Denial Of Service Research Articles

Design and analysis of H∞$$ {H}_{\infty } $$ control strategies with dynamic event‐triggered schemes and quantizer in the presence of hybrid attacks

AbstractThis study explores the resilience of networked control systems (NCSs) against hybrid attacks, focusing on enhancing their performance. To mitigate excessive data transmission, the article introduces dynamic event‐triggered schemes and quantizer within the sensor‐to‐observer communication channel. The network environment is susceptible to various attacks, including denial‐of‐service (DoS) attacks and deception attacks. An augmented system model is formulated, and through the application of Lyapunov stability theory, conditions for ensuring the asymptotic stability of the system are established. The collaborative design of quantizer parameters, controller gain, and event‐triggered thresholds is achieved by solving linear matrix inequalities. Simulation‐based theoretical models have effectively demonstrated the reduction of the impact of network intrusions on NCSs, validating the proposed approach.

DFA-mode-dependent stability of impulsive switched memristive neural networks under channel-covert aperiodic asynchronous attacks

This article is concerned with the deterministic finite automaton-mode-dependent (DFAMD) exponential stability problem of impulsive switched memristive neural networks (SMNNs) with aperiodic asynchronous attacks and the network covert channel. First, unlike the existing literature on SMNNs, this article focuses on DFA to drive mode switching, which facilitates precise system behavior modeling based on deterministic rules and input characters. To eliminate the periodicity and consistency constraints of traditional attacks, this article presents the multichannel aperiodic asynchronous denial-of-service (DoS) attacks, allowing for the diversity of attack sequences. Meanwhile, the network covert channel with a security layer is exploited and its dynamic adjustment is realized jointly through the dynamic weighted try-once-discard (DWTOD) protocol and selector, which can reduce network congestion, improve data security, and enhance system defense capability. In addition, this article proposes a novel mode-dependent hybrid controller composed of output feedback control and mode-dependent impulsive control, with the goal of increasing system flexibility and efficiency. Inspired by the semi-tensor product (STP) technique, Lyapunov–Krasovskii functions, and inequality technology, the novel exponential stability conditions are derived. Finally, a numerical simulation is provided to illustrate the effectiveness of the developed approach.

Comprehensive Performance Evaluation of Machine Learning Algorithms for detecting DDoS attacks in SDN

<div align="center">Software-Defined Networking (SDN) revolutionizes networking by separating control logic and data forwarding, enhancing security against threats like Distributed Denial of Service (DDoS) attacks. These attacks flood control plane bandwidth, causing SDN network failures. Recent studies emphasize the efficacy of machine learning and statistical approaches in identifying and mitigating these security risks. However, there has been a lack of focus on employing ensembling techniques, amalgamating diverse machine learning models, selecting pertinent features, and utilizing oversampling techniques to balance categorical data. Our study evaluates 20 machine-learning models, emphasizing feature engineering and addressing class imbalance using Synthetic Minority Oversampling TEchnique (SMOTE). The results indicate that Ensemble methods such as LGBM Classifier, Random Forest Classifier, XGB Classifier, Decision Tree Classifier attained near-perfect scores (almost 100%) across all metrics, suggesting potential overfitting. Conversely, models like AdaBoost Classifier, K-Neighbors Classifier, and SVC exhibited slightly lower (99%) but realistic performance, underscoring the intricacy of accurate prediction in cybersecurity. Simpler models, including Logistic Regression, Linear Discriminant Analysis, and Gaussian Naive Bayes, demonstrated moderate to low accuracy, approximately around 70%. These findings stress the imperative need for a nuanced approach in the selection and fine-tuning of machine learning models to ensure effective DDoS detection in SDN environments.</div>

An Extensive Analysis of Current Software Defined Network Optimization Techniques

