Distributed Denial Of Service Detection Research Articles

A novel Distributed Denial of Service attack defense scheme for Software-Defined Networking using Packet-In message and frequency domain analysis

Software-Defined Networking (SDN) enhances network management by improving adaptability, flexibility, and scalability. However, its centralized controller is vulnerable to Distributed Denial of Service (DDoS) attacks that can disrupt network availability. This study introduces a novel real-time DDoS detection scheme integrated into the SDN controller. The scheme uses a two-step process to analyze Packet-In messages in both time and frequency domains. A time-series is generated by sampling the number of Packet-In messages at specific time intervals, which is compared against a predefined threshold. If exceeded, frequency domain analysis is applied to extract features, which are then used by Machine Learning (ML) algorithms to identify DDoS attacks. The scheme achieves 99.85% accuracy in distinguishing normal traffic from attack traffic, demonstrating its effectiveness in safeguarding SDN environments from DDoS threats.

Implementasi Sistem Manajemen Log untuk Penanggulangan Serangan Server dengan SIEM

In the current digital era, information security has become a primary focus for organizationsworldwide. Rapid technological advancements have brought significant benefits but alsointroduced increasingly sophisticated cyber threats and attacks. One approach to addressing thesechallenges is through Security Information and Event Management (SIEM). SIEM integratesSecurity Information Management (SIM) and Security Event Management (SEM) to collect,analyze, and report security data from various network sources, enabling more effective detection,response, and management of security incidents. This study focuses on handling server attacksusing Wazuh SIEM as an early warning system. The methodology involves setting up a networktopology to detect Distributed Denial of Service (DDoS) attacks using SIEM, collecting andanalyzing log data, correlating data to identify threats, and responding to detected threats. Theresults indicate that SIEM is crucial in modern cybersecurity, providing real-time threat detectionand response capabilities. The system successfully detected and blocked 42 attacks during thetrial. In conclusion, SIEM offers greater security visibility and control, enabling organizations todetect and respond to complex security threats efficiently and effectively. Modern SIEM systems,equipped with advanced analytics and machine learning, can identify anomaly patterns and newthreats, thus strengthening an organization's cybersecurity defenses.

Distributed Denial of Service Attack Detection and Prevention Using Pipit Fox-Attentional Deep Learning in Software-Defined Networking

The Software-Defined Network (SDN) remains the innovative model that assists in satisfying the new application requirements of future networks. However, destructive attacks, particularly Distributed Denial of Service (DDoS) attacks, are aimed primarily at the SDN control panel, presenting a significant risk to network security. The traditional approaches for DDoS attack detection exhibit several limitations including interpretability challenges, overfitting problems, and false predictions. To mitigate these drawbacks, the research proposed a Pipit Flying Fox Optimized Deep Neural Network (PPF-DNN) and Intelligent Pipit Forage Optimized-Attentional Convolutional Neural Network (IPFO-ACNN) model. The channel attention is employed to enable the network to focus selectively on relevant information, improving the model’s sensitivity to subtle anomalies associated with DDoS attacks. By dynamically adjusting the attention weights across channels, the mechanism enhances the capability of the model to discriminate the normal network traffic and malicious patterns, which results in improved precision and reduced false positives. This approach harnesses the power of CNN to automatically extract hierarchical features from network data, enhancing the efficacy of the ACNN model in attack detection. IPFO and PPF algorithms integrate the unique strengths of bio-inspired algorithms, creating a synergistic approach for efficient model parameter tuning. In the case of Training Percentage (TP) 80, the accuracy, sensitivity, and specificity of the IPFO-ACNN model are evaluated as 98.87%, 99.24% and 97.91%, respectively. Similarly, the PPF-DNN model’s performance is assessed as 98.49%, 92.50% and 98.55%, which presents a promising avenue for bolstering network security infrastructure, ensuring more robust DDoS detection and mitigation capabilities in an increasingly complex cyber threat landscape.

