DLDM), which mitigates the impact of an attack once it has been identified. It also ensures that the attack is defeated and that the infrastructure continues to operate. A comprehensive simulation study revealed that the proposed framework is capable of detecting and mitigating low-rate DDoS attacks to ensure an acceptable level of service in cloud computing environments.

Deep Ensemble Technique for Cyber Attack Detection in Big Data Environment

In this research work, a unique DDoS attack detection and mitigation approach is developed. At first, the input information is carried out into a detection phase, where it identifies the presence of an attack as well as the types of attack. The detection phase will include the “pre-processing, feature extraction, attack detection & attack mitigation.” The collected raw information is pre-processed. Then, the flow-based features such as “flow rate, flow byte, total forward packet, as well as total backward packet” are extracted. In addition, the sequential frequent pattern characteristics are retrieved utilizing the Apriori model. For the precise detection, an ensemble classifier is introduced by inclosing the “Neural Network (ANN), Bi-GRU, Recurrent Neural Network (RNN), and optimized Convolutional Neural Network (CNN).” The DBN, Bi-GRU, and RNN of ensemble classifiers are trained with the retrieved characteristics. The result from DBN, Bi-GRU, and RNN is subjected as an input to an optimized CNN, in which weights of CNN are optimally tuned by a novel hybrid optimization. Then, the Trust_BAIT strategy is used in the mitigation phase to remove the intruder from the network.

DNSguard: A Raspberry Pi-Based DDoS Mitigation on DNS Server in IoT Networks

IoT development has increased the likelihood of several security attacks, such as Mirai, VPNFilter, and DNS (Domain Name System) flooding attacks. The DNS is a censorious component of smart home IoT infrastructure, a soft target for adversaries to launch DNS flooding attacks and impact poor QoS. This letter proposes DNSguard, a MUD-enabled two-level DNS flooding attack mitigation framework for IoT networks. DNSguard authenticates the behavioral profiles of Manufacturer Usage Description (MUD) compliant IoT devices and monitors traffic to detect and mitigate DNS flooding attacks at the local DNS server. The solution has been implemented using online DNS traffic in Raspberry Pi, and quantified response time decreased to 67.2%.