Detect Denial Of Service Attacks Research Articles

Performance evaluation of machine learning models for distributed denial of service attack detection using improved feature selection and hyper‐parameter optimization techniques

SummaryThis article gives the framework of extensive experimentation of various machine learning models to detect distributed denial of service attacks (DDoS). We use six‐tier feature ranking methods that use statistical techniques as well as machine learning based classifiers to obtain the significant features. The measurable statistical based feature selection involves Chi‐Square (Chi2), information gain (IG), merged Chi‐Square (Chi2)‐IG ranking and machine learning classifiers involve ensemble classifiers, that is, decision tree, random forest and eXtreme gradient boosting (XGBoost). Different supervised machine learning models (logistic regression, decision tree classifier, linear support vector machine, k‐nearest neighbors, Gaussian Naive Bayes, random forest classifier, XGBoost) are trained on a feature‐engineered datasets. To further our research, we use neural networks (ANN and CNN) using both feature‐selected and auto‐feature selection training setup. We check the validation and adaptability of these models with the optimal tuning of various parameters using GridSearchCV and the effectiveness of random sampling in overcoming the class imbalance problem. Based on various feature selection methods, the models are evaluated for their best performance. The experimental results show that our trained machine learning models and neural networks outperformed the ones in the state of art. The performance analysis is done based on confusion matrix scores, that is, accuracy, false alarm rate, sensitivity, specificity, false‐positive rate, F1 score, area under curve analysis and loss functions on well‐known KDD Cup 99 and UNSW‐NB15 datasets. This study is significant for furthering the research in DDoS detection with machine learning and deep neural networks.

Compare between PSO and artificial bee colony optimization algorithm in detecting DoS attacks from network traffic

Our world today relies heavily on informatics and the internet, as computers and communications networks have increased day by day. In fact, the increase is not limited to portable devices such as smartphones and tablets, but also to home appliances such as: televisions, refrigerators, and controllers. It has made them more vulnerable to electronic attacks. The denial of service (DoS) attack is one of the most common attacks that affect the provision of services and commercial sites over the internet. As a result, we decided in this paper to create a smart model that depends on the swarm algorithms to detect the attack of denial of service in internet networks, because the intelligence algorithms have flexibility, elegance and adaptation to different situations. The particle swarm algorithm and the bee colony algorithm were used to detect the packets that had been exposed to the DoS attack, and a comparison was made between the two algorithms to see which of them can accurately characterize the DoS attack.

Distributed denial of service attacks detection for software defined networks based on evolutionary decision tree model

The software defined networks (SDN) system has modern techniques in networking, it separates the forwarding plane from the control plane and works to collect control functions in a central unit (controller), and this separation process leads to many advantages, such as cost reduction and programming ability. Concurrently, because of its centralized architecture, it is prone to a variety of attacks. Distributed denial of service (DDoS) attack has a significant impact on SDN, it is characterized by its ability to consume network resources as well as its ability to turn off the entire network. The work in this study aims to improve and increase the security and robustness of SDN systems against the attack or intrusion, by using a machine learning model to detect attack traffic and classify traffic of SDN as (attack or normal), and optimization algorithm (genetic algorithm) for improving the accuracy of the classification. After preparing and preprocessing the dataset, we used the genetic algorithm (GA) to optimize the hyperparameters of the decision tree (DT) model, and the proposed evolutionary decision tree (EDT) model was used to classify traffic into normal and attack traffic. The results indicate that the suggested model achieved a high classification accuracy of 99.46.

Distributed Denial of Service Attack Detection and Prevention Model for IoT based Computing Environment using Ensemble Machine Learning Approach

Defending against Distributed Denial of Service (DDoS) in the Internet of Things (IoT) computing environment is a challenging task. DDoS attacks are type of collective attack in which attackers work together to compromise internet security and services. The resource-constrained devices used in IoT deployments have made it even easier for an attacker to break, because of the vast number of vulnerable IoT devices with significant compute power. This paper proposed an ensemble machine learning (ML) model using the bagging technique to detect and prevent DDoS attacks in the IoT computing environment. We carried out an Machine Learning experiment and evaluated our proposed model with the most recent DDoS attacks (CICDoS2019) dataset. We use seven validation metrics (classification accuracy, precision rate, recall rate, f1-score, Matthews Correlation Coefficient, false negative rate and false positive rate) to evaluate the performance of the proposed model. The results obtained in our experiment shows an improved performance with an overall maximum classification accuracy of 99.75%, precision rate of 99.99%, recall rate of 99.76%, f1-score of 99.87%, Matthews Correlation Coefficient of 0.000000214, false negative rate of 0.24% and 4.42% false positive rate.

