Detect Denial Of Service Attacks Research Articles

Cluster-based wireless sensor network framework for denial-of-service attack detection based on variable selection ensemble machine learning algorithms

A Cluster-Based Wireless Sensor Network (CBWSN) is a system designed to remotely control and monitor specific events or phenomena in areas such as smart grids, intelligent healthcare, circular economies in smart cities, and underwater surveillance. The wide range of applications of technology in almost every field of human activity exposes it to various security threats from cybercriminals. One of the pressing concerns that requires immediate attention is the risk of security breaches, such as intrusions in wireless sensor network traffic. Poor detection of denial-of-service (DoS) attacks, such as Grayhole, Blackhole, Flooding, and Scheduling attacks, can deplete the energy of sensor nodes. This can cause certain sensor nodes to fail, leading to a degradation in network coverage or lifetime. The detection of such attacks has resulted in significant computational complexity in the related works. As new threats arise, security attacks get more sophisticated, focusing on the target system's vulnerabilities. This paper proposed the development of Cluster-Based Wireless Sensor Network and Variable Selection Ensemble Machine Learning Algorithms (CBWSN_VSEMLA) as a security threats detection system framework for DoS attack detection. The CBWSN model is designed using a Fuzzy C-Means (FCM) clustering technique, whereas VSEMLA is a detection system comprised of Principal Component Analysis (PCA) for feature selection and various ensemble machine learning algorithms (Bagging, LogitBoost, and RandomForest) for the detection of grayhole attacks, blackhole attacks, flooding attacks, and scheduling attacks. The experimental results of the model performance and complexity comparison for DoS attack evaluation using the WSN-DS dataset show that the PCA_RandomForest IDS model outperforms with 99.999 % accuracy, followed by the PCA_Bagging IDS model with 99.78 % accuracy and the PCA_LogitBoost model with 98.88 % accuracy. However, the PCA_RandomForest model has a high computational complexity, taking 231.64 s to train, followed by the PCA_LogitBoost model, which takes 57.44 s to train, and the PCA_Bagging model, which takes 0.91 s to train to be the best in terms of model computational complexity. Thus, the models surpassed all baseline models in terms of model detection accuracy on flooding, scheduling, grayhole, and blackhole attacks.

Distributed Denial of Service Attack Detection in IoT Networks using Deep Learning and Feature Fusion: A Review

The explosive growth of Internet of Things (IoT) devices has led to escalating threats from distributed denial of service (DDoS) attacks. Moreover, the scale and heterogeneity of IoT environments pose unique security challenges, and intelligent solutions tailored for the IoT are needed to defend critical infrastructure. The deep learning technique shows great promise because automatic feature learning capabilities are well suited for the complex and high-dimensional data of IoT systems. Additionally, feature fusion approaches have gained traction in enhancing the performance of deep learning models by combining complementary feature sets extracted from multiple data sources. This paper aims to provide a comprehensive literature review focused specifically on deep learning techniques and feature fusion for DDoS attack detection in IoT networks. Studies employing diverse deep learning models and feature fusion techniques are analysed, highlighting key trends and developments in this crucial domain. This review provides several significant contributions, including an overview of various types of DDoS attacks, a comparison of existing surveys, and a thorough examination of recent applications of deep learning and feature fusion for detecting DDoS attacks in IoT networks. Importantly, it highlights the current challenges and limitations of these deep learning techniques based on the literature surveyed. This review concludes by suggesting promising areas for further research to enhance deep learning security solutions, which are specifically tailored to safeguarding the fast-growing IoT infrastructure against DDoS attacks.

Improvement of Distributed Denial of Service Attack Detection through Machine Learning and Data Processing

The early and accurate detection of Distributed Denial of Service (DDoS) attacks is a fundamental area of research to safeguard the integrity and functionality of organizations’ digital ecosystems. Despite the growing importance of neural networks in recent years, the use of classical techniques remains relevant due to their interpretability, speed, resource efficiency, and satisfactory performance. This article presents the results of a comparative analysis of six machine learning techniques, namely, Random Forest (RF), Decision Tree (DT), AdaBoost (ADA), Extreme Gradient Boosting (XGB), Multilayer Perceptron (MLP), and Dense Neural Network (DNN), for classifying DDoS attacks. The CICDDoS2019 dataset was used, which underwent data preprocessing to remove outliers, and 22 features were selected using the Pearson correlation coefficient. The RF classifier achieved the best accuracy rate (99.97%), outperforming other classifiers and even previously published neural network-based techniques. These findings underscore the feasibility and effectiveness of machine learning algorithms in the field of DDoS attack detection, reaffirming their relevance as a valuable tool in advanced cyber defense.