DDoS Attack Detection with Machine Learning

Nowadays, Distributed Denial of Service (DDoS) attacks are a major issue in internet security. These attacks target servers or network infrastructure. Similar to an unanticipated traffic jam on highway (lagging/crash) that prevent normal traffic reach to destination. DDoS may prevent users to access any system services. Researchers and scientists have developed numerous methods and algorithms to improve the performance of DDoS detection. In this paper, a DDoS detection method utilizing machine learning is proposed. There are three type of supervised machine learning classification methods which are K-Nearest Neighbor, Multilayer Perceptron and Random Forest, are applied in the proposed work to assess the accuracy of the model in training and testing processes. RF classification provides robustness and interpretability, MLP offers deep learning capabilities for complex patterns, and K-NN delivers simplicity and adaptability for instance-based learning. Together, these methods can contribute to a comprehensive DDoS attack detection system using machine learning. There are two types of classification setups: binary and multi-class classification. Binary classification involves identifying traffic as either a DDoS attack or normal using the NSL-KDD dataset. Multi-class classification, on the other hand, distinguishes between various types of DDoS attacks (such as DoS, Probe, U2R, and Sybil) and normal traffic using the NSL-KDD dataset. Feature engineering is also involved in this experiment to convert the categorical features into numerical values for detecting DDoS attack. Our model's performance was effective compared to other machine learning methods. RF achieved the highest accuracy rates: 99.35% in binary classification and 97.71% in multi-class classification. K-NN followed with 99.15% in binary and 97.35% in multi-class classification, while MLP achieved 90.63% in binary and 84.33% in multi-class classification.

Innovative Machine Learning Strategies for DDoS Detection: A Review

This is a broad survey that investigates the use of machine learning (ML) methods for detecting distributed denial of service (DDoS) attacks. Traditional intrusion detection systems face difficulties in application-layer DDoS attacks because they target legal web traffic forms using standard transmission control protocol connections. This paper reviews different ML methods used in recent studies to tackle these issues. These studies use various data sets, such as UNSW-np-15, CICDDoS2019, and the novel dataset LATAM-DDoS-Internet of Things., which prove the efficacy of the proposed models in terms of accuracy and performance metrics. The second group of studies shows more advanced designs, such as protocol-based deep intrusion detection and autoencoder-multi-layer perceptron. These use deep learning to find features and group attacks. All of these approaches present favorable outcomes when it comes to distinguishing normal, DoS, and DDoS traffic with a high level of accuracy. Furthermore, the review discusses works that emphasize the early detection of noise-robust models and distributed frameworks. Different techniques, such as snake optimizer with ensemble learning, metastability theory, and spark-based anomaly detection, highlight the trend of predicting DDoS attacks, whereas hyperband-tuned deep neural networks and evolutionary support vector machine models show higher accuracy in cloud systems as well as software-defined networking environments. Hence, this review gives a general observation of how DDoS attacks develop on their way and proves that ML techniques help to strengthen network security.

A Survey of AI Methods for Detection of DDoS Attacks on Networks

This survey explores various artificial intelligence (AI) methods for detecting Distributed Denial of Service (DDoS) attacks on networks. It classifies these approaches into machine learning, deep learning, and other AI-based techniques, providing a comprehensive overview of current advancements in the field. Numerous research studies in the field of machine learning have evaluated DDoS attack detection performance using various datasets and techniques. Some noteworthy results are the supremacy of the J48 algorithm in SDN networks and the efficacy of the AdaBoost and Gradient Boost classifiers. In other investigations, Random Forest, Support Vector Machine, and Naive Bayes also showed excellent accuracy rates, up to 99.7%. To improve DDoS detection, deep learning techniques introduced autoencoders, hybrid models, and recurrent neural networks. These models achieved accuracy rates as high as 99.99%, frequently outperforming more conventional machine learning techniques. Enhanced detection rates were achieved by the utilization of a varied dataset in conjunction with deep-stacked autoencoders. Artificial intelligence methods such as Fuzzy Logic, Artificial Bee Colony, Ant Colony Optimization, and Whale Optimization Algorithm were used to identify DDoS assaults. These methods demonstrated high accuracy rates, efficient detection of various attack types, and improvements in reducing false positives; the integration of these techniques into intrusion detection systems offers a strong defense against dynamic DDoS threats. The overall survey highlights the effectiveness of AI techniques in DDoS attack detection across various methodologies.

