DDoS Attack Detection Research Articles

A Feature Similarity Machine Learning Model for DDoS Attack Detection in Modern Network Environments for Industry 4.0

• A new traffic attribute-pattern similarity function SWATHI for similarity computation between network traffic attribute patterns and evolutionary feature clustering of traffic attribute patterns to carry feature transformation-based dimensionality reduction. • A Gaussian based network traffic similarity function for similarity computation between network traffic instances. • A machine learning model SWASTHIKA which considers network traffic data obtained after feature transformation for detection of low rate and high-rate network attacks. Recent advancements in artificial intelligence and machine learning technologies have laid the flagstone for the fourth industrial revolution, Industry 4.0. The industry 4.0 is at a very high momentum when compared to previous revolutions witnessed by humans in a way which was never anticipated. Cyber Physical Systems and Cloud computing are the basis for Industry 4.0. An ongoing research challenge in cloud computing is the immediate need to address security and data availability challenges coined in modern networking environments. For instance, DDoS attacks in cloud are continuously throwing new challenges to network community which makes detection of these attacks, an ongoing research challenge with respect to cloud security. At the outset, the research reported in this work has addressed three important contributions (i) A new gaussian based traffic attribute-pattern similarity function for evolutionary feature clustering to achieve feature transformation-based dimensionality reduction, (ii) A Gaussian based network traffic similarity function for similarity computation between network traffic instances and (iii) A machine learning model SWASTHIKA which uses feature transformation traffic for detection of low rate and high-rate network attacks. For experimental study, the most recent benchmark dataset namely IoT DoS and DDoS attack dataset available at IEEE Dataport is considered as this dataset has highly non-linear traffic instances which are like the real-world traffic. The performance evaluation of the proposed machine learning model SWASTHIKA is done by considering various classifier evaluation parameters such as accuracy, precision, detection rate, and F-Score. The experiment results proved that the attack detection rate of SWASTHIKA is significantly better compared to state of art machine learning classifiers.

Review on Detection of DDOS Attack using Machine Learning

Abstract: Now days due to digitalization the drastic increment towards Computer technology and Computer network is increased rapidly. Various types of works are turned into Online Mode so due to increment in network connection various attack are been perform. One of the dangerous and powerful attack is Distributed Denial of Service [DDOS] is one of the major issues in the computer network. The Attacker target the server with the help of DDOS and tries to interrupt normal traffic. The Denial-ofservice consist of subclass which includes Distributed denial of service. Therefore, to prevent the DDOS attack many researches have been carried out. To Prevent DDOS common technique which includes Machine learning and deep learning. The main focus is to detect DDOS attack. Keywords: Computer Network, DDOS, Machine Learning, Deep Learning.

An investigation of different DDOS attack detection methods in software-defined networks

Software-Defined Network is more vulnerable to more frequent and severe security attacks. Distributed Denial of service (DDoS) spasms corrupt network along with hinder efficiency and performance significantly. DDoS spasms lead to exhaustion of network means, thereby stopping the controller and impeding normal activities. Detection of DDoS attacks requires different classification techniques that provide accurate and efficient decision-making. Various techniques to detect the attacks are proposed in the existing literature. However, analysis of various works reveals various shortcomings of different techniques. In this paper, the existing techniques are analyzed in terms of their accuracy and MSE, and seven methods are compared with regards to suitability to counter DDoS attacks efficiently. Analysis of the results shows limitations and sets the tone for future studies on the topic. Overall, it is suggested to continue looking for better techniques to improve upon the existing learning and experiences gained and provide more accurate results.

An ensemble method for feature selection and an integrated approach for mitigation of distributed denial of service attacks

AbstractDistributed denial of service attacks (DDoS) penetrate numerous computer system and implant malicious codes thereby making them ready for launching a collaborative attack. These attacks paralyze the target system mainly the web server by exhausting their network resources of the target server. The threats posed by DDoS attacks on the Internet demands for effective detection and mitigation methods of these attacks. In the paper, we proposed an integrated method for detection and mitigation of DDoS attack using machine learning and a line of defenses respectively. The detection phase consists of feature selection through ensemble feature selection algorithm and classification using machine learning algorithm. Feature selection algorithms are important as they reduce the dimension of the dataset. The selection of an efficient classification model will improve the detection rate of the proposed system. In the mitigation phase, we introduce two lines of defense to minimize the exhaustion of the victim server's resources. Using the existing dataset, we show experimentally that it is possible to detect the presence of attacks and mitigate them to a minimum level. The proposed integrated method yields an accuracy of 97.8% in detecting the attacks and able to reduce the utilization of processors upto an average of 25.95%.

IoT-based Network Attacks Discovery with Combined Classifiers

In this paper following the recent trends in IoT-based network attacks discovery and advancing further our previous research, in which we optimize and test single neural network, support vector machine and random forest classifiers for both the detection and recognition of multiple DDoS attacks, we propose results from newly developed combined classifiers. The first of them employs only a neural network and a random forest classifier, while the second use additionally a support vector machine. Both are implemented in two modifications – as detectors of malicious vs. normal traffic, and as classifiers of 10 types of attacks vs. non-attack samples. High classification accuracy is being obtained over the popular Bot-IoT dataset and it prove higher than that of the single classifiers. At the same time, it is also higher than other solutions, proposed in the practice.