Detection‐based compound event‐triggered secure control for nonlinear multiagent systems

SummaryThis paper designs a distributed dynamic‐detection‐based event‐triggered control method to address the secure tracking control problem. A distributed online iterative dynamic detection mechanism is designed to detect denial‐of‐service (DoS) attacks. The detection results are transmitted into a proposed ET method to adjust the triggering threshold, which can mitigate the impact of DoS attacks. Moreover, the signals of state, observations of disturbance observers and adaptive laws are calculated to generate the trigger signals in the control signal simultaneously, which can help conserve communication resources and reduce the occurrence of pulse phenomenon. Meanwhile, since the predictor exists certain prediction errors that will reduce the tracking performance, a speed function is introduced to ensure the achievement of the control objective. The designed solution guarantees semiglobally uniformly ultimately bounded for all signals within the closed‐loop system. Finally, the effectiveness of control scheme is demonstrated through several simulation results.

Detection of DoS Attacks for IoT in Information-Centric Networks Using Machine Learning: Opportunities, Challenges, and Future Research Directions

The Internet of Things (IoT) is a rapidly growing network that shares information over the Internet via interconnected devices. In addition, this network has led to new security challenges in recent years. One of the biggest challenges is the impact of denial-of-service (DoS) attacks on the IoT. The Information-Centric Network (ICN) infrastructure is a critical component of the IoT. The ICN has gained recognition as a promising networking solution for the IoT by supporting IoT devices to be able to communicate and exchange data with each other over the Internet. Moreover, the ICN provides easy access and straightforward security to IoT content. However, the integration of IoT devices into the ICN introduces new security challenges, particularly in the form of DoS attacks. These attacks aim to disrupt or disable the normal operation of the ICN, potentially leading to severe consequences for IoT applications. Machine learning (ML) is a powerful technology. This paper proposes a new approach for developing a robust and efficient solution for detecting DoS attacks in ICN-IoT networks using ML technology. ML is a subset of artificial intelligence (AI) that focuses on the development of algorithms. While several ML algorithms have been explored in the literature, including neural networks, decision trees (DTs), clustering algorithms, XGBoost, J48, multilayer perceptron (MLP) with backpropagation (BP), deep neural networks (DNNs), MLP-BP, RBF-PSO, RBF-JAYA, and RBF-TLBO, researchers compare these detection approaches using classification metrics such as accuracy. This classification metric indicates that SVM, RF, and KNN demonstrate superior performance compared to other alternatives. The proposed approach was carried out on the NDN architecture because, based on our findings, it is the most used one and has a high percentage of various types of cyberattacks. The proposed approach can be evaluated using an ndnSIM simulation and a synthetic dataset for detecting DoS attacks in ICN-IoT networks using ML algorithms.

Anomaly Detection IDS for Detecting DoS Attacks in IoT Networks Based on Machine Learning Algorithms.

Widespread and ever-increasing cybersecurity attacks against Internet of Things (IoT) systems are causing a wide range of problems for individuals and organizations. The IoT is self-configuring and open, making it vulnerable to insider and outsider attacks. In the IoT, devices are designed to self-configure, enabling them to connect to networks autonomously without extensive manual configuration. By using various protocols, technologies, and automated processes, self-configuring IoT devices are able to seamlessly connect to networks, discover services, and adapt their configurations without requiring manual intervention or setup. Users' security and privacy may be compromised by attackers seeking to obtain access to their personal information, create monetary losses, and spy on them. A Denial of Service (DoS) attack is one of the most devastating attacks against IoT systems because it prevents legitimate users from accessing services. A cyberattack of this type can significantly damage IoT services and smart environment applications in an IoT network. As a result, securing IoT systems has become an increasingly significant concern. Therefore, in this study, we propose an IDS defense mechanism to improve the security of IoT networks against DoS attacks using anomaly detection and machine learning (ML). Anomaly detection is used in the proposed IDS to continuously monitor network traffic for deviations from normal profiles. For that purpose, we used four types of supervised classifier algorithms, namely, Decision Tree (DT), Random Forest (RF), K Nearest Neighbor (kNN), and Support Vector Machine (SVM). In addition, we utilized two types of feature selection algorithms, the Correlation-based Feature Selection (CFS) algorithm and the Genetic Algorithm (GA) and compared their performances. We also utilized the IoTID20 dataset, one of the most recent for detecting anomalous activity in IoT networks, to train our model. The best performances were obtained with DT and RF classifiers when they were trained with features selected by GA. However, other metrics, such as training and testing times, showed that DT was superior.