A Hybrid Approach for Efficient DDoS Detection in Network Traffic Using CBLOF-Based Feature Engineering and XGBoost

This is one of the greatest challenges in computer network security and cannot be dealt with without a set of most recent detection techniques. This paper lays down a new hybrid technique that combines Clustering-Based Local Outlier Factor (CBLOF) and Extreme Gradient Boosting (XGBoost) to enhance accuracy while detecting Distributed Denial of Service (DDoS) from network traffic. The proposed hybrid model utilizes a CBLOF for outlier detection as feature engineering. Over the detected anomalies, classification is to be done using XGBoost classification to attain the objective. The proposed hybrid model was tested extensively on CICIDS 2017 and CICIDS 2018 datasets Compared with traditional ones, the proposed model outperformed the traditional ones with an accuracy rate of 99.99%, precision of 100%, and F1 score reflecting perfection. These results confirm this model's efficiency in terms of known and novel attack patterns and introduce a further reliable framework for the timely detection of DDoS attacks. Even if it is computation-heavy, optimization could be made towards real-time large-scale data.

Detecting Distributed Denial-of-Service (DDoS) Attacks Through the Log Consolidation Processing (LCP) Framework

One major problem commonly faced by organizations is a network attack especially if the network is vulnerable due to poor security policies. Network security is vital in protecting not only the infrastructure but most importantly, the data that moves around the network and is stored within the organization. Ensuring a secure network requires a complex combination of hardware including both network and security devices, specialized applications such as web filtering and log management, and a group of well-trained network administrators and highly skilled analysts. This paper aims to present an alternative to the current log management solution. A hindrance to the current log management solution is the difficulty in amalgamating and correlating a vast number of logs with different formats and variables. This paper uses a novel framework called Log Consolidation Processing (LCP) based on the System Information Event Management (SIEM) technology, to monitor the behavior and the fitness of a network. LCP provides a flexible and complete solution to collect, correlate, and analyze logs from multiple devices as well as applications. An experiment testing the effectiveness of LCP in detecting DDoS attacks in a campus network environment was conducted, demonstrating a highly successful rate of detection. Besides threat detection and avoidance through log monitoring and analysis, other benefits of implementing the LCP framework are also included. This paper concludes by mentioning suggested enhancements for the LCP framework.

A REVIEW OF MACHINE LEARNING AND FEATURE SELECTION TECHNIQUES FOR CYBERSECURITY ATTACK DETECTION WITH A FOCUS ON DDOS ATTACKS

This study provides a systematic review of machine learning (ML) techniques applied in intrusion detection systems (IDS), with a particular focus on Random Forest (RF), Support Vector Machine (SVM), and Decision Tree (DT). Following the PRISMA guidelines, a comprehensive search of relevant databases identified 205 articles, from which 68 were selected for detailed analysis. The findings highlight that RF consistently outperforms other models, achieving accuracy rates as high as 99.72% in detecting Distributed Denial of Service (DDoS) attacks due to its ensemble learning approach. SVM, while effective in specific scenarios with binary classification tasks, struggles with scalability and high-dimensional datasets, though feature selection significantly improves its performance. DT models, known for their simplicity and interpretability, are prone to overfitting, but this issue is mitigated when combined with feature selection techniques. The study further emphasizes the importance of feature selection in enhancing IDS accuracy and efficiency across various models. Additionally, ensemble and hybrid methods, which combine multiple ML techniques, offer promising improvements in detection accuracy and real-time performance. These findings underscore the potential of machine learning, particularly through the use of ensemble and hybrid approaches, to significantly improve cybersecurity measures in modern networks.