A robust tuned classifier-based distributed denial of service attacks detection for quality of service enhancement in software-defined network

In today’s world, Software-Defined Networking (SDN) plays a significant role in the advancement of next-generation network architecture that offers vast control to the network operators. However, the control layer is vulnerable to Distributed Denial of Service (DDoS) attacks where DDoS is one of the most powerful and devastating cyber-attacks. Thus, the development of a DDoS attack detection mechanism is very essential since these kinds of attacks have a direct impact on the overall performance of the SDN. In this paper, a new robust Tuned support vector machine-based DDoS attack detection methodology has been proposed to categorize the benign traffic from DDoS attack traffic on the SDN. Primarily, the network is created with controller and OpenFlow switch and the communication can be carried out through secure channels among different benign users and also attackers. Afterward, the multi-characteristic values are extracted by the effective extraction strategy which consists of the six-tuple characteristic values matrix. Finally, the tuned classifier has been implemented with the aid of optimization algorithm for differentiating the abnormal traffic and the normal traffic. The performance results manifest that the proposed detection framework achieves a higher accuracy of 98% and precision of 99% when compared with existing classifiers.

Refined LSTM Based Intrusion Detection for Denial-of-Service Attack in Internet of Things

The Internet of Things (IoT) is a promising technology that allows numerous devices to be connected for ease of communication. The heterogeneity and ubiquity of the various connected devices, openness to devices in the network, and, importantly, the increasing number of connected smart objects (or devices) have exposed the IoT network to various security challenges and vulnerabilities which include manipulative data injection and cyberattacks such as a denial of service (DoS) attack. Any form of intrusive data injection or attacks on the IoT networks can create devastating consequences on the individual connected device or the entire network. Hence, there is a crucial need to employ modern security measures that can protect the network from various forms of attacks and other security challenges. Intrusion detection systems (IDS) and intrusion prevention systems have been identified globally as viable security solutions. Several traditional machine learning methods have been deployed as IoT IDS. However, the methods have been heavily criticized for poor performances in handling voluminous datasets, as they rely on domain expertise for feature extraction among other reasons. Thus, there is a need to devise better IDS models that can handle the IoT voluminous datasets efficiently, cater to feature extraction, and perform reasonably well in terms of overall performance. In this paper, an IDS based on redefined long short-term memory deep learning approach is proposed for detecting DoS attacks in IoT networks. The model was tested on benchmark datasets; CICIDS-2017 and NSL-KDS datasets. Three pre-processing procedures, which include encoding, dimensionality reduction, and normalization were deployed for the datasets. Using key classification metrics, experimental results obtained show that the proposed model can effectively detect DoS attacks in IoT networks as it performs better compared to other methods including models from related works.

A Security System for Detecting Denial of Service (DDoS) and Masquerade Attacks on Social Networks

This study on a security system for detecting denial of service (DDoS) and masquerade attacks on social networks specifically describes how a Convolutional Neural Network (CNN) algorithm was employed. The dataset used for this research is the CICIDS2017 dataset, which contains benign data (no attack present) and the most up-to-date, frequent attacks which resemble true, real-world data. The feature extraction method used was recursive feature elimination (RFE), which reduced 77 columns of the dataset to 10 columns. This research was motivated by the limitation of Alguliyev and Abdullayeva 2019, which focused on the prediction of DDoS attack occurrence by getting related texts in social media. It has a limited attack class that focuses solely on DDoS attacks, and it does not perform social media network prediction in general. The objective of this research is to develop a security system for detecting DDoS and masquerade attacks and evaluate the detection model on social media networks. The system was tested on Facebook and Instagram. The result of the training accuracy that we derived from this research is 99.53%, while the testing accuracy is 99.52%. The result of this research is compared with previous studies’ results. This study recommends that the model implemented can be enhanced more effectively by comparing the accuracy of alternative deep learning algorithms to that of the CNN utilized in the current prediction model.

