Detect Denial Of Service Attacks Research Articles

Model Based Prediction Technique for Denial of Service Attack Detection

Model Based Prediction Technique for Denial of Service Attack Detection

Denial of service attack detection through machine learning for the IoT

ABSTRACT Sustained Internet of Things (IoT) deployment and functioning are heavily reliant on the use of effective data communication protocols. In the IoT landscape, the publish/subscribe-based Message Queuing Telemetry Transport (MQTT) protocol is popular. Cyber security threats against the MQTT protocol are anticipated to increase at par with its increasing use by IoT manufacturers. In particular, IoT is vulnerable to protocol-based Application layer Denial of Service (DoS) attacks, which have been known to cause widespread service disruption in legacy systems. In this paper, we propose an Application layer DoS attack detection framework for the MQTT protocol and test the scheme on legitimate and protocol compliant DoS attack scenarios. To protect the MQTT message brokers from such attacks, we propose a machine learning-based detection framework developed for the MQTT protocol. Through experiments, we demonstrate the impact of such attacks on various MQTT brokers and evaluate the effectiveness of the proposed framework to detect these malicious attacks. The results obtained indicate that the attackers can overwhelm the server resources even when legitimate access was denied to MQTT brokers and resources have been restricted. In addition, the MQTT features we have identified showed high attack detection accuracy. The field size and length-based features drastically reduced the false-positive rates and are suitable in detecting IoT based attacks.

DDOS-attacks detection using an efficient measurement-based statistical mechanism

A monitoring mechanism is vital for detecting malicious attacks against cyber systems. Detecting denial of service (DOS) and distributed DOS (DDOS) is one of the most important security challenges facing network technologies. This paper introduces a reliable detection mechanism based on the continuous ranked probability score (CRPS) statistical metric and exponentially smoothing (ES) scheme for enabling efficient detection of DOS and DDOS attacks. In this regard, the CRPS is used to quantify the dissimilarity between a new observation and the distribution of normal traffic. The ES scheme, which is sensitive in detecting small changes, is applied to CRPS measurements for anomaly detection. Moreover, in CRPS-ES approach, a nonparametric decision threshold computed via kernel density estimation is used to suitably detect anomalies. Tests on three publically available datasets proclaim the efficiency of the proposed mechanism in detecting cyber-attacks.

Voting extreme learning machine based distributed denial of service attack detection in cloud computing

Distributed denial of service attack is one of the most dangerous attacks in cloud computing. This attack makes the cloud services inaccessible to the end-users by exhausting resources, resulting in heavy economic and reputation loss. So, developing defensive solutions against these attacks is necessary for the widespread adoption of cloud computing technology. This paper proposes a new system for detecting DDoS attacks in cloud computing environment. The proposed system is built using voting extreme learning machine (V-ELM), a type of artificial neural network. Experiments were performed to evaluate the performance of the proposed system by using two benchmark datasets viz. NSL-KDD dataset and ISCX intrusion detection dataset. It has been shown by experiments that the proposed system detects attacks with an accuracy of 99.18% with the NSL-KDD dataset and 92.11% with the ISCX dataset. Performance of the proposed system has been compared with other systems based on backpropagation artificial neural network, artificial neural network trained with black hole optimization, extreme learning machine, random forest and, adaboost. It performs better than these systems. Experiments have also been performed to analyze the performance of the proposed system under different parameter values viz. number of ELMs in V-ELM and number of hidden layer neurons in a single ELM.

A statistical class center based triangle area vector method for detection of denial of service attacks

Denial of service (DoS) attack is the menace to private cloud computing environment that denies services provided by cloud servers leading to huge business losses. Efficient DoS attack detection mechanisms are demanded which necessitates the extraction of features for its best performance. The lacuna in the existing feature extraction based detection systems is the sensitiveness of initial cluster center which leads to high false alarm rate and low accuracy. In this paper, this issue is addressed by proposing a class center based triangle area vector (CCTAV) method which computes the mean of target classes individually and extracts the correlation between features. Mahalanobis distance measure is used for profile construction and DoS attacks detection. The proposed CCTAV method is tested with five publicly available datasets and compared with existing methods. It is noticed that the proposed statistical method reduces the complexity of feature extraction and enhances the attack detection process. The proposed approach is evaluated by conducting tenfold cross validation to compute 95% confidence interval. It is evident that the accuracy obtained for all the datasets are within the confidence interval. Further, the proposed CCTAV method provides significant results compared to the state-of-the-art attack detection methods.