DBSCAN SMOTE LSTM: Effective Strategies for Distributed Denial of Service Detection in Imbalanced Network Environments

In detecting Distributed Denial of Service (DDoS), deep learning faces challenges and difficulties such as high computational demands, long training times, and complex model interpretation. This research focuses on overcoming these challenges by proposing an effective strategy for detecting DDoS attacks in imbalanced network environments. This research employed DBSCAN and SMOTE to increase the class distribution of the dataset by allowing models using LSTM to learn time anomalies effectively when DDoS attacks occur. The experiments carried out revealed significant improvement in the performance of the LSTM model when integrated with DBSCAN and SMOTE. These include validation loss results of 0.048 for LSTM DBSCAN and SMOTE and 0.1943 for LSTM without DBSCAN and SMOTE, with accuracy of 99.50 and 97.50. Apart from that, there was an increase in the F1 score from 93.4% to 98.3%. This research proved that DBSCAN and SMOTE can be used as an effective strategy to improve model performance in detecting DDoS attacks on heterogeneous networks, as well as increasing model robustness and reliability.

Retraction Note: Detecting distributed denial of service (DDoS) in SD-IoT environment with enhanced firefly algorithm and convolution neural network

Retraction Note: Detecting distributed denial of service (DDoS) in SD-IoT environment with enhanced firefly algorithm and convolution neural network

Developing information technology for evaluating and enhancing application-layer DDoS attack detection methods

The subject matter of this article is the methods to detect distributed denial-of-service (DDoS) attacks at the Hypertext Transfer Protocol (HTTP) level with the purpose of justifying the requirements for creating software capable of identifying malicious web server clients. The goal of this article is to develop an information technology to evaluate the efficiency of DDoS attack detection methods, which will quantify their operating time, memory consumption, and approximate classification accuracy. In addition, this paper proposes hypotheses and a potential approach to improve existing application-layer DDoS attack detection methods with the intention of increasing their accuracy and identification speed. The tasks of this study are as follows: to analyse modern methods for detecting application-layer DDoS attacks; to investigate their features and short­comings; to develop a software system to assess DDoS attack detection methods; to programmatically implement these methods and experimentally measure their performance indicators, specifically: classification ac­curacy, operating time, and memory usage; to compare the efficiency of the investigated methods; to formulate hypotheses and propose an approach to improve existing methods and/or develop new methods based on the results obtained. The methods employed are abstraction, analysis, systematic approach, and empirical research. In particular, the datasets generated by DDoS utilities were processed using the synthetic minority oversampling technique (SMOTE) to balance them. Furthermore, the studied DDoS attack detection methods were implemented, including fitting the required parameters and training artificial neural network models for evaluation. The following results were obtained. The average classification accuracy, operating time, and random-access memory (RAM) consumption during Internet traffic classification were determined for six DDoS attack detection methods under the same conditions. This study has demonstrated that the development of a novel method to detect DDoS attacks at the HTTP level with enhanced accuracy and classification speed is strongly required. The experimental results demonstrate that the time series-based method exhibited the shortest operating time (1.33 ms for 5000 vectors), whereas the deep neural network-based method exhibited the highest average classification accuracy (ranging from 99.07% to 99.97%) and the lowest memory consumption (39.09 KB for 5000 vectors). Conclusions. In this study, a software system was developed to assess the average accuracy of DDoS attack classification methods and measure the computational resources utilized. The scientific novelty of the obtained results lies in the formulation of two hypotheses and a potential approach to the creation of a novel method for detecting DDoS attacks at the HTTP level, which will have both high classification accuracy and a short operating time to surpass previously studied analogues in these respects. The first hypothesis is based on the additional usage of HTTP request attributes during Internet traffic classification. The second hypothesis is to analyse a graph of user transitions between website pages. The article also superficially describes a potential approach that involves the implementation of the described hypotheses as well as the proposed software architecture of an application-layer DDoS attack detection system for the Kubernetes platform and the Istio framework, which addresses the issue of collecting web request parameter values for websites that use the cryptographically secured HTTPS protocol.

Beyond signatures and thresholds: Intelligent DDoS detection using Convolutional Neural Networks

Distributed Denial of Service (DDoS) attacks have evolved into sophisticated threats against digital infrastructure. This research investigates Convolutional Neural Networks (CNNs) for DDoS detection using the CIC-IDS2017 dataset. A CNN model was developed, leveraging convolutional and pooling layers for hierarchical feature extraction. Preprocessing ensured dataset consistency and generalization. The model achieved 99.978% test accuracy, demonstrating proficiency in recognizing DDoS patterns. Comparatively, a Deep Neural Network (DNN) benchmark obtained 99.9512% accuracy, indicating CNNs superiority. However, CNN training time was longer. While results highlight deep learning's potential against DDoS attacks, optimizations for real-time deployment warrant exploration. This empirical evaluation and comparative analysis enriches the discourse on utilizing machine learning for robust cybersecurity.