In the modern, technologically advanced era, the use of devices connected to the Internet has increased exponentially. This has led to a significant increase in Internet activity. Network scalability, low levels of service, and the need to manage a large number of clients on a single server (which can lead to denial of service (DOS) attacks) are just a few of the consequences of increased traffic if you are a load balancer, . A method proposed in the literature. Although load balancers are popular, studies have shown that they have a few drawbacks, such as not being programmable and exclusive to a single vendor to overcome these issues and the subsequent increase in Internet traffic saw the emergence of Software Defined Networking (SDN) as a paradigm shift. Software defined networking (SDN) enables programmable load balancers and gives customers the freedom to develop and implement their own load-balancing algorithms this exam covers the origins of software-defined networking (SDN) and Open Flow, with impact on weight and density so included. In this article, we will go through various SDN load balancing techniques. This review builds on existing research challenges, their answers, and possible future research directions. Load balancing in intelligent software-defined (SDN) algorithms is typically performed using mathematical tools. Finally, we detail the metrics used to evaluate the performance of the algorithms.

An Empirical Analysis of DDoS Attack Detection and Mitigation Techniques: A Comparative Review of Tools and Methods

The availability and integrity of online services and networks are seriously threatened by distributed denial of service (DDoS) assaults. As a result, a plethora of detection and mitigation strategies have been created, all utilizing different instruments and approaches. By comparing various tools and approaches, this study provides an empirical examination of DDoS attack detection and mitigation strategies. We carefully assess the performance of top DDoS detection and mitigation solutions against a range of attack vectors and in diverse network contexts, taking into account their efficacy, efficiency, and accuracy. We examine the benefits, drawbacks, and real-world applications of both open-source and proprietary technologies for network defenders. Additionally, we look at how these tools and techniques adapt to changing threats and talk about new trends and difficulties in the DDoS assault arena. For network security practitioners, researchers, and policymakers looking for an understanding of the state of DDoS defence mechanisms and tactics for strengthening resilience against these disruptive cyber threats, this comparative assessment is an invaluable resource.

SDN-Driven Security Framework for DDOS Attack Detection and Mitigation

The rising complexity and persistence of Distributed Denial of Service (DDoS) attacks, particularly low-rate variants, present significant challenges in detection and mitigation within Software-Defined Networking (SDN) environments. Existing detection systems often flood networks with alerts, burdening security personnel and delaying timely mitigation. Furthermore, many solutions are designed and tested in simulated conditions, limiting their real-world applicability. To address these challenges, we propose an SDN-based security framework enhanced with automated monitoring, detection, and mitigation capabilities, optimized for slow-rate DDoS attacks. Our framework was rigorously evaluated on a physical testbed, achieving mitigation efficiencies between 91.66% and 100% under varied attack conditions, thus proving its robustness in practical settings. Additionally, we introduce the SDN-SlowRate-DDoS dataset, designed to assist researchers and industry professionals in developing and testing intrusion detection solutions in more realistic scenarios. To further improve DDoS defense in SDN, we incorporate an ensemble online machine learning model that dynamically adapts to evolving attack patterns, enhancing accuracy across attack types and outperforming traditional models with a detection rate of 99.2% on benchmark datasets. This dual approach leverages both real-world testing and adaptive machine learning, advancing proactive DDoS threat management in SDN environments

Lightweight Machine Learning-Based DOS Attack Detection in Wireless Sensor Networks Using Decision Tree and Information Gain

Abstract—Wireless Sensor Networks (WSNs) are rapidly expanding across various domains due to their unique characteristics and performance capabilities. However, these networks are highly vulnerable to a range of security threats, particularly Denial-of-Service (DoS) attacks, which are among the most common in WSNs. This paper explores the vulnerabilities of WSNs, focusing on DoS threats, and reviews current techniques for their detection. It introduces a lightweight machine learning-based approach using a decision tree (DT) algorithm with the Information Gain (IG) feature selection method for efficient DoS detection. Tested on an enhanced WSN-DS dataset, the proposed method demonstrated high accuracy and minimal processing time compared to other classifiers, such as XGBoost, and RF. This efficiency makes the proposed method well-suited for real- time DoS attack detection in resource-constrained WSNs. Keywords—Machine Learning,Decision Tree (DT),Information Gain (IG),DoS attack detection

