DDoS Attack Detection Research Articles

DDoS attack detection in IoT environment using optimized Elman recurrent neural networks based on chaotic bacterial colony optimization

DDoS attack detection in IoT environment using optimized Elman recurrent neural networks based on chaotic bacterial colony optimization

Semi-Supervised Machine Learning Approaches for DDOS Attack Detection

Network infrastructures are the target of several attacks. These include intrusions into the confidentiality, integrity, and availability of the network. The network's availability is impacted by a persistent attack known as a distributed denial-of-service (DDoS) attack. Such an assault is carried out using a command and control (C & C) technique. To detect these assaults, numerous researchers have put forth various machine learning-based solutions. In this paper, we are going to detect different DDoS attacks by various methods and evaluate their performance. This experiment made use of the KD99 dataset. The normal and assault samples were classified using the random forest technique. The classification of 99.76% of the samples was accurate. By strategically selecting clusters and incorporating the insights gained from the small labelled dataset, a portion of the unlabelled clusters can be assigned labels, effectively converting raw data into useful training examples. This enriched dataset is then used to train an improved classifier that can better generalize and adapt to the dynamic nature of DDoS attacks.

FLAD: Adaptive Federated Learning for DDoS attack detection

Federated Learning (FL) has been recently receiving increasing consideration from the cybersecurity community as a way to collaboratively train deep learning models with distributed profiles of cyber threats, with no disclosure of training data. Nevertheless, the adoption of FL in cybersecurity is still in its infancy, and a range of practical aspects have not been properly addressed yet. Indeed, the Federated Averaging algorithm at the core of the FL concept requires the availability of test data to control the FL process. Although this might be feasible in some domains, test network traffic of newly discovered attacks cannot be always shared without disclosing sensitive information. In this paper, we address the convergence of the FL process in dynamic cybersecurity scenarios, where the trained model must be frequently updated with new recent attack profiles to empower all members of the federation with the latest detection features. To this aim, we propose FLAD (adaptive Federated Learning Approach to DDoS attack detection), an FL solution for cybersecurity applications based on an adaptive mechanism that orchestrates the FL process by dynamically assigning more computation to those members whose attacks profiles are harder to learn, without the need of sharing any test data to monitor the performance of the trained model. Using a recent dataset of DDoS attacks, we demonstrate that FLAD outperforms state-of-the-art FL algorithms in terms of convergence time and accuracy across a range of unbalanced datasets of heterogeneous DDoS attacks. We also show the robustness of our approach in a realistic scenario, where we retrain the deep learning model multiple times to introduce the profiles of new attacks on a pre-trained model.

DDoS Attack Detection using Back Propagation Neural Network Optimized by Bacterial Colony Optimization

DDoS Attack Detection using Back Propagation Neural Network Optimized by Bacterial Colony Optimization

DDoS Attack Detection in SDN using ML Techniques

Abstract: The increasing prevalence of DDoS attacks poses a serious threat to modern network infrastructures. SDN has been proposed as a promising solution for enhancing network security. However, detecting and mitigating DDoS attack in software definednetwork remains a challenging task. In this research paper, suggest an innovative approach in order to identify DDoS assaults in software-defined networks using (ML) techniques. Ourmethod entails gathering and analyzing network data. Traffic data using SDN controllers. We use variety of ML techniques analyze the traffic information to discover unexpected traffic patterns that might point to the presence of a DDoS attack. Random Forest, DecisionTree, K-Means clustering are among the algorithms used. We evaluate our approach using a real-world dataset and compare it to existing DDoS detection techniques in SDN. Our results show that our approach achieves high accuracy, precision, and recall rates indetecting DDoS attacks. We also demonstrate that our technique can detect either known and unexpected DDoS assaults with low false-positive rates. Overall, our study indicates thepotency of applying machine learning methods to SDN DDoS attack detection. Our methodoffers a promising remedy for boosting network security in contemporary infrastructures.

Detection of IOT botnet attack based on machine learning

The paper discussed the process of data processing and algorithm selection for three different scenarios in order to improve accuracy in detecting DDOS attacks, SPAM emails, and malware. It provided detailed descriptions of each process involved in the simulation. For the DDOS attack detection simulation, three different datasets were used, and missing data was removed to ensure the quality of the data. In addition, features were processed to make sure they could be applied to specific algorithms. Both decision tree and random forest algorithms were selected and tuned to obtain maximum accuracy. Similarly, for the SPAM email detection simulation, binary was used to represent whether an email was spam or not, and Count Vectorizer function was applied to convert mail contents into feature vectors. The KNN and decision tree algorithms were chosen, and emphasis was given on parameter adjustment to eliminate overfitting and ensure optimal model accuracy. The paper also discussed the importance of considering multiple factors when selecting and tuning algorithms, such as accuracy, complexity, and computational efficiency. These factors must be balanced to achieve the best overall performance. Overall, the paper provided a comprehensive overview of the methods and processes involved in data processing and algorithm selection to improve detection accuracy for DDOS attacks, SPAM emails, and malware. This research can greatly benefit organizations that are looking to enhance their security measures and minimize the risks associated with these cyber threats.