Machine-learning-based optical spectrum feature analysis for DoS attack detection in IP over optical networks.

In this paper, we introduce a novel approach for detecting Denial of Service (DoS) attacks in software-defined IP over optical networks, leveraging machine learning to analyze optical spectrum features. This method employs machine learning to automatically process optical spectrum data, which is indicative of network security status, thereby identifying potential DoS attacks. To validate its effectiveness, we conducted both numerical simulations and experimental trials to collect relevant optical spectrum datasets. We then assessed the performance of three machine learning algorithms XGBoost, LightGBM, and the BP neural network in detecting DoS attacks. Our findings show that all three algorithms demonstrate a detection accuracy exceeding 97%, with the BP neural network achieving the highest accuracy rates of 99.55% and 99.74% in simulations and experiments, respectively. This research not only offers a new avenue for DoS attack detection but also enhances early detection capabilities in the underlying optical network through optical spectrum data analysis.

TPAAD: Two‐phase authentication system for denial of service attack detection and mitigation using machine learning in software‐defined network

AbstractSoftware‐defined networking (SDN) has received considerable attention and adoption owing to its inherent advantages, such as enhanced scalability, increased adaptability, and the ability to exercise centralized control. However, the control plane of the system is vulnerable to denial‐of‐service (DoS) attacks, which are a primary focus for attackers. These attacks have the potential to result in substantial delays and packet loss. In this study, we present a novel system called Two‐Phase Authentication for Attack Detection that aims to enhance the security of SDN by mitigating DoS attacks. The methodology utilized in our study involves the implementation of packet filtration and machine learning classification techniques, which are subsequently followed by the targeted restriction of malevolent network traffic. Instead of completely deactivating the host, the emphasis lies on preventing harmful communication. Support vector machine and K‐nearest neighbours algorithms were utilized for efficient detection on the CICDoS 2017 dataset. The deployed model was utilized within an environment designed for the identification of threats in SDN. Based on the observations of the banned queue, our system allows a host to reconnect when it is no longer contributing to malicious traffic. The experiments were run on a VMware Ubuntu, and an SDN environment was created using Mininet and the RYU controller. The results of the tests demonstrated enhanced performance in various aspects, including the reduction of false positives, the minimization of central processing unit utilization and control channel bandwidth consumption, the improvement of packet delivery ratio, and the decrease in the number of flow requests submitted to the controller. These results confirm that our Two‐Phase Authentication for Attack Detection architecture identifies and mitigates SDN DoS attacks with low overhead.

Machine learning based detection of DDoS attacks in software defined network

<span>Nowadays, software defined networking (SDN) offers benefits in the area so fautomation, elasticity, and resource consumption. However, evidenceis there that SDN controller may undergo certain defeat for the network structure, particularly as the yare targeted by attacks like denial of service (DoS). Due to this network traffic has increased tremendously and attacked the server severely. To handle this issue, weused the Ryu controller and Mininet tool to identify and all eviate the DoS attack by the machine learning (ML) algorithm. Since ML is deemed as themain method for detecting peculiarities, the detection of DoS attacks was done through ML based classification. In this paper, several ML techniques were used to identify the DoS attack, and the traffic which is causing the attack has been dropped immediately to avoid congestion. The proposed work hasbeen simulated in Mininet and the results show that the proposed work detects DoS attacks well and achieves good accuracy.</span>

Low-rate distributed denial of service attacks detection in software defined network-enabled internet of things using machine learning combined with feature importance