DESIGN OF WIRELESS INTRUSION DETECTION SYSTEM FOR DOS ATTACK AND MALICIOUS ACCESS POINT IN WI-FI NETWORKS

The IEEE 802.11 wireless networks are organized either in infrastructure mode or ad-hoc mode. These wireless networks are very common, because of their portability and ease of access. In infrastructure mode of wireless networks, wireless clients have to be aware of the environments due to vulnerability and various types of attacks that can made by wireless intruders. Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA) security protocols are used to protect any wireless infrastructure against wireless intruders. The main problem of wireless network is to maintain the network security. Firewalls are not much capable to secure network from attacks because firewall can only detect the attacks which come from outside of the network. Therefore, Intrusion Detection System (IDS) plays an important role in network security. In general Intrusion Detection System (IDS) is used to detect unauthorized access, malicious access point and various types of wireless attacks in IEEE 802.11 infrastructure mode of wireless networks. Network based Wireless Intrusion Detection system (WIDS) is designed to detect Denial of Service (DOS) attack and Malicious Access Point (Evil Twin Attack) in Wi-Fi networks. Because DOS attack and Evil Twin Attack are the most significant attacks in IEEE 802.11 networks. In this work, a diverse detection algorithm is proposed to detect DOS attack and Evil Twin Attack which is based on number of deauthentication frames and beacon frames and some other fields. In this project, an experimental setup for wireless network infrastructure with one access point (AP) and three or four number of wireless clients are used to design Wireless Intrusion Detection System (WIDS). In that design, one client act as an attacker and another one client act as detector. In this work, Kali Linux based attack software tool is used to register wireless clients to launch attacks on the network. The set of commends are used to configure on the designed infrastructure wireless networks for testing the attacks and solutions

Security challenges in internet of things: Distributed denial of service attack detection using support vector machine‐based expert systems

AbstractThe rapid development of internet of things (IoT) is to be the next generation of the IoT devices are a simple target for attackers due to the lack of security. Attackers can easily hack the IoT devices that can be used to form botnets, which can be used to launch distributed denial of service (DDoS) attack against networks. Botnets are the most dangerous threat to the security systems. Software‐defined networking (SDN) is one of the developing filed, which introduce the capacity of dynamic program to the network. Use the flexibility and multidimensional characteristics of SDN used to prevent DDoS attacks. The DDoS attack is the major attack to the network, which makes the entire network down, so that normal users might not avail the services from the server. In this article, we proposed the DDoS attack detection model based on SDN environment by combining support vector machine classification algorithm is used to collect flow table values in sampling time periods. From the flow table values, the five‐tuple characteristic values extracted and based on it the DDoS attack can be detected. Based on the experimental results, we found the average accuracy rate is 96.23% with a normal amount of traffic flow. Proposed research offers a better DDoS detection rate on SDN.

Machine Learning-Based Distributed Denial of Service Attack Detection on Intrusion Detection System Regarding to Feature Selection

Distributed Service Denial (DDoS) is a type of network attack, which each year increases in volume and intensity. DDoS attacks also form part of the major types of cyber security threats so far. Early detection plays a key role in avoiding the catastrophic effects on server infrastructure from DDoS attacks. Detection techniques in the traditional Intrusion Detection System (IDS) are far from perfect compared to a number of modern techniques and tools used by attackers, because the traditional IDS only uses signature-based detection or anomaly-based detection models and causes a lot of false positive flags, since the flow of computer network data packets has complex properties in terms of both size and source. Based on the deficiency in the ordinary IDS, this study aims to detect DDoS attacks by using machine learning techniques to enhance IDS policy development. According to the experiment the selection of features plays an important role in the precision of the detection results and in the performance of machine learning in classification problems. The combination of seven key selected dataset features used as an input neural network classifier in this study provides the highest accuracy value at 97.76%.

Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN : An Experimental Approach.

The expected advent of the Internet of Things (IoT) has triggered a large demand of embedded devices, which envisions the autonomous interaction of sensors and actuators while offering all sort of smart services. However, these IoT devices are limited in computation, storage, and network capacity, which makes them easy to hack and compromise. To achieve secure development of IoT, it is necessary to engineer scalable security solutions optimized for the IoT ecosystem. To this end, Software Defined Networking (SDN) is a promising paradigm that serves as a pillar in the fifth generation of mobile systems (5G) that could help to detect and mitigate Denial of Service (DoS) and Distributed DoS (DDoS) threats. In this work, we propose to experimentally evaluate an entropy-based solution to detect and mitigate DoS and DDoS attacks in IoT scenarios using a stateful SDN data plane. The obtained results demonstrate for the first time the effectiveness of this technique targeting real IoT data traffic.

ICMPv6-Based DoS and DDoS Attacks Detection Using Machine Learning Techniques, Open Challenges, and Blockchain Applicability: A Review

Although the launch of Internet Protocol version six (IPv6) addressed the issue of IPv4's address depletion, but also mandated the use of Internet Control Message Protocol version six (ICMPv6) messages in newly introduced features such as the Neighbor Discovery Protocol (NDP). This has exacerbated existing network attacks including ICMPv6-based Denial of Service (DoS) attacks and its variant form Distributed Denial of Service (DDoS) attack. Intrusion Detection Systems (IDS) aimed at tackling security issues raised by ICMPv6-based DoS and DDoS attacks have been reviewed by researchers and a general classification of existing IDSs was proposed as anomaly-based and signature-based. However, it is incredibly hard to see the overall picture of IDSs based on Machine Learning (ML) techniques with such a classification, as there is a lack of a more detailed view of the ML approach, classifiers, feature selection techniques, datasets, and different evaluation metrics. Nevertheless, recent developments in this relatively new field have not been covered such as ML-based IDSs using flow-based traffic representation. Therefore, this article specifically reviews and classifies IDSs based on ML techniques to detect ICMPv6-based DoS and DDoS attacks as single and hybrid classifiers. In addition, blockchain applicability in Collaborative IDS (CIDS) architecture based on the ensemble framework has been proposed as a solution to one of the open challenges for ICMPv6-based DoS and DDoS attacks detection problem. Moreover, this review also provides a classification of ICMPv6 vulnerabilities to DoS and DDoS attacks which would provide a reference resource for future researchers in this domain. To the best of the author's knowledge, this is the first review paper specifically focusing on IDSs based on ML techniques in this domain, as well as blockchain applicability as a possible research direction has been proposed to attract researcher's focus on building ensemble learning-based IDS models.

Detection of DoS attacks using machine learning techniques

As the growth of IoT has been further reinforced by the advances, when used with other technologies like embedded systems, hardware and software enhancements, networking devices, but still there are so many threats in IoT that includes security, accuracy, performance, networks, and privacy. With the increased use of smart services, remote access, and frequent changes in networks has raised many security and privacy concerns. Therefore, security threats in IoT are one of the main issues while data transmission. Thus, network challenges and security issues concerning to IoT can be resolved by using machine learning (ML) techniques and algorithms. The current study outlined the security standards for IoT applications to enhance the performance and efficiency of the network and user services. As well as, the study focus is on comparing the Support Vector Machine (SVM) and Decision Trees for the detection of Denial of Service (DoS) attacks.

Detecting DoS Attacks Based on Multi-Features in SDN

Denial of Service (DoS) attack is a serious threat to Software Defined Network (SDN). Although many research efforts have been devoted to identify new features for DoS attack detection, the existing approaches are not able to detect various types of DoS attacks. In SDN, DoS attacks against data plane are mainly organized in two ways: 1) DoS attack with multiple flow entries (M-DoS) to exhaust the Ternary Content-Addressable Memory (TCAM) resource of the switch. 2) DoS attack with a single well-designed entry (S-DoS) to overwhelm the target link and further impact the controller. To detect these two attacks, we propose a new approach by extracting six features of flow table, and using the back propagation (BP) neural network to construct the classifier. Test results of test-bed experiments indicate that the accurate detection probability of proposed approach is 98.9%, which can effectively distinguish M-DoS flows and S-DoS flows without being affected by Flash crowd scene.