DDoS detection in electric vehicle charging stations: A deep learning perspective via CICEV2023 dataset

Distributed Denial of Service (DDoS) attacks have always been an important research topic in the field of information security. Regarding specialized infrastructures such as electric vehicle charging stations, detecting and preventing such attacks becomes even more critical. In the existing literature, most studies on DDoS attack detection focus on traditional methods that analyze network metrics such as network traffic, packet rates, and number of connections. These approaches attempt to detect attacks by identifying anomalies and irregularities in the network, but can have high error rates and fail to identify advanced attacks. Conversely though, detection methods based on system metrics use deeper and more insightful parameters such as processor utilization, memory usage, disk I/O operations, and system behavior. Such metrics provide a more detailed perspective than network-based approaches, allowing for more accurate detection of attacks. However, work in this area is not yet widespread enough further research and improvement are needed. The adoption of advanced system metrics-based methods can significantly improve the effectiveness of DDoS defense strategies, especially in next-generation and specialized infrastructures. This paper evaluates the applicability and effectiveness of Long Short-Term Memory (LSTM) and Feed-Forward Network (FFN) in detecting DDoS attacks against electric vehicle charging stations through system metrics using CICEV2023 dataset. Experimental results show that the LSTM based model offers advantages in terms of speed and processing capacity, while the FFN is superior in terms of the accuracy.

HybGBS: A hybrid neural network and grey wolf optimizer for intrusion detection in a cloud computing environment

SummaryThe cloud computing environment is subject to unprecedented cyber‐attacks as its infrastructure and protocols may contain vulnerabilities and bugs. Among these, Distributed Denial of Service (DDoS) is chosen by most cyber extortionists, creating unusual traffic that drains cloud resources, making them inaccessible to customers and end users. Hence, security solutions to combat this attack are in high demand. The existing DDoS detection techniques in literature have many drawbacks, such as overfitting, delay in detection, low detection accuracy for attacks that target multiple victims, and high False Positive Rate (FPR). In this proposed study, an Artificial Neural Network (ANN) based hybrid GBS (Grey Wolf Optimizer (GWO) + Back Propagation Network (BPN) + Self Organizing Map (SOM)) Intrusion Detection System (IDS) is proposed for intrusion detection in the cloud computing environment. The base classifier, BPN, was chosen for our research after evaluating the performance of a comprehensive set of neural network algorithms on the standard benchmark UNSW‐NS 15 dataset. BPN intrusion detection performance is further enhanced by combining it with SOM and GWO. Hybrid Feature Selection (FS) is made using a correlation‐based approach and Stratified 10‐fold cross‐validation (STCV) ranking based on Weight matrix value (W). These selected features are further fine‐tuned using metaheuristic GWO hyperparameter tuning based on a fitness function. The proposed IDS technique is validated using the standard benchmark UNSW‐NS 15 dataset, which consists of 1,75,341 and 82,332 attack cases in the training and testing datasets. This study's findings demonstrate that the proposed ANN‐based hybrid GBS IDS model outperforms other existing IDS models with a higher intrusion detection accuracy of 99.40%, fewer false alarms (0.00389), less error rate (0.001), and faster prediction time (0.29 ns).