<p>One of the main challenges in developing the internet of things (IoT) is the existence of availability problems originated from the low-rate distributed denial of service attacks (LRDDoS). The complexity of IoT makes the LRDDoS hard to detect because the attack flow is performed similarly to the regular traffic. Integration of software defined IoT (SDN-Enabled IoT) is considered an alternative solution for overcoming the specified problem through a single detection point using machine learning approaches. The controller has a resource limitation for implementing the classification process. Therefore, this paper extends the usage of Feature Importance to reduce the data complexity during the model generation process and choose an appropriate feature for generating an efficient classification model. The research results show that the Gaussian Naïve Bayes (GNB) produced the most effective outcome. GNB performed better than the other algorithms because the feature reduction only selected the independent feature, which had no relation to the other features.</p>

DoS attack detection using online learning techniques in wireless sensor networks

Wireless sensor network (WSN) models pose substantial security vulnerabilities since most WSNs are deployed in unattended hostile environments. This research focuses on denial-of-service (DoS) attack detection, a crucial problem in WSN security. Previous research has mostly focused on offline machine learning algorithms, which require long-term data collection and cannot continually adapt to new data. Online learning is thus more suitable for detecting DoS attacks in WSN due to the benefit of continuous improvement with fresh data. Nevertheless, existing online DoS attack detection algorithms do not take internal and external data interference into consideration. Thus, noisy data might have a negative effect on the performance of the model. Moreover, the data includes features that are redundant or unnecessary for the classification. Hence, the selection of proper features not only decreases computational time but also improves the performance of the model. This study proposes an online-learning-based approach for detecting DoS attacks in WSN. Specifically, a feature selection method is proposed to identify the most appropriate attributes for the training process. Furthermore, a noise-tolerant online passive-aggressive multi-class classifier is also developed. The performance of our proposed method is investigated in terms of accuracy, precision, recall, and F1-score, and it proves to be competitive.

A Balanced Intrusion Detection System for Wireless Sensor Networks in a Big Data Environment Using CNN-SVM Model

Wireless Sensor Networks (WSNs) were exposed to several distinct safety issues and attacks regarding gathering and sending data. In this scenario, one of the most prevalent WSN assaults that may target any tier of the protocol stack is the Denial of Service (DoS) attack. The current research suggested various strategies to find the attack in the network. However, it has classification challenges. An effective ensemble deep learning-based intrusion detection system to identify the assault in the WSN network was, therefore, suggested in this research to address this issue. The data pre-processing involves converting qualitative data into numeric data using the One-Hot Encoding technique. Following that, Normalization Process was carried out. Then Manta-Ray Foraging Optimization is suggested to choose the best subset of features. Then Synthetic Minority Oversampling Technique (SMOTE) oversampling creates a new minority sample to balance the processed dataset. Finally, CNN–SVM classifier is proposed to classify the attack kinds. The Accuracy, F-Measure, Precision, and Recall metrics were used to assess the outcomes of 99.75%, 99.21%, 100%, and 99.6%, respectively. Compared to existing approaches, the proposed method has shown to be extremely effective in detecting DoS attacks in WSNs.

Detection of DoS Attacks in Smart City Networks With Feature Distance Maps: A Statistical Approach

Smart cities are highly digitalized cities, with a high volume of data stored digitally, as well as a large number of physical objects and Internet of Things (IoT) devices. It is no surprise that security concerns increase as connected IoT devices become more prevalent. There has long been a perception that Denial of Service (DoS) attacks give rise to a notable menace to the security of smart city networks. A statistical method based on feature distance maps is suggested in this work for the identification of DoS attacks in smart city networks. This study aims to build a DoS attack detection model that has a low computational complexity and a low rate of false positives. The performance of the model is arbitrated using smart city network traffic dataset. In order to make processing easier, the features are normalized using Min-Max normalization. A subset of features suitable for attack detection can be evaluated with Pearson Correlation Coefficient. A feature distance map method is proposed for extracting correlations between features between records. Manhattan distance measures are used to generate the feature distance maps. The feature distance maps enhance the statistical analysis process. Hellinger distance measure is used to generate the normal traffic profile by calculating the degree of similarity between the feature distance map of each record and the normal traffic profile mean. On the basis of the proposed threshold, the Hellinger distance is used to evaluate whether an unknown traffic data belongs to normal or attack. Compared with Mahalanobis distance-based DoS detection, the Hellinger distance-based attack detection takes less time to execute. Based on the theoretical and experimental results, the proposed DoS attack detection system has a low computational complexity and a low false positive rate. Furthermore, the proposed approach outperforms the existing state-of-the-art feature ranking based DoS attack detection systems.