Adaptive Learning Based Whale Optimization and Convolutional Neural Network Algorithm for Distributed Denial of Service Attack Detection in Software Defined Network Environment

SDNs (Software Defined Networks) have emerged as a game-changing network concept. It can fulfill the ever-increasing needs of future networks and is increasingly being employed in data centres and operator networks. It does, however, confront certain fundamental security concerns, such as DDoS (Distributed Denial of Service) assaults. To address the aforementioned concerns, the ALWO+CNN method, which combines ALWOs (Adaptive Learning based Whale Optimizations) with CNNs (Convolution Neural Networks), is suggested in this paper. Initially, preprocessing is performed using the KMC (K-Means Clustering) algorithm, which is used to significantly reduce noise data. The preprocessed data is then used in the feature selection process, which is carried out by ALWOs. Its purpose is to pick out important and superfluous characteristics from the dataset. It enhances DDoS classification accuracy by using the best algorithms. The selected characteristics are then used in the classification step, where CNNs are used to identify and categorize DDoS assaults efficiently. Finally, the ALWO+CNN algorithm is used to leverage the rate and asymmetry properties of the flows in order to detect suspicious flows specified by the detection trigger mechanism. The controller will next take the necessary steps to defend against DDoS assaults. The ALWO+CNN algorithm greatly improves detection accuracy and efficiency, as well as preventing DDoS assaults on SDNs. Based on the experimental results, it was determined that the suggested ALWO+CNN method outperforms current algorithms in terms of better accuracies, precisions, recalls, f-measures, and computational complexities.

Handshake Logic-Based Event-Triggered Load Frequency Control for Smart Grids Under DoS Attacks

This paper investigates the load frequency control (LFC) problem for smart grids with denial-of-service (DoS) attacks via a novel event-triggered control method. In order to sustain the stable operation of the smart grids, a handshake logic-based event-triggered communication scheme (HLETCS) is proposed. The targets of the designed controller are twofold. Firstly, an event-triggered mechanism with a handshake logic-based concept is proposed to save network resources. In this triggering method, a handshake protocol is used to detect DoS attacks in the communication networks. Secondly, through employing Lyapunov stability theory, sufficient stabilization criteria ensuring the uncertain LFC systems being asymptotically stable are deduced. Based on these conditions, the corresponding state feedback controller design method is given. Finally, a simulation of a two-area power system with electric vehicles is given as an example to substantiate the proposed method of this paper.

Majority Vote-Based Ensemble Approach for Distributed Denial of Service Attack Detection in Cloud Computing

Cloud computing is considered as technical advancement in information technology. Many organizations have been motivated by this advancement to outsource their data and computational needs. Such platforms are required to fulfil basic security principles such as confidentiality, availability, and integrity. Cloud computing offers scalable and virtualized services with a high flexibility level and decreased maintenance costs to end-users. The infrastructure and protocols that are behind cloud computing may contain bugs and vulnerabilities. These vulnerabilities are being exploited by attackers, leading to attacks. Among the most reported attacks in cloud computing are distributed denial-of-service (DDOS) attacks. DDOS attacks are conducted by sending many data packets to the targeted infrastructure. This leads to most network bandwidth and server time being consumed, thus causing a denial of the service problem. Several methods have been proposed and experimented with for early DDOS attack detection. Employing a single machine learning classification model may give an adequate level of attack detection accuracy but needs an enhancement. In this study, we propose an approach based on an ensemble of machine learning classifiers. The proposed approach uses a majority vote-based ensemble of classifiers to detect attacks more accurately. A subset of the CICDDOS2019 dataset consisting of 32,000 instances, including 8450 benign and 23,550 DDOS attack instances was used in this study for results and evaluation. The experimental results showed that 98.02% accuracy was achieved with 97.45% sensitivity and 98.65% specificity.

Research on Dual Security Control for a Non-Linear CPS with Multi-Objective Constraints under DoS Attack and Actuator Fault: An Active-Passive Attack-Tolerant Approach

Based on the discrete event-triggered communication scheme (DETCS), a codesign method of dual security control and communication for the non-linear cyberphysical system (CPS) with denial-of-service (DoS) attack and actuator fault is studied under multi-objective constraints. First, to effectively distinguish DoS attacks with different energy levels, the DoS attack detection method is established based on the maximum allowable delay of the system. Second, a non-linear CPS dual security control framework that integrates active-passive attack tolerance for DoS attack and active fault tolerance for actuator fault is constructed. Third, the low-energy DoS attack is regarded as a special kind of time delay, and a robust observer for the estimation of system states and actuator fault is designed, and a codesign method of passive attack tolerance, active fault tolerance, and communication is proposed. Furthermore, a correction compensation algorithm of control quantity is proposed for high-energy DoS attack based on the PID idea to make active-passive attack tolerance more effective. Finally, the effectiveness of the proposed method is verified by the simulation of a quadruple-tank model.