FQBDDA: fuzzy Q-learning based DDoS attack detection algorithm for cloud computing environment

FQBDDA: fuzzy Q-learning based DDoS attack detection algorithm for cloud computing environment

Intrusion detection system for detecting distributed denial of service attacks using machine learning algorithms

<span>Today, the creation of more effective intrusion detection system (IDS) has become crucial due to the rise in computer malware. Ensuring the availability of the system is an important component of information security and the most important requirement of any network. Recently the machine learning algorithm (ML) has been used to improve intrusion detection over the network. It is currently necessary to release an updated version of these systems. The presented work aimed to build a reliable and accurate IDS based on ML to classify and prevent distributed denial of service attacks to protect any system working on the network from temporary or complete system failure. We presented five ML models to create the proposed distributed denial-of-services attack (DDoS)-IDS, including (decision tree, random forest, logistic regression, support vector machine, and multi-layer neural network) which were trained and evaluated using the CIC-IDS-2018 dataset. Furthermore, principal component analysis (PCA) was used to reduce the dimensionality of the dataset. According to the classification results, the proposed multi-layer neural network model reached optimal performance for detecting DDoS attacks and achieved classification accuracy at 99.9992%.</span>

A novel sensitive DDoS attacks against statistical test in network traffic fusion

AbstractDistributed denial of service (DDoS) attacks are common attacks that limit casual users from cracking critical network resources. A method to find the DDoS attack comes to light as an essential and hot research issue. Therefore, the increment in network usage scale demands more challenges to see the DDoS attack. Non‐real‐time collection of network traffic will make sincere complications inaccuracy; DDoS attack detection, and efficiency. Lately, sketch data structures play an excellent role in high‐speed networks to suppress and combine network traffic issues. However, the sketch data structure has issues rebuilding the reverse keys that behave abnormally due to the reversible hash function. To rectify the above difficulties, we include the Chinese Remainder Theorem‐based Reverse Sketching (CRTRS). However, Reverse Sketching is not good at suppressing and combining heavy network traffic, but it can easily detect abnormal keys. According to the network traffic records setup by CRTRS, we add the Modified Cumulative Sum Quality Control Scheme (MCSQCS) that encourages DDoS attack detection. The enforcement of the proposed work with DDoS attack detection has two kind of different data sets. The result of the experiments shows that it gives more accuracy and efficiency in detecting DDoS attacks. Therefore, comparing other DDoS detecting methods with the sketch data structure has fewer computational complications. Improving the anomalous keys is the most critical challenge in this proposed work. To illustrate the accuracy rate, we experiment with a new technique called CIC‐Friday Heavy network traffic fragment. We also explain the experimental results of the MAWI heavy network fragment with the various parameter setups. To compare our proposed method with other similar existing methods, we use a sketch data structure to manage the network traffic data. It also uses the MSPCA method to detect the DDoS attack. The information‐based analysis helps to see the DDoS attack. The result analysis of True Positive Value (TPV) and False Positive Value (FPV) with MSPCA techniques has 79% and .1% accuracy. Similarly, information‐based detection has an accuracy of about 90% and 5%. Hence, the proposed method gives more accuracy for the detection of DDoS attacks.

Detection of application-layer DDoS attacks using machine learning and genetic algorithms

Application-layer Distributed Denial of Service (App-DDoS) attacks continue to be a pervasive problem in cybersecurity, despite the availability of various defensive frameworks. This research addresses the challenges associated with App-DDoS detection and presents a highly effective and adaptable solution for detecting various types of App-DDoS attacks. Motivated by the critical need for improved DDoS detection, our approach achieves dual objectives by accurately detecting both known and unknown DDoS attacks while minimizing false alarms. To achieve this, we combine Random Forest (RF), Gaussian Mixture Models (GMM) and a human with expertise in DDoS to enhance the system's resilience against evolving attack patterns. Furthermore, we prioritize high-quality data curation by utilizing multiple datasets, CICIDS2017 and CICDDoS2019, and incorporating GMM to adapt effectively to varying data distributions over time. In addition, we propose a comprehensive feature selection strategy that addresses the false alarm rate and improves classifier performance by utilizing decision tree (DT) feature importance and the minimum redundancy maximum relevance (MRMR) approach. Moreover, we adopt genetic algorithms (GA) for automated hyper-parameter optimization to ensure efficient and effective DDoS detection. Quantitative analysis shows a significant reduction in false alarms to 0.12% (52 out of 45,149 samples), with the RF classifier achieving outstanding accuracy (99.9%), precision (100%), recall (99.8%), and F1 score (99.9%). Handling unknown App-DDoS attacks, our approach demonstrates remarkable performance across all datasets.