Denial of Service Attack Prediction Using Gradient Descent Algorithm

Denial of service (DoS) attack is one of the prevalent security threats in today’s digital world. A significant number of machine learning algorithms have been applied for detection of DoS attacks. However, each algorithm has its own limitations. In general, the success of any machine learning algorithm is based on the selection of appropriate data set and identification of attack parameters. In this paper, a detailed investigation is done in the process of identifying relevant attack parameters from the simple network management protocol data set. The chosen parameters underwent various metrics comparisons for validating their accuracy. We started with the linear regression model and achieved accuracy of 99.7% with 3.3% errors. Hence, to achieve further optimization in the case of error reduction, we applied gradient descent algorithm in the linear regression which reduces errors by 3%. Hence, our proposed measures help in accurate identification of DoS attacks and the same has been verified through the experimental simulations and graphical representation.

Distributed denial of service attack detection using autoencoder and deep neural networks

Distributed denial of service attack detection using autoencoder and deep neural networks

Averaged dependence estimators for DoS attack detection in IoT networks

Wireless sensor networks (WSNs) have evolved to become an integral part of the contemporary Internet of Things (IoT) paradigm. The sensor node activities of both sensing phenomena in their immediate environments and reporting their findings to a centralized base station (BS) have remained a core platform to sustain heterogeneous service-centric applications. However, the adversarial threat to the sensors of the IoT paradigm remains significant. Denial of service (DoS) attacks, comprising a large volume of network packets, targeting a given sensor node(s) of the network, may cripple routine operations and cause catastrophic losses to emergency services. This paper presents an intelligent DoS detection framework comprising modules for data generation, feature ranking and generation, and training and testing. The proposed framework is experimentally tested under actual IoT attack scenarios, and the accuracy of the results is greater than that of traditional classification techniques.

PROLEMus: A Proactive Learning-Based MAC Protocol Against PUEA and SSDF Attacks in Energy Constrained Cognitive Radio Networks

Malicious users can exploit vulnerabilities in cognitive radio networks (CRNs) and cause heavy performance degradation by denial of service (DoS) attacks. During operation, cognitive radios (CRs) spend a considerable amount of time to identify idle (free) channels for transmission. In addition, CRs also need additional security mechanisms to prevent malicious attacks. Proactive model predictive control (MPC)-based medium access control (MAC) protocols for CRs can quicken the idle channel identification by predicting future states of channels in advance. This provides enough time for CRs to carry out other calculations like DoS attack detection. However, such external detection techniques use additional power that makes them inappropriate for energy constrained applications. As a solution, this paper proposes a proactive learning-based MAC protocol (PROLEMus) that shows immunity to two prominent CR-based DoS attacks, namely, primary user emulation attack (PUEA) and spectrum sensing data falsification (SSDF) attack, without any external detection mechanism. PROLEMus shows an average of 6.2%, 8.9%, and 12.4% improvement in channel utilization, backoff rate, and sensing delay, respectively, with low prediction errors (≤1.8%) saving 19.65% energy, when compared to recently proposed MAC protocols like ProMAC aided with additional DoS attack detection mechanism.

Traffic Seasonality aware Threshold Adjustment for Effective Source-side DoS Attack Detection

In order to detect Denial of Service (DoS) attacks, victim-side detection methods are used popularly such as static threshold-based method and machine learning-based method. However, as DoS attacking methods become more sophisticated, these methods reveal some natural disadvantages such as the late detection and the difficulty of tracing back attackers. Recently, in order to mitigate these drawbacks, source-side DoS detection methods have been researched. But, the source-side DoS detection methods have limitations if the volume of attack traffic is relatively very small and it is blended into legitimate traffic. Especially, with the subtle attack traffic, DoS detection methods may suffer from high false positive, considering legitimate traffic as attack traffic. In this paper, we propose an effective source-side DoS detection method with traffic seasonality aware adaptive threshold. The threshold of detecting DoS attack is adjusted adaptively to the fluctuated legitimate traffic in order to detect subtle attack traffic. Moreover, by understanding the seasonality of legitimate traffic, the threshold can be updated more carefully even though subtle attack happens and it helps to achieve low false positive. The extensive evaluation with the real traffic logs presents that the proposed method achieves very high detection rate over 90% with low false positive rate down to 5%.