An Adversarial Machine Learning-Based Fast Detection Method for Denial of Service-Oriented Cyber Attacks in Internet of Vehicles

Denial of Service (DoS)-Oriented cyber attack has been a major threat for physical security in many kinds of network media, including the Internet of Vehicles (IoV). This paper focuses on the scenario of IoV, and proposes a machine learning-based fast detection method for adversarial neural network-based fast detection method for DoS-oriented cyber attacks. First, by analyzing the implementation principles and attack characteristics of three attack types, three aspects of statistical features are extracted: maximum matching packet growth rate, source address entropy value, and flow table similarity. Then, they are used as the input features to establish an adversarial machine learning-based DoS cyber attack detection method. On this basis, the field features of six stream rules are extracted, and two DoS cyber attack detection methods via machine learning are formulated. The proposals are able to detect the low-rate DoS-based cyber attacks against the data layer. The experimental results show that the proposed DoS attack detection method based on machine learning can effectively detect three DoS attacks under IoV, and these two algorithms have higher detection rates when compared with other algorithms.

Distributed Denial of Service Attack Detection in Network Traffic Using Deep Learning Algorithm.

Internet security is a major concern these days due to the increasing demand for information technology (IT)-based platforms and cloud computing. With its expansion, the Internet has been facing various types of attacks. Viruses, denial of service (DoS) attacks, distributed DoS (DDoS) attacks, code injection attacks, and spoofing are the most common types of attacks in the modern era. Due to the expansion of IT, the volume and severity of network attacks have been increasing lately. DoS and DDoS are the most frequently reported network traffic attacks. Traditional solutions such as intrusion detection systems and firewalls cannot detect complex DDoS and DoS attacks. With the integration of artificial intelligence-based machine learning and deep learning methods, several novel approaches have been presented for DoS and DDoS detection. In particular, deep learning models have played a crucial role in detecting DDoS attacks due to their exceptional performance. This study adopts deep learning models including recurrent neural network (RNN), long short-term memory (LSTM), and gradient recurrent unit (GRU) to detect DDoS attacks on the most recent dataset, CICDDoS2019, and a comparative analysis is conducted with the CICIDS2017 dataset. The comparative analysis contributes to the development of a competent and accurate method for detecting DDoS attacks with reduced execution time and complexity. The experimental results demonstrate that models perform equally well on the CICDDoS2019 dataset with an accuracy score of 0.99, but there is a difference in execution time, with GRU showing less execution time than those of RNN and LSTM.

Improving distributed denial of service attack detection using supervised machine learning

Distributed denial-of-service (DDoS) attacks are a big problem for cyber security because they can cause a lot of damage to both people and companies. Distributed Denial of Service (DDoS) attacks have been seen to do a lot of damage to the networks and devices they are aimed at. These hacks slow down networks and use up buffer space, which makes resources unavailable. To solve this problem, “Supervised Machine Learning Models” have been used. Several machine learning techniques, such as Random Forest, K-Nearest Neighbors (KNN), and Logistic Regression, were used to figure out what was normal and what was an attack. This study used a sample of the CSE-CICIDS2018, CSE-CICIDS2017, and CICDoS datasets. The dataset was divided into two parts in which three fourth of the data was used for training and one fourth of the data for testing purpose. The proposed research attempt to classify the DDoS attack by using supervised machine learning classifiers. This approach employs three machine learning classifiers such as Random Forest, KNN and Logistic regression. Then we perform Feature Scaling by using Standard Scaler. Finally, the system was evaluated. Random forest classifier outperformed other classifiers with an accuracy of 97.6 % whereas KNN and Logistic regression achieved 97 % and 91.1 %. The study employed several Supervised Machine Learning techniques, including Random Forest, KNN, and Logistic Regression to identify the most effective algorithm for the test. Results demonstrate that Random Forest outperformed the other models.