Web Application Firewall for Detecting and Mitigation of Based DDoS Attacks Using Machine Learning and Blockchain

Applications have rapidly transformed the data access, business operations, and communication methods. This sudden shift has resulted in significant security challenges such as Distributed Denial of Service (DDoS) attacks, which intensify Internet security issues. This paper introduces a novel approach to enhancing the Web Application Firewall (WAF) for detecting and mitigating botnet-based DDoS attacks through the use of Machine Learning (ML) and blockchain technologies. Legacy security systems often struggle to adapt to evolving digital threats, particularly with the rise of complex botnet designs. The integration of ML and blockchain within the WAF ecosystem represents a substantial advancement in cyber defense mechanisms. Insights are provided into the development of advanced ML algorithms for precise anomaly detection and the formulation of efficient blockchain protocols for streamlined threat intelligence sharing. The proposed approach addresses current challenges associated with botnet-driven DDoS attacks establishes a foundation for adaptive, future-proof cybersecurity strategies.

A Distributed RF Threat Sensing Architecture

The scope of this work is to propose a distributed RF sensing architecture that interconnects and utilizes a cyber security operations center (SOC) to support long-term RF threat monitoring, alerting, and further centralized processing. For the purpose of this work, RF threats refer mainly to RF jamming, since this can jeopardize multiple wireless systems, either directly as a Denial of Service (DoS) attack, or as a means to force a cellular or WiFi wireless client to connect to a malicious system. Furthermore, the possibility of the suggested architecture to monitor signals from malicious drones in short distances is also examined. The work proposes, develops, and examines the performance of RF sensing sensors that can monitor any frequency band within the range of 1 MHz to 8 GHz, through selective band pass RF filtering, and subsequently these sensors are connected to a remote SOC. The proposed sensors incorporate an automatic calibration and time-depended environment RF profiling algorithm and procedure for optimizing RF jamming detection in a dense RF spectrum, occupied by heterogeneous RF technologies, thus minimizing false-positive alerts. The overall architecture supports TCP/IP interconnections of multiple RF jamming detection sensors through an efficient MQTT protocol, allowing the collaborative operation of sensors that are distributed in different areas of interest, depending on the scenario of interest, offering holistic monitoring by the centralized SOC. The incorporation of the centralized SOC in the overall architecture allows also the centralized application of machine learning algorithms on all the received data.

REHAS: Robust and Efficient Hyperelliptic Curve‐Based Authentication Scheme for Internet of Drones

ABSTRACTInternet of Drones (IoD) is one of the most beneficial and has many versatile applications like Surveillance and Security, Delivery and Logistics, Environmental Monitoring, Agriculture, and so forth. The IoD network is crucial for collecting sensitive data like geo‐coordinates, vehicle traffic data, and property details while surveying the various deployment locations in smart cities. The communication between users and drones can be compromised over insecure wireless channels by multiple attacks such as Man‐in‐the‐middle‐attack, Denial of Service, and so forth. Many schemes have already been propounded in the field of IoD. Still, many of them cannot address the resource constraints problem of drones, and existing protocols have higher computation and communication costs. Therefore, this paper has proposed a robust and efficient Hyper‐Elliptic Curve‐based authentication scheme (REHAS), which provides a session key for secure communication. Artificial Identities are generated using a hash function and random numbers. Fuzzy Extractor is used for user biometric authentication, which makes the smart device secure when lost. HECC is used with a smaller bit size of 80 bits rather than ECC of 160 bits. The security of the REHAS has been ensured using Scyther simulation. Furthermore, the resilience, safety, and robustness of REHAS are ensured by Informal security analysis. Lastly, a comparative study of the REHAS has been performed with other related Authentication and key agreement (AKA) protocols regarding communication cost, Computation cost, and security features, demonstrating that REHAS incurred less computation cost (6.7171 ms), communication overhead (1696 bits), and energy consumption (22.5 mJ) than other existing AKA schemes.