A novel approach for DDoS attacks detection in COVID-19 scenario for small entrepreneurs

The current COVID-19 issue has altered the way of doing business. Now that most customers prefer to do business online, many companies are shifting their business models, which attracts cyber attackers to launch several kinds of cyberattacks against commercial companies simultaneously. The most common and lethal DDoS attack disables the victim’s online resources. While large businesses can afford defensive measures against DDoS assaults, the situation is different for new entrepreneurs. Their lack of security resources restricts their ability to ward off DDoS attacks. Here, we aim to highlight the problems that prospective entrepreneurs should be aware of before joining the business, followed by a filtering mechanism that efficiently identifies DDoS assaults in the COVID-19 scenario, which is the subject of our research. The suggested approach employs statistical and machine learning techniques to discriminate between DDoS attack data and regular communication. Our suggested framework is cost-effective and identifies DDoS attack traffic with a 92.8% accuracy rate.

Detection and prevention of DDoS attacks on M-healthcare sensitive data: a novel approach

Detection and prevention of DDoS attacks on M-healthcare sensitive data: a novel approach

Multi-type low-rate DDoS attack detection method based on hybrid deep learning

Multi-type low-rate DDoS attack detection method based on hybrid deep learning

Optimal feature selection with CNN-feature learning for DDoS attack detection using meta-heuristic-based LSTM

Optimal feature selection with CNN-feature learning for DDoS attack detection using meta-heuristic-based LSTM

DETECTION AND MITIGATION OF DISTRIBUTED DENIAL OF SERVICE ATTACKS ON NETWORK ARCHITECTURE SOFTWARE DEFINED NETWORKING USING THE NAIVE BAYES ALGORITHM

DDoS attacks are a form of attack carried out by sending packets continuously to machines and even computer networks. This attack will result in a machine or network resources that cannot be accessed or used by users. DDoS attacks usually originate from several machines operated by users or by bots, whereas Dos attacks are carried out by one person or one system. In this study, the term to be used is the term DDoS to represent a DoS or DDoS attack. In the network world, Software Defined Network (SDN) is a promising paradigm. SDN separates the control plane from forwarding plane to improve network programmability and network management. As part of the network, SDN is not spared from DDoS attacks. In this study, we use the naïve Bayes algorithm as a method to detect DDoS attacks on the Software Defined Network network architecture

Detecting DDoS Attacks in Cloud Computing Using Extreme Learning Machine and Adaptive Differential Evolution

Detecting DDoS Attacks in Cloud Computing Using Extreme Learning Machine and Adaptive Differential Evolution

DDoS attack detection and defence mechanism based on second-order exponential smoothing: Holt's model

DDoS attack detection and defence mechanism based on second-order exponential smoothing: Holt's model

DDoS attack detection and defence mechanism based on second-order exponential smoothing: Holt's model

Technological progress and digitisation are primarily assisted by the growth of internet. The web has now become a national asset, and all national security relies on it as well. But these emerging developments have also brought with them unparalleled network threats. Among them, a strong and more powerful attack on the internet is a distributed denial of service attack. In this work we propose a novel framework for DDoS detection. To detect anomalous variations in mean distance values the technique of second order exponential smoothing/Holt's method is used. In the proposed context, the DDoS defence module is based on the principle of the rate limitation of incoming traffic on the basis of bandwidth and demand rates from a device connected. The experimental verification of proposed method is done using the NS2 simulator and the results are evaluated with detection rate, throughput and false positive rate.

Detection and defence method of low-rate DDoS attacks in vehicle edge computing network using information metrics

Detection and defence method of low-rate DDoS attacks in vehicle edge computing network using information metrics

Prediction of dynamics of suspicious network activity based on network traffic analysis

The article considers the possibility of early prediction of cyberattacks based on the analysis of suspicious activity in the network, which will provide additional opportunities for information protection services in countering such attacks. A feature of a slow DDoS attack is the use of a vulnerability in the TCP protocol, where interruptions can be caused intentionally or unintentionally as a result of delays in the communication channel. It is well known that detection of slow DDoS attacks is significantly different from volume-based attacks, as slow attacks do not increase network traffic. The general problem is to detect the start time of such an attack, since traffic parameters do not change dramatically. An assumption is made about the dependence of the slow attack on the user’s behavior. Using machine learning methods based on the analysis of similar situations in the past, it is possible to create an integrated system for transforming large volumes of publicly available data to predict the behavior of attackers in the network. A method of detecting such attacks based on research and prediction of suspicious user activity is proposed. The possibilities of using this method have been proven on the basis of modeling RUDY attacks on HTTP services. The characteristics of forecasting accuracy depending on the accumulated traffic and attack statistics are given. It is concluded that this method can be used to detect different types of slow DDoS attacks. Predicting suspicious traffic provides a solution to the problem of detecting slow DDoS attacks based on an algorithm for finding unknown future values for a time series of traffic parameters. The proposed method combines the advantages of artificial intelligence and statistical analysis and is capable of self-learning in case of replenishment of attack statistics. This approach allows you to accurately determine the random process at the control points and ensure a minimum of the mean square error of approximation in the intervals between these points.