DL-2P-DDoSADF: Deep learning-based two-phase DDoS attack detection framework

In today’s tech-driven world, while Internet-based applications drive social progress, their architectural weaknesses, inadequate security measures, lack of network segmentation, unsecured IoT devices etc., offer ample opportunities for attackers to launch a multitude of attacks on their services. Despite numerous security solutions, the frequent changes in the methods employed by attackers present a challenge for security systems to stay up to date. Moreover, the existing machine learning approaches are confined to known attack patterns and necessitate annotated data. This paper proposes a deep learning-based two-phase DDoS attack detection framework named DL-2P-DDoSADF. The proposed framework has been validated using the CICDDoS2019 and DDoS-AT-2022 datasets. In the first phase, Autoencoder (AE) has been trained using the legitimate traffic and threshold value has been set using Reconstruction Error (RE). The test data comprising legitimate and attack traffic has been used to validate the proposed approach efficacy. The initial phase entails utilizing a trained AE model to enable the passage of predicted legitimate traffic through the network. In contrast, the predicted attack traffic proceeds to the second phase to classify the type of attack it represents. The performance and efficacy of various deep learning approaches: Deep Neural Network (DNN), Long Short-Term Memory (LSTM) and Gated Recurrent Units (GRU) are compared as part of the second phase. The autoencoder displayed an accuracy level of 99% in detecting both datasets in the initial phase. It has been observed that the DNN produced an overall accuracy of 97% and 96% for the CICDDoS2019 and DDoS-AT-2022 datasets, respectively, for multiclass classification. The DNN model performed better than LSTM and GRU models in the second phase.

Ensemble of deep reinforcement learning with optimization model for DDoS attack detection and classification in cloud based software defined networks

Ensemble of deep reinforcement learning with optimization model for DDoS attack detection and classification in cloud based software defined networks

Machine learning assisted snort and zeek in detecting DDoS attacks in software-defined networking

Machine learning assisted snort and zeek in detecting DDoS attacks in software-defined networking

An Assessment of Ensemble Voting Approaches, Random Forest, and Decision Tree Techniques in Detecting Distributed Denial of Service (DDoS) Attacks

The contemporary and escalating dependence on digital technologies has rendered networks and systems more susceptible to cyber assaults. Among the dominant and detrimental forms of such attacks lies the Distributed Denial-of-Service (DDoS) assault, a menace capable of inflicting substantial financial repercussions and tarnishing one’s reputation. To combat this predicament, implementing machine learning (ML) algorithms has gained widespread acceptance, facilitating the identification and mitigation of DDoS attacks. Within this study, a novel security mechanism has been proposed to preclude DDoS assaults. Employing an ensemble learning approach, the objective is to differentiate between conventional network traffic and the pernicious influx of DDoS attack traffic. Moreover, the study assesses and compares the efficacy of two prominent ML algorithms, namely the decision tree and random forest, in detecting DDoS attacks. We evaluate the models using a publicly available dataset named ”TIME SERIES DATASET FOR DDOS ATTACK DETECTION.” We compare the performance of the models using various evaluation metrics, including accuracy, precision, recall, training time (sec), and the F1 score. The model development process consists of data collection, pre-processing, splitting into training and testing sets, selecting prediction models, and evaluating their performance. Evaluated on a dataset of 11,423 instances, the proposed approach demonstrated promising results, with accuracy ranging from 92% to 100% for the time series dataset. In conclusion, the proposed approach effectively detects and mitigates DDoS attacks, offering a reliable solution to protect communication systems against this growing cybersecurity threat.