Privacy protection-based resilient secondary control for DC microgrids under DoS attacks

In this paper, we investigate the privacy protection-based resilient secondary control problem for an isolated DC microgrid (MG) under denial-of-service (DoS) attacks. To solve the problem, a resilient privacy protection control method is proposed by introducing random noises and the state decomposition strategy. Specifically, the initial secondary control signal of each distributed generator (DG) includes two parts: one is utilized for neighbor communication and compensating for the voltage deviation caused by the droop control, while the other influences the evolution of the first part and remains undetected to the neighbors. Besides, to ensure that the true value of the transmitted current remains obscured, random noises are injected in the first part. Based on the developed privacy protection mechanism, a distributed resilient controller is designed to guarantee the deviations in current and voltage are effectively regulated within the permissible range under DoS attacks, while simultaneously safeguarding the privacy datas. Ultimately, the efficiency of our proposed method is proved through real-time experiments conducted in OPAL-RT 4510.

Advanced security framework for low Earth orbit satellites in space information network

Recently, low Earth orbit (LEO) satellites have emerged as key players in space information network (SIN) due to their ability to provide global coverage. However, they remain susceptible to threats such as denial of service (DoS), man-in-the-middle (MITM), and spoofing attacks. In this paper, we propose a cross-layer security framework (CLSF) to address these vulnerabilities. Our approach begins by employing a physically unclonable function (PUF) at the upper layer to establish mutual authentication between legitimate satellites and ground stations, while also securely exchanging frequency seeds for the next phase. Following this, dynamic seed frequency hopping (DSFH) is applied at the physical layer to counter DoS, MITM, and spoofing attacks. Additionally, the frequency transitions of malicious satellites are modeled using a Markov chain. Our results demonstrate that the proposed CLSF, which integrates PUF and DSFH, delivers strong security performance.

“Sometimes you have knowledge but lack the equipment to save a life”: perspectives on health system barriers to post-abortion care in Liberia and Sierra Leone

BackgroundAbortion is largely restricted in Liberia and Sierra Leone, with exceptions under limited conditions. Consequently, women and girls seeking induced abortion care in these settings resort to unsafe methods, resulting in severe complications. Post-abortion care (PAC) is a lifesaving obstetric intervention to address abortion-related complications, but access to quality and comprehensive PAC in health facilities is daunting. Research on barriers to PAC, drawing on perspectives from diverse stakeholders, is critical to inform specific programmatic improvements to enhance access to quality PAC services.ObjectivesThis study explored stakeholders’ perspectives on the barriers to quality PAC across health facilities in Liberia and Sierra Leone.MethodsThis cross-sectional qualitative study targeted PAC providers in selected health facilities and policy actors in Liberia and Sierra Leone. We conducted in-depth interviews with 33 healthcare providers – 8 in Liberia and 25 in Sierra Leone; and 13 policy actors – 8 in Liberia and 5 in Sierra Leone. The policy actors included representatives from religious institutions, ministries of health, civil society organizations, and non-government organizations working on sexual and reproductive health (SRH) issues. Audio files of the interviews were transcribed verbatim in the original language of the interview and translated into English by expert translators. A deductive and inductive approach was used to develop a codebook to code the interviews in Dedoose software. Data analysis was conducted using the thematic approach.FindingsDiverse viewpoints of what constitutes quality PAC existed among stakeholders in Sierra Leone and Liberia, and these variations are reflected in their practices and behavior around PAC services. Our analysis revealed some weaknesses and gaps in PAC delivery, including a lack of trained providers, which was more pronounced in Sierra Leone than in Liberia. In both countries, the absence of functional PAC equipment, inadequate PAC supplies, and infrastructure-related challenges (e.g., lack of rooms with audio-visual privacy during PAC service) were commonly cited. Limited audio-visual privacy complicated provider-patient interactions, with providers mentioning that this makes patients withhold vital information during history-taking. Providers had no or limited knowledge of the law, and best practices around PAC, leading to delays, denial of services, overcharging fees, and stigmatization of some patients.ConclusionDespite existing policies and interventions on post-abortion, many health facilities in Liberia and Sierra Leone lack essential post-abortion care equipment and supplies and trained providers. There is a need to recruit and train willing providers, along with a clear referral system. Further, sensitizing health providers, stakeholders, and communities on abortion-related policies, guidelines, and value clarification could help improve post-abortion care service provision and uptake.