Optimization of IPv6 Neighbor Discovery Protocol

In IPv6, the DAD (Duplicate Address Detection) protocol detects duplicate addresses configured on the local link. Once the IPv6 address is auto configured on an IPv6 enabled host, the host verifies that its address is unique using the DAD procedure. This protocol works when hosts can communicate. If the DAD protocol fails to detect duplication, both the hosts assign the same link-local address. The neighbor discovery protocol verifies the generated address is unique or already exists on the local link. This process is known as Duplicate Address Detection (DAD). This process has critical security vulnerability and is susceptible to many attacks, especially allowing hackers to perform denial of service attacks (DOS). With that, the new devices will not be able to join the network. Researchers have developed various techniques to address DAD vulnerabilities, such as NDPMon, SEND, and Software-defined networking, SAVA, and extension headers. These techniques appear to be neither robust nor performance-oriented with DAD’s DOS detection and mitigation techniques. We have proposed a novel approach that detects and mitigates DOS attacks consuming low bandwidth and overhead.

Performance limitation analysis of networked control systems under denial‐of‐service attacks

AbstractThe performance limitation analysis of networked control systems (NCSs) with denial‐of‐service (DoS) attacks and external disturbances is studied in this paper. An optimal control strategy is proposed to solve the problem of performance limitation, and also an intrusion detection system (IDS) method is used to detect DoS attacks, so that DoS attacks have the least impact on NCSs. A non‐cooperative game model between IDS and DoS attackers is established, and the optimal packet delivery rate of NCSs is obtained by solving the Nash equilibrium (NE) strategy of the non‐cooperative game. An appropriate Lyapunov function is selected, and the accuracy of the definition is proved by the dynamic programming and mathematical induction. The derived results show that the performance limitation of NCSs is influenced by traditional constraints, DoS attacks, and external disturbances. Finally, some examples are given to show the effectiveness of the obtained theoretical results.

Denial of service attack detection and mitigation for internet of things using looking-back-enabled machine learning techniques

IoT (Internet of Things) systems are still facing a great number of attacks due to their integration in several areas of life. The most-reported attacks against IoT systems are "Denial of Service" (DoS) and "Distributed Denial of Service" (DDoS) attacks. In this paper, we investigate DoS/DDoS attacks detection for IoT using machine learning techniques. We propose a new architecture composed of two components: DoS/DDoS detection and DoS/DDoS mitigation. The detection component provides fine-granularity detection, as it identifies the specific type of attack, and the packet type used in the attack. In this way, it is possible to apply the corresponding mitigation countermeasure on specific packet types. The proposed DoS/DDoS detection component is a multi-class classifier that adopts the "Looking-Back" concept, and is evaluated on the Bot-IoT dataset. Evaluation results show promising results as a Looking-Back-enabled Random Forest classifier achieves an accuracy of 99.81%.

An approach for slow distributed denial of service attack detection and alleviation in software defined networks

Over the last few years, the need for programmable networks has captured the interest of industrialists and academicians. It has led to the development of a paradigm called software defined network (SDN). It separates the network intelligence into the control plane and forwarding logic into the data plane. This architecture gives scope to various security issues of which denial of service (DoS) is the most common and challenging to detect. This paper focuses on the detection and mitigation of a slow DoS attack called Slowloris on Apache2 server in SDN based networks. The proposed solution is called Slowloris detection and mitigation mechanism (SDMM). Mininet, an emulator, and SimpleHTTPServer are used for simulation and the same is implemented using Zodiac FX OpenFlow switch, Ryu controller and Apache2 server. SDMM algorithm detects and mitigates prolonged Slowloris attack in typical networks as well as in slow networks with low bandwidth and high delay in 240-280s with an accuracy of 100% and 98% respectively. It uses expectation of burst size as a key factor for detection.

A Comprehensive Review of Denial of Service Attacks in Blockchain Ecosystem and Open Challenges

With the proliferation of the blockchain technology ecosystems such as mining pools, crypto exchanges, full Bitcoin nodes, wallets, and pool protocol servers in recent years, the denial of service (DoS) attack vector has become more prevalent, and the attacks are targeted to the peer-to-peer networks and blockchain users. Despite blockchain enhancing security with decentralized design, secured distributed storage, and privacy, it is still vulnerable to new attack threats. If an attempted DoS is successful on blockchain, the impact is most likely massive given the fact that it is predominantly used for finance applications. An extensive account of the current state-of-the-art for possible DoS and corresponding mitigation techniques is not discussed in the existing research. This paper analyzes and categorizes the existing state-of-the-art DoS attack methods, detection techniques, and mitigation solutions targeting blockchain peer-to-peer networks as well as conventional network crypto exchanges. The review of the prior research shows that the blockchain ecosystem can be a target to successfully perform DoS attacks in the future, and technological advancements in blockchain are needed to mitigate potential attacks.