Detection and defence method of low-rate DDoS attacks in vehicle edge computing network using information metrics

Detection and defence method of low-rate DDoS attacks in vehicle edge computing network using information metrics

Signature-based Traffic Classification for DDoS Attack Detection and Analysis of Mitigation for DDoS Attacks using Programmable Commodity Switches

Signature-based Traffic Classification for DDoS Attack Detection and Analysis of Mitigation for DDoS Attacks using Programmable Commodity Switches

Securing IoT Based Maritime Transportation System Through Entropy-Based Dual-Stack Machine Learning Framework

Internet of Things (IoTs) is envisaged to widely capture the realm of logistics and transportation services in future. The applications of ubiquitous IoTs have been extended to Maritime Transportation Systems (MTS) that spawned increasing security threats; posing serious fiscal concerns to stakeholders involved. Among these threats, Distributed Denial of Service Attack (DDoS) is ranked very high that can wreak havoc on IoT artifacts of the MTS networks. Timely and effective detection of such attacks is imperative for necessary mitigation. Conventional approaches exploit entropy of attributes in network traffic for detecting DDoS attacks. However, the majority of these approaches are static in nature and consider only a few network traffic parameters, limiting the number of DDoS attack detection to a few types and intensities. In current research, a novel framework named “Dual Stack Machine Learning (S2ML)” has been proposed to calculate distinct entropy-based varying 10-Tuple (T) features from network traffic features, three window sizes and associated Rate of Exponent Separation (RES). These features have been exploited for developing an intelligent model over MTS-IoT datasets to successfully detect multiple types of DDoS attacks in MTS. S2ML is an efficient framework that overcomes the shortcomings of prevalent DDoS detection approaches, as evident from the comparison with Multi-layer Perceptron (MLP), Alternating Decision Tree (ADT) and Simple Logistic Regression (SLR) over different evaluation metrics (Confusion metrics, ROCs). The proposed S2ML technique outperforms prevalent ones with 1.5% better results compared to asserted approaches on distribution of normal/attack traffic. We look forward to enhancing the model performance through dynamic windowing, measuring packet drop rates and infrastructure of Software Defined Networks (SDNs).

An optimized weighted voting based ensemble model for DDoS attack detection and mitigation in SDN environment

In recent years, software defined networking (SDN) has risen to prominence as a cutting-edge and promising networking approach. SDN is more secure and immune to DDoS attacks than traditional networks due to the bifurcation of the control and data planes, a global perspective of the whole network, centralized network control, and many other features. SDN still seems to be vulnerable to new DDoS attacks that can target the Application plane, control plane, or data plane, as well as the SDN architectural communication channels. In this paper, we propose a novel optimized weighted voting ensemble model to detect DDoS attack in an SDN environment. The proposed ensemble employs six base classifiers (two SVMs, two Random forests, and two Gradient Boosted Machines) that are differentiated by hyperparameter values. The optimal set of weights are identified by a novel hybrid metaheuristic optimization algorithm (BHO). Our approach eliminates false negatives by employing a novel dynamic fitness function. For training the ensemble framework we used CIC-DDoS2019 dataset. To examine the proposed model’s performance, a testbed is developed using mininet and POX controller and loaded with multiple datasets. Our model outperforms all the recent approaches, achieving a low variance and high classification accuracies of 99.4163% and 99.3591% on CIC-DDoS2019 and CAIDA-2007 datasets respectively.

Identifying legitimate user in DDoS attack using Petri net

The effective construction of systems and that are embedded in an automated or organisational context is a major difficulty in modern research. These systems are built so that customers, manufacturers, users, and better understand of a system and how it can be installed, used, altered, and enhanced with the help of the model. Petri nets are used to represent and investigate discrete systems such as running in parallel, web - based, concurrent, and non-deterministic systems, among others. It has a strong mathematical foundation and also the ability to model in a graphical form. With its significant development and advancements in recent years, network has pervaded every part of our lives. As a result of this process, a growing number of critical network security issues have arisen, including network intrusion issues.The aim of this article is to present an approach to develop and verify a method for modeling of network attacks either at server side or client side. Moreover the goal is to prove that the method enables one to design models resembling the same behaviour of attacks that support the detection process of selected network attacks and facilitate the application of countermeasures. The most common network threat targeting end users and servers are caused by DDoS. The DDoS detection process can be performed either by understanding the properties of attacks or analysing its behavioural models. The proposed approach to modeling of attacks is based on Petri nets. The designed framework is designed detecting DDoS attack at the server side and mitigates the network attacks. The system's major elements are detection and packet classification based on the confidence index value. The CI value helps to detect untrusted network attacks and prioritize the attacks. An algorithm for detecting untrusted network attack is designed and modelled using Petri nets.