Distributed Denial of Service Attack Detection Using Hyper Calls Analysis in Cloud

In the scenario of Distributed Denial of Service (DDoS) attacks are increasing in a significant manner, the attacks should be mitigated in the beginning itself to avoid its devastating consequences for any kind of business. DDoS attack can slow down or completely block online services of business like websites, email or anything that faces internet. The attacks are frequently originating from cloud virtual machines for anonymity and wide network bandwidth. Hyper-Calls Analysis(HCA) enables the tracing of command flow to detect any clues for the occurrence of malicious activity in the system. A DDoS attack detection approach proposed in this paper works in the hypervisor side to perform hyper calls based introspection with machine learning algorithms. The system evaluates system calls in hypervisor for the classification of malicious activities through Support Vector Machine and Stochastic Gradient Descent (SVM & SGD) Algorithms. The attack environment created using XOIC attacker tool and CPU death ping libraries. The system’s performance also evaluated on CICDDOS 2019 dataset. The experimental results reveal that more than 99.6% of accuracy in DDoS detection without degrading performance.

Detection and Mitigation of (D)DoS Attacks in SDN Environment Using Entropy

Software Defined Networking (SDN) is a paradigm for the networks, where the control planes and data planes are separated. It provides centralized network control by separating the network’s control logic from the underlying hardware devices. However, like traditional networks SDN is also susceptible to Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. This paper aims to detect and mitigate DoS and DDoS attacks in an SDN environment using an entropy-based approach. The proposed mechanism calculates the entropy of the network over the collected traffic, and derives a dynamic threshold according to the network traffic conditions to determine whether the environment is subject to DoS or DDoS attacks. In the event of the attack, the proposed mechanism installs a drop flow rule into underlying forwarding devices, discarding the traffic sent from attacking host to victim host

Conditional Tabular Generative Adversarial Based Intrusion Detection System for Detecting Ddos and Dos Attacks on the Internet of Things Networks

The increasing use of Internet of Things (IoT) devices has led to a rise in Distributed Denial of Service (DDoS) and Denial of Service (DoS) attacks on these networks. These attacks can have severe consequences, resulting in the unavailability of critical services and financial losses. In this paper, we propose an Intrusion Detection System (IDS) based on a Conditional Tabular Generative Adversarial Network (CTGAN) for detecting DDoS and DoS attacks on IoT networks. Our CGAN-based IDS utilizes a generator network to produce synthetic traffic that mimics legitimate traffic patterns, while the discriminator network learns to differentiate between legitimate and malicious traffic. The syntactic tabular data generated by CTGAN is employed to train multiple shallow machine-learning and deep-learning classifiers, enhancing their detection model performance. The proposed approach is evaluated using the Bot-IoT dataset, measuring detection accuracy, precision, recall, and F1 measure. Our experimental results demonstrate the accurate detection of DDoS and DoS attacks on IoT networks using the proposed approach. Furthermore, the results highlight the significant contribution of CTGAN in improving the performance of detection models in machine learning and deep learning classifiers.

Efficient Detection and Localization of DoS Attacks in Heterogeneous Vehicular Networks

Vehicular communication has emerged as a powerful tool for providing a safe and comfortable driving experience for users. Long Term Evolution (LTE) supports and enhances the quality of vehicular communication due to its properties such as high data rate, spatial reuse, and low delay. However, high mobility of vehicles introduces a wide variety of security threats, including Denial-of-Service (DoS) attacks. In this paper, we propose effective solutions for real-time detection and localization of DoS attacks in an LTE-based vehicular network with mobile network components (e.g., vehicles, femto access points, etc.). We consider malicious data transmission by vehicles in two ways- using real identification (unintentional) and using fake identification (intentional). This paper makes three important contributions. First, we propose an efficient attack detection technique based on data packet counter and average Packet Delivery Ratio (PDR). Next, we present an improved attack detection framework using machine learning algorithms. We use some ML-based supervised classification algorithms to make detection more robust and consistent. Finally, we propose Data Packet Counter (DPC)-based, triangulation-based and measurement report based localization for both intentional and unintentional DoS attacks. We analyze the average packet delay incurred by vehicles by modelling the system as an <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$M/M/m$</tex-math></inline-formula> queue. Our experimental evaluation demonstrates that our proposed technique significantly outperforms state-of-the-art techniques.