A Paradigm for DoS Attack Disclosure using Machine Learning Techniques

Cybersecurity is one of the main concerns of governments, businesses, and even individuals. This is because a vast number of attacks are their core assets. One of the most dangerous attacks is the Denial of Service (DoS) attack, whose primary goal is to make resources unavailable to legitimate users. In general, the Intrusion Detection and Prevention Systems (IDPS) hinder the DoS attack, using advanced techniques. Using machine learning techniques, this study will develop a detection model to detect DoS attacks. Utilizing the NSL-KDD dataset, the suggested DoS attack detection model was investigated using Naive Bayes, K-nearest neighbor, Decision Tree, and Support Vector Machine algorithms. The Accuracy, Recall, Precision, and Matthews Correlation Coefficients (MCC) metrics are used to compare these four techniques. In general, all techniques are performing well with the proposed model. However, The Decision Tree technique has outperformed all the other techniques in all four metrics, while the Naive Bayes technique showed the lowest performance.

Novel DoS Attack Detection Based on Trust Mode Authentication for IoT

Wireless sensor networks are extensively utilized as a communication mechanism in the field of the Internet of Things (IoT). Along with these services, numerous IoT based applications need stabilized transmission or delivery over unbalanced wireless connections. To ensure the stability of data packets delivery, prevailing works exploit diverse geographical routing with multi-hop forwarders in WSNs. Furthermore, critical Denial of Service (DoS) attacks frequently has an impact on these techniques, where an enormous amount of invalid data starts replicating and transmitted to receivers to prevent Wireless Sensor Networks (WSN) communication. In this investigation, a novel adaptive endorsement method is designed by combining dimensionality reduction based Hilbert-Huang Transformation (DR-HHT) and authentication trust mode (ATM). DR-HHT and ATM defend against the severity of DoS attacks, by fulfilling trust, reliability, stability requirements. ATM also examines the state information (SI) of nodes in wireless links; this SI leverages the performance of ATM to enhance data delivery effectually. Dissimilar to existing routing protocols, DR-HHT and ATM guarantee data integrity by building Kolmogorov_Smirnov based authentication algorithms. Concerning the correlation coefficient, this model isolates DoS attacks and diminishes computational cost. This strategy also eliminates duplicate data transmission and redundant information, offering an effectual trust-based evaluation model from adaptive authentication. Extensive simulation demonstrates that the anticipated model shows a better trade-off than the prevailing techniques and the simulation is carried out in a MATLAB environment.

On the use of principal component analysis in the entropy based detection of denial‐of‐service attacks

AbstractThis paper investigates some possibilities for the use of the principal component analysis (PCA) algorithm in the detection of denial‐of‐service (DoS) attacks. Two simple traffic features that are widely used for the detection of DoS attacks are source and destination ports of packets. In this paper, we show that by using only the principal component of these two features as the input for detection a powerful detector can be built. Shannon entropy formula and two generalized entropy formulas have been used in combination with PCA. The input dataset is generated in an emulation testbed. The type of attack that is investigated is SYN flood.

Real-Time DDoS Attack Detection System Using Big Data Approach

Currently, the Distributed Denial of Service (DDoS) attack has become rampant, and shows up in various shapes and patterns, therefore it is not easy to detect and solve with previous solutions. Classification algorithms have been used in many studies and have aimed to detect and solve the DDoS attack. DDoS attacks are performed easily by using the weaknesses of networks and by generating requests for services for software. Real-time detection of DDoS attacks is difficult to detect and mitigate, but this solution holds significant value as these attacks can cause big issues. This paper addresses the prediction of application layer DDoS attacks in real-time with different machine learning models. We applied the two machine learning approaches Random Forest (RF) and Multi-Layer Perceptron (MLP) through the Scikit ML library and big data framework Spark ML library for the detection of Denial of Service (DoS) attacks. In addition to the detection of DoS attacks, we optimized the performance of the models by minimizing the prediction time as compared with other existing approaches using big data framework (Spark ML). We achieved a mean accuracy of 99.5% of the models both with and without big data approaches. However, in training and testing time, the big data approach outperforms the non-big data approach due to that the Spark computations in memory are in a distributed manner. The minimum average training and testing time in minutes was 14.08 and 0.04, respectively. Using a big data tool (Apache Spark), the maximum intermediate training and testing time in minutes was 34.11 and 0.46, respectively, using a non-big data approach. We also achieved these results using the big data approach. We can detect an attack in real-time in few milliseconds.