Denial Of Service Attack Detection System Research Articles

Eye-Net: A Low-Complexity Distributed Denial of Service Attack-Detection System Based on Multilayer Perceptron

Distributed Denial of Service (DDoS) attacks disrupt service availability, leading to significant financial setbacks for individuals and businesses. This paper introduces Eye-Net, a deep learning-based system optimized for DDoS attack detection that combines feature selection, balancing methods, Multilayer Perceptron (MLP), and quantization-aware training (QAT) techniques. An Analysis of Variance (ANOVA) algorithm is initially applied to the dataset to identify the most distinctive features. Subsequently, the Synthetic Minority Oversampling Technique (SMOTE) balances the dataset by augmenting samples for under-represented classes. Two distinct MLP models are developed: one for the binary classification of flow packets as regular or DDoS traffic and another for identifying six specific DDoS attack types. We store MLP model weights at 8-bit precision by incorporating the quantization-aware training technique. This adjustment slashes memory use by a factor of four and reduces computational cost similarly, making Eye-Net suitable for Internet of Things (IoT) devices. Both models are rigorously trained and assessed using the CICDDoS2019 dataset. Test results reveal that Eye-Net excels, surpassing contemporary DDoS detection techniques in accuracy, recall, precision, and F1 Score. The multiclass model achieves an impressive accuracy of 96.47% with an error rate of 8.78%, while the binary model showcases an outstanding 99.99% accuracy, maintaining a negligible error rate of 0.02%.

Detection of DoS Attacks in Smart City Networks With Feature Distance Maps: A Statistical Approach

Smart cities are highly digitalized cities, with a high volume of data stored digitally, as well as a large number of physical objects and Internet of Things (IoT) devices. It is no surprise that security concerns increase as connected IoT devices become more prevalent. There has long been a perception that Denial of Service (DoS) attacks give rise to a notable menace to the security of smart city networks. A statistical method based on feature distance maps is suggested in this work for the identification of DoS attacks in smart city networks. This study aims to build a DoS attack detection model that has a low computational complexity and a low rate of false positives. The performance of the model is arbitrated using smart city network traffic dataset. In order to make processing easier, the features are normalized using Min-Max normalization. A subset of features suitable for attack detection can be evaluated with Pearson Correlation Coefficient. A feature distance map method is proposed for extracting correlations between features between records. Manhattan distance measures are used to generate the feature distance maps. The feature distance maps enhance the statistical analysis process. Hellinger distance measure is used to generate the normal traffic profile by calculating the degree of similarity between the feature distance map of each record and the normal traffic profile mean. On the basis of the proposed threshold, the Hellinger distance is used to evaluate whether an unknown traffic data belongs to normal or attack. Compared with Mahalanobis distance-based DoS detection, the Hellinger distance-based attack detection takes less time to execute. Based on the theoretical and experimental results, the proposed DoS attack detection system has a low computational complexity and a low false positive rate. Furthermore, the proposed approach outperforms the existing state-of-the-art feature ranking based DoS attack detection systems.

An efficient metaheuristic algorithm based feature selection and recurrent neural network for DoS attack detection in cloud computing environment

Detection of Denial of Service (DoS) attack is one of the most critical issues in cloud computing. The attack detection framework is very complex due to the nonlinear thought of interruption activities, unusual conduct of systems traffic, and many attributes in the issue space. This paper proposes an efficient DoS attack detection system that uses the Oppositional Crow Search Algorithm (OCSA), which integrates the Crow Search Algorithm (CSA) and Opposition Based Learning (OBL) method to address such type of issues. The proposed system consists of two stages viz. selection of features using OCSA and classification using Recurrent Neural Network (RNN) classifier. The essential features are selected using the OCSA algorithm and then given to RNN classifier. In the subsequent testing process, incoming data is classified using the RNN classifier. It ensures the separation of standard data (saved in cloud) and the removal of compromised data Using the benchmark data set, the results of experimental evaluation demonstrate that the proposed technique outperforms the other conventional methods by 98.18%, 95.13%, 93.56%, and 94.12% in terms of Precision, Recall, F-Measure, and Accuracy respectively. Further, the proposed work outperforms existing works by 3% on an average for all the metrics used.

Deep Radial Intelligence with Cumulative Incarnation approach for detecting Denial of Service attacks

Nowadays Denial of Service (DoS) attack is one of the security threats that make the online services unavailable for legitimate users. Therefore, a DoS attack detection system is needed to protect online services against malicious activities. Machine learning approaches are widely used to detect cyber-attacks. The lacunae in the existing machine learning based attack detection systems are more learning time due to vanishing gradient and getting stuck in the local minima due to selection of random weights. In this paper, these issues have been addressed and Deep Radial Intelligence (DeeRaI) with Cumulative Incarnation (CuI) approach is proposed to detect the DoS attacks. The proposed DeeRaI approach learns the intelligence extracted from the radial basis function with different levels of abstraction. The proposed CuI optimizes the weights of the DeeRaI network in which the knowledge gained is progressed to the next generation. Experiments were conducted on benchmark datasets and the proposed approach is compared with existing classifiers and state-of-the-art attack detection systems. It is seen from the performance evaluation that the proposed approach gives promising results than the other existing approaches. Further, it is evident that the proposed approach converges faster and provides best weights compared to the existing optimization methods.