A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques

The study in this paper characterizes lightweight IoT networks as being established by devices with few computer resources, such as reduced battery life, processing power, memory, and, more critically, minimal security and protection, which are easily vulnerable to DDoS attacks and propagating malware. A DDoS attack detection model is crucial for attacks in various industries, ensuring the availability and reliability of their networks and systems. The model distinguishes between legitimate and malicious traffic by analyzing network traffic patterns and identifying anomalies. This safeguards critical infrastructure, preserves business continuity, and protects the user experience, minimizing the impact of DDoS attacks. Numerous scholars have studied the notion that protecting lightweight IoT networks essentially requires improving intrusion detection systems. This research is valuable, as it follows a tailored pre-processing methodology specific to IoT network challenges, addressing a pressing need in cybersecurity by focusing on a growing concern related to IoT devices and DDoS attacks, enhancing the security of essential network systems in various industries by effectively detecting DDoS attacks, and developing a lightweight intrusion detection system that aligns with the limited resources of IoT devices. This manuscript proposes a compact and lightweight intrusion detection system that blends machine learning classifiers with a fresh approach to data pre-processing. The handling of missing values, data standardization using Standard Scalar, feature selection using ExtraTreeClassifier wherein only the 15 best features are extracted, and anomaly detection using a classifier are performed. The network dataset of TON-IOT and BOT-IOT datasets is used for experiments, specifically binary classifications and multiple-class classification for the experiment with DDoS and all attacks, respectively. There is an imbalance between the TON-IOT and BOT-IOT attack classes. In trials using the TON-IOT and BOT-IOT datasets, the classes were balanced using several iterations of the SMOTE approach. This research provides a number of classifier types, namely logistic regression, random forest, naïve bayes, artificial neural network, and k nearest neighbor algorithms, which are used to build a lightweight intrusion detection system that is ideally suited for protecting against DDoS attacks in IoT networks. The time taken to train and predict the DDoS attacks is also implemented. Random forest performed well under TON-IOT and naïve bayes performed well under BOT-IOT under binary and multiple-class classification, achieving an accuracy of 100% with less training and prediction time.

A Cooperative Detection of DDoS attacks based on CNN-BiLSTM in SDN

In response to the challenges posed by the high overhead and low detection efficiency of traditional SDN, a novel approach has been proposed to detect DDoS attacks. This cooperative method leverages information entropy and deep learning techniques to divide the detection task between the data plane and control plane. An advanced CNN-BiLSTM model with batch normalization and attention mechanism is utilized to identify DDoS attack traffic. The results of experiments demonstrate that this method offers superior accuracy, detection rate, and false alarm rate compared to prior approaches. Moreover, the switch-controller collaborative detection method proposed in this research reduces the occupancy rate of CPU, in contrast to the conventional single point detection method.

Hybrid Deep Learning Approach Utilizing RNN and LSTM for the Detection of DDoS Attacks Within the Bitcoin Ecosystem

Hybrid Deep Learning Approach Utilizing RNN and LSTM for the Detection of DDoS Attacks Within the Bitcoin Ecosystem

Proactive DDoS attack detection in software-defined networks with Snort rule-based algorithms

Proactive DDoS attack detection in software-defined networks with Snort rule-based algorithms

DDoS attack detection in smart home applications

AbstractIn smart applications, edge nodes are deployed to perform faster computations. Due to the limited computational capability of edge nodes, collaborative computing is used in which multiple edge nodes collaborate for request processing. For faster processing, these edge nodes are used in many applications namely, smart homes, smart farming, healthcare and so forth. In this paper, we have discussed the use of edge nodes in smart home applications. The smart home application contains different types of sensors and these sensors generate various types of data. Edge nodes are used in these applications for the immediate processing of data. A data classifier is used to classify the data and to reduce delay in data processing. However, the data classifier is more susceptible to DDoS attacks. Hence, an efficient attack detection mechanism is required to detect DDoS attacks. We have used a Feature Selection SVM (FSSVM) algorithm to select optimal parameters for attack recognition. In this algorithm, the information gain ratio is used for optimal parameter selection, and SVM is used for classification. The FSSVM algorithm has been compared with KPCA‐SVM, SVM, and Naive Bayes. Simulation results show that the FSSVM algorithm provides better accuracy compared to KPCA‐SVM, SVM, and Naive Bayes algorithms.

Comparative Study of AI-Enabled DDoS Detection Technologies in SDN

Software-defined networking (SDN) is becoming the standard for the management of networks due to its scalability and flexibility to program the network. SDN provides many advantages but it also involves some specific security problems; for example, the controller can be taken down using cyber attacks, which can result in the whole network shutting down, creating a single point of failure. In this paper, DDoS attacks in SDN are detected using AI-enabled machine and deep learning models with some specific features for a dataset under normal DDoS traffic. In our approach, the initial dataset is collected from 84 features on Kaggle and then the 20 top features are selected using a permutation importance algorithm. The dataset is learned and tested with five AI-enabled models. Our experimental results show that the use of a machine learning-based random forest model achieves the highest accuracy rate of 99.97% in DDoS attack detection in SDN. Our contributions through this study are, firstly, that we found the top 20 features that contributed to DDoS attacks. Secondly, we reduce the time and cost of comparing various learning models and their performance in determining a learning model suitable for DDoS detection. Finally, various experimental methods to evaluate the performance of the learning model are presented so that related researchers can utilize them.