Ultimately bounded control for nonlinear systems under denial-of-service attacks: an accumulation-based event-triggered mechanism

This paper investigates the control problem for nonlinear systems under denial-of-service (DoS) attacks. In contrast to traditional event-triggered mechanisms (ETMs), an accumulation-based ETM, which is robust to abrupt signals, is employed to schedule the signal transmission between sensors and controllers, thereby saving more communication resources. Due to the openness of network-based transmission, DoS attacks are encountered during data transmissions, where the DoS attacks considered in this paper follow the Bernoulli distribution. This paper aims to design a controller for nonlinear systems considering the impact of DoS attacks and accumulation-based ETMs, ensuring that the controlled system state is ultimately bounded in the mean square. Firstly, sufficient conditions are provided to guarantee that the system state can achieve the given control performance, along with an explicit expression for the ultimate bound. Then, the controller gains are obtained by solving certain linear matrix inequalities. Finally, two simulation examples are conducted to validate the effectiveness of the designed controller.

Fully distributed event-triggered secondary voltage resilient tracking control for microgrids

This paper aims to design the fully distributed event-triggered secondary voltage resilient tracking control strategy for microgrids subject to denial-of-service (DoS) attacks. The fully distributed method is employed to remove the requirement of the smallest nonzero eigenvalue of the Laplacian matrix, which is the global information. In addition, an attack compensation with the latest successful transmission state information from neighbor's as the attack compensation term is designed for both the event-triggered scheme and the controller to save communication resources and mitigate the negative effects caused by DoS attacks. Finally, the effectiveness of the designed fully distributed event-triggered resilient control method subject to DoS attacks is demonstrated via a simulation example with comparisons.

Optimizing Effectiveness and Defense of Drone Surveillance Missions via Honey Drones

This work aims to develop a surveillance mission system using unmanned aerial vehicles (UAVs) or drones when Denial-of-Service (DoS) attacks are present to disrupt normal operations for mission systems. In particular, we introduce the concept of cyber deception using honey drones (HDs) to protect the mission system from DoS attacks. HDs exhibit fake vulnerabilities and employ stronger signal strengths to lure DoS attacks, unlike the legitimate drones called mission drones (MDs) deployed for mission execution. This research formulates an optimization problem to identify an optimal set of signal strengths of HDs and MDs to best prevent the system from DoS attacks while maximizing mission performance under the resource constraints of UAVs. To solve this optimization problem, we leverage deep reinforcement learning (DRL) to achieve these multiple objectives of the mission system concerning system security and performance. Particularly, for efficient and effective parallel processing in DRL, we utilize a DRL algorithm called the Asynchronous Advantage Actor-Critic (A3C) algorithm to model attack-defense interactions. We employ a physical engine-based simulation testbed to consider realistic scenarios and demonstrate valid findings from the realistic testbed. The extensive experiments proved that our HD-based approach could achieve up to a 32% increase in mission completion, a 20% reduction in energy consumption, and a 62% decrease in attack success rates compared to existing defense strategies.

Embedding Tree-Based Intrusion Detection System in Smart Thermostats for Enhanced IoT Security.

IoT devices with limited resources, and in the absence of gateways, become vulnerable to various attacks, such as denial of service (DoS) and man-in-the-middle (MITM) attacks. Intrusion detection systems (IDS) are designed to detect and respond to these threats in IoT environments. While machine learning-based IDS have typically been deployed at the edge (gateways) or in the cloud, in the absence of gateways, the IDS must be embedded within the sensor nodes themselves. Available datasets mainly contain features extracted from network traffic at the edge (e.g., Raspberry Pi/computer) or cloud servers. We developed a unique dataset, named as Intrusion Detection in the Smart Homes (IDSH) dataset, which is based on features retrievable from microcontroller-based IoT devices. In this work, a Tree-based IDS is embedded into a smart thermostat for real-time intrusion detection. The results demonstrated that the IDS achieved an accuracy of 98.71% for binary classification with an inference time of 276 microseconds, and an accuracy of 97.51% for multi-classification with an inference time of 273 microseconds. Real-time testing showed that the smart thermostat is capable of detecting DoS and MITM attacks without relying on a gateway or cloud.