Detection of Denial-of-Service Attacks Based on Computer Vision Techniques

Detection of Denial-of-Service (DoS) attacks has attracted researchers since 1990s. A variety of detection systems has been proposed to achieve this task. Unlike the existing approaches based on machine learning and statistical analysis, the proposed system treats traffic records as images and detection of DoS attacks as a computer vision problem. A multivariate correlation analysis approach is introduced to accurately depict network traffic records and to convert the records into their respective images. The images of network traffic records are used as the observed objects of our proposed DoS attack detection system, which is developed based on a widely used dissimilarity measure, namely Earth Mover's Distance (EMD). EMD takes cross-bin matching into account and provides a more accurate evaluation on the dissimilarity between distributions than some other well-known dissimilarity measures, such as Minkowski-form distance L <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</sub> and X <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> statistics. These unique merits facilitate our proposed system with effective detection capabilities. To evaluate the proposed EMD-based detection system, ten-fold cross-validations are conducted using KDD Cup 99 dataset and ISCX 2012 IDS Evaluation dataset. The results presented in the system evaluation section illustrate that our detection system can detect unknown DoS attacks and achieves 99.95 percent detection accuracy on KDD Cup 99 dataset and 90.12 percent detection accuracy on ISCX 2012 IDS evaluation dataset with processing capability of approximately 59,000 traffic records per second.

A Combined Approach to DoS Attack Detection System

In the network system attack like Denial of service (DoS) is forthcoming damaging attack. The performance of online servers degrades within seconds. Intensive computation on the target server is imposed due to this attack. Target Server gets flooded with large useless packets. The fatality server can be forced out of service From a few minutes to even several days. Eventually crucial business services running on the target fatality causes work down on the target fatality. So for the researchers it is very challenging task. The development of network-based detection mechanisms is the focus of the solution of this kind of attack. Based on these mechanisms in the existing detection systems, traffic transmitted over the protected networks get monitored. Mainly two methods are introduced for detection mechanism namely Misuse based and Anomaly based detection systems. But to enhance the detection rate they are not sufficient. In the proposed system the features which are directly associated with DoS attacks are extract by monitoring the network traffic. To generate geometrical triangular area measurements for normal profiles on the basis of these features the multivariate correlation analysis (MCA) model is used. To detect any unknown DoS attack in the network, these models are used as references. And furthermore to detect attack anomaly detection method is used. Only MCA and anomaly based system is not sufficient for accurate attack detection. So the inventive work behavioral based rule model integrated with MCA and anomaly, as a hybrid model used to enhance the accuracy of DoS attack detection. In proposed inventive model behavioral rules are generated for suspected packets and ultimately detection accuracy as well as detection rate get increased.

A System for Denial-of-Service AttackDetection Based on Multivariate CorrelationAnalysis

Interconnected systems, such as Web servers, database servers, cloud computing servers etc., are now under threads from network attackers. As one of most common and aggressive means, Denial-of Service (DoS) attacks cause serious impact on thesecomputing systems. In this paper, we present a DoS attack detection system that uses Multivariate Correlation Analysis (MCA) for accurate network traffic characterization by extracting the geometrical correlations between network traffic features. Our MCA-based DoS attack detection system employs the principle of anomaly-based detection in attack recognition. This makes our solution capableof detecting known and unknown DoS attacks effectively by learning the patterns of legitimate network traffic only. Furthermore, a triangle-area-based technique is proposed to enhance and to speed up the process of MCA. The effectiveness of our proposed detection system is evaluated using KDD Cup 99 dataset, and the influences of both non normalized data and normalized data on the performance of the proposed detection system are examined. The results show that our system outperforms two other previously developed state-of-the-art approaches in terms of detection accuracy.

English

The reliability and availability of network services are being threatened by the growing number of Denial-of-Service (DoS) attacks. Effective mechanisms for DoS attack detection are demanded. Therefore, present a DoS attack detection system that uses Multivariate Correlation Analysis (MCA) for accurate network traffic characterization by extracting the geometrical correlations between network traffic features. the application of Multivariate Correlation Analysis(MCA) where SVM(Support Vector Machine) is used to Train the data & it classify the data/attack. Clustering is use for the alert aggregation process. Denial-of-Service Attack Detection Based on Multivariate Correlation Analysis is a generative modelling approach using probabilistic methods.MCA-based DoS attack detection system employs the principle of anomaly detection and misuse based detection in attack recognition. This makes, solution capable of detecting known and unknown DoS attacks effectively by learning the patterns of legitimate network traffic only & also detecting various types of viruses. this system also checking for conditional privileges like packet level intruder, process level intruder etc.Furthermore, The effectiveness of propose detection system is evaluated using KDD Cup dataset

A System for Denial-of-Service Attack Detection Based on Multivariate Correlation Analysis

Interconnected systems, such as Web servers, database servers, cloud computing servers and so on, are now under threads from network attackers. As one of most common and aggressive means, denial-of-service (DoS) attacks cause serious impact on these computing systems. In this paper, we present a DoS attack detection system that uses multivariate correlation analysis (MCA) for accurate network traffic characterization by extracting the geometrical correlations between network traffic features. Our MCA-based DoS attack detection system employs the principle of anomaly based detection in attack recognition. This makes our solution capable of detecting known and unknown DoS attacks effectively by learning the patterns of legitimate network traffic only. Furthermore, a triangle-area-based technique is proposed to enhance and to speed up the process of MCA. The effectiveness of our proposed detection system is evaluated using KDD Cup 99 data set, and the influences of both non-normalized data and normalized data on the performance of the proposed detection system are examined. The results show that our system outperforms two other previously developed state-of-the-art approaches in terms of detection accuracy.