The Slow HTTP Distributed Denial of Service Attack Detection in Cloud

Cloud computing became popular due to nature as it provides the flexibility to add or remove the resources on-demand basis. This also reduces the cost of investments for the enterprises significantly. The adoption of cloud computing is very high for enterprises running their online applications. The availability of online services is critical for businesses like financial services, e-commerce applications, etc. Though cloud provides availability, still these applications are having potential threats of going down due to the slow HTTP Distributed Denial of Service (DDoS) attack in the cloud. The slow HTTP attacks intention is to consume all the available server resources and make it unavailable to the real users. The slow HTTP DDoS attack comes with different formats such as slow HTTP headers attacks, slow HTTP body attacks and slow HTTP read attacks. Detecting the slow HTTP DDoS attacks in the cloud is very crucial to safeguard online cloud applications. This is a very interesting and challenging topic in DDoS as it mimics the slow network. This paper proposed a novel method to detect slow HTTP DDoS attacks in the cloud. The solution is implemented using the OpenStack cloud platform. The experiments conducted exhibits the accurate results on detecting the attacks at the early stages. The slowHTTPTest open source tool is used in this experiment to originate slow HTTP DDoS attacks.

Deep Radial Intelligence with Cumulative Incarnation approach for detecting Denial of Service attacks

Nowadays Denial of Service (DoS) attack is one of the security threats that make the online services unavailable for legitimate users. Therefore, a DoS attack detection system is needed to protect online services against malicious activities. Machine learning approaches are widely used to detect cyber-attacks. The lacunae in the existing machine learning based attack detection systems are more learning time due to vanishing gradient and getting stuck in the local minima due to selection of random weights. In this paper, these issues have been addressed and Deep Radial Intelligence (DeeRaI) with Cumulative Incarnation (CuI) approach is proposed to detect the DoS attacks. The proposed DeeRaI approach learns the intelligence extracted from the radial basis function with different levels of abstraction. The proposed CuI optimizes the weights of the DeeRaI network in which the knowledge gained is progressed to the next generation. Experiments were conducted on benchmark datasets and the proposed approach is compared with existing classifiers and state-of-the-art attack detection systems. It is seen from the performance evaluation that the proposed approach gives promising results than the other existing approaches. Further, it is evident that the proposed approach converges faster and provides best weights compared to the existing optimization methods.

DoS Attack Detection and Path Collision Localization in NoC-Based MPSoC Architectures

Denial of Service (DoS) attacks are an increasing threat for Multiprocessor System-on-Chip (MPSoC) architectures. By exploiting the shared resources on the chip, an attacker is able to prevent completion or degrade the performance of a task. This is extremely dangerous for MPSoCs used in critical applications. The Network-on-Chip (NoC), as a central MPSoC infrastructure, is exposed to this attack. In order to maintain communication availability, NoCs should be enhanced with an effective and precise attack detection mechanism that allows the triggering of effective attack mitigation mechanisms. Previous research works demonstrate DoS attacks on NoCs and propose detection methods being implemented in NoC routers. These countermeasures typically led to a significantly increased router complexity and to a high degradation of the MPSoC’s performance. To this end, we present two contributions. First, we provide an analysis of information that helps to narrow down the location of the attacker in the MPSoC, achieving up to a 69% search space reduction for locating the attacker. Second, we propose a low cost mechanism for detecting the location and direction of the interference, by enhancing the communication packet structure and placing communication degradation monitors in the NoC routers. Our experiments show that our NoC router architecture detects single-source DoS attacks and determines, with high precision, the location and direction of the collision, while incurring a low area and power overhead.