A novel optimization-driven deep learning framework for the detection of DDoS attacks

Distributed denial of service (DDoS) attack is one of the most hazardous assaults in cloud computing or networking. By depleting resources, this attack renders the services unavailable to end users and leads to significant financial and reputational damage. Hence, identifying such threats is crucial to minimize revenue loss, market share, and productivity loss and enhance the brand reputation. In this study, we implemented an effective intrusion detection system using deep learning approach. The suggested framework includes three phases: Data pre-processing, Data balancing, and Classification. First, we prepare the valid data, which is helpful for further processing. Then, we balance the given pre-processed data by Conditional generative adversarial network (CGAN), and as a result, we can minimize the bias towards the majority classes. Finally, we distinguish whether the traffic is attack or benign using a stacked sparse denoising autoencoder (SSDAE) with a firefly-black widow (FA-BW) hybrid optimization algorithm. All these experiments are validated through the CICDDoS2019 dataset and compared with well-received techniques. From these findings, we observed that the proposed strategy detects DDoS attacks significantly more accurately than other approaches. Based on our findings, this study highlights the crucial role played by advanced deep learning techniques and hybrid optimization algorithms in strengthening cybersecurity against DDoS attacks.

REVEALING ANOMALIES BY NETWORK PACKET FLOODING ON BUILT FTP AND OPENSSH SERVERS IN CONTROLLED LAB ENVIRONMENT

This scientific paper investigates the effects of network packet flooding on FTP (port 21) and SSH (port 22) protocols, aiming to reveal and document anomalies in server behavior under high-load conditions. By simulating packet flooding in a controlled lab environment, an analysis on vulnerabilities and anomalies unique to each protocol is conducted in order to the improve defensive capabilities. The results provide guidance on best practices to secure FTP and OpenSSH services against malicious traffic, such as Distributed Denial of Service (DDoS) attacks, supporting wider network security strategies.

A Detailed Inspection of Machine Learning Based Intrusion Detection Systems for Software Defined Networks

The growing use of the Internet of Things (IoT) across a vast number of sectors in our daily life noticeably exposes IoT internet-connected devices, which generate, share, and store sensitive data, to a wide range of cyber threats. Software Defined Networks (SDNs) can play a significant role in enhancing the security of IoT networks against any potential attacks. The goal of the SDN approach to network administration is to enhance network performance and monitoring. This is achieved by allowing more dynamic and programmatically efficient network configuration; hence, simplifying networks through centralized management and control. There are many difficulties for manufacturers to manage the risks associated with evolving technology as the technology itself introduces a variety of vulnerabilities and dangers. Therefore, Intrusion Detection Systems (IDSs) are an essential component for keeping tabs on suspicious behaviors. While IDSs can be implemented with more simplicity due to the centralized view of an SDN, the effectiveness of modern detection methods, which are mainly based on machine learning (ML) or deep learning (DL), is dependent on the quality of the data used in their modeling. Anomaly-based detection systems employed in SDNs have a hard time getting started due to the lack of publicly available data, especially on the data layer. The large majority of existing literature relies on data from conventional networks. This study aims to generate multiple types of Distributed Denial of Service (DDoS) and Denial of Service (DoS) attacks over the data plane (Southbound) portion of an SDN implementation. The cutting-edge virtualization technology is used to simulate a real-world environment of Docker Orchestration as a distributed system. The collected dataset contains examples of both benign and suspicious forms of attacks on the data plane of an SDN infrastructure. We also conduct an experimental evaluation of our collected dataset with well-known machine learning-based techniques and statistical measures to prove their usefulness. Both resources we build in this work (the dataset we create and the baseline models we train on it) can be useful for researchers and practitioners working on improving the security of IoT networks by using SDN technologies.