Eye-Net: A Low-Complexity Distributed Denial of Service Attack-Detection System Based on Multilayer Perceptron

Distributed Denial of Service (DDoS) attacks disrupt service availability, leading to significant financial setbacks for individuals and businesses. This paper introduces Eye-Net, a deep learning-based system optimized for DDoS attack detection that combines feature selection, balancing methods, Multilayer Perceptron (MLP), and quantization-aware training (QAT) techniques. An Analysis of Variance (ANOVA) algorithm is initially applied to the dataset to identify the most distinctive features. Subsequently, the Synthetic Minority Oversampling Technique (SMOTE) balances the dataset by augmenting samples for under-represented classes. Two distinct MLP models are developed: one for the binary classification of flow packets as regular or DDoS traffic and another for identifying six specific DDoS attack types. We store MLP model weights at 8-bit precision by incorporating the quantization-aware training technique. This adjustment slashes memory use by a factor of four and reduces computational cost similarly, making Eye-Net suitable for Internet of Things (IoT) devices. Both models are rigorously trained and assessed using the CICDDoS2019 dataset. Test results reveal that Eye-Net excels, surpassing contemporary DDoS detection techniques in accuracy, recall, precision, and F1 Score. The multiclass model achieves an impressive accuracy of 96.47% with an error rate of 8.78%, while the binary model showcases an outstanding 99.99% accuracy, maintaining a negligible error rate of 0.02%.

Towards Resource-Efficient DDoS Detection in IoT: Leveraging Feature Engineering of System and Network Usage Metrics

The Internet of Things (IoT) is omnipresent, exposing a large number of devices that often lack security controls to the public Internet. In the modern world, many everyday processes depend on these devices, and their service outage could lead to catastrophic consequences. There are many Deep Packet Inspection (DPI) based intrusion detection systems (IDS). However, their linear computational complexity induced by the event-driven nature poses a power-demanding obstacle in resource-constrained IoT environments. In this paper, we shift away from the traditional IDS as we introduce a novel and lightweight framework, relying on a time-driven algorithm to detect Distributed Denial of Service (DDoS) attacks by employing Machine Learning (ML) algorithms leveraging the newly engineered features containing system and network utilization information. These features are periodically generated, and there are only ten of them, resulting in a low and constant algorithmic complexity. Moreover, we leverage IoT-specific patterns to detect malicious traffic as we argue that each Denial of Service (DoS) attack leaves a unique fingerprint in the proposed set of features. We construct a dataset by launching some of the most prevalent DoS attacks against an IoT device, and we demonstrate the effectiveness of our approach with high accuracy. The results show that standalone IoT devices can detect and classify DoS and, therefore, arguably, DDoS attacks against them at a low computational cost with a deterministic delay.

A Machine Learning Based Approach for the Detection of DDoS Attacks on Internet of Things Using CICDDoS2019 Dataset - PortMap

In today's technological era, the Internet has become ubiquitous, playing a vital role in our daily lives. With the exponential growth of IoT innovation, millions of interconnected IoT-enabled devices rely on cloud services to communicate over the Internet. However, this rapid development also exposes these devices to various threats, with DDoS (Distributed Denial of Service) and DoS (Denial of Service) attacks being particularly potent and destructive. DDoS attacks present a unique challenge as they are extremely difficult to detect using conventional intrusion detection frameworks and traditional methodologies. Fortunately, advancements in machine learning have provided a promising solution by enabling accurate differentiation between DDoS attacks and other forms of data. This study proposes a DDoS detection model based on machine learning algorithms. To conduct this study, we utilized the most recent and freely available online dataset called CICDDoS2019. Various machine learning-based techniques were explored, aiming to identify the characteristics associated with accurate classification. Among the algorithms tested, AdaBoost and XGBoost demonstrated exceptional performance. As part of future work, a hybrid approach will be incorporated into this model, further improving its capabilities. It is worth noting that this model will be continuously updated with new data on DDoS attacks, ensuring its relevance and effectiveness in combating emerging threats. By leveraging machine learning techniques, this approach enhances the detection of DDoS attacks on Internet of Things networks, safeguarding the integrity and security of connected devices and the overall IoT ecosystem.

Review on DDoS Attack in Controller Environment of Software Defined Network

Distributed Denial of Service (DDoS) attacks pose a significant threat to the security and availability of networks. With the increasing adoption of Software-Defined Networking (SDN) and its multi-controller architectures, there is a need to explore effective DDoS attack detection mechanisms tailored to these environments. An overview of the current research on detecting DDoS attacks in SDN environments, with a focus on different detection techniques, methodologies and problems is presented in this survey paper. The survey attempt to identify the limitations and strengths of current approaches and propose potential research directions for improving DDoS detection in this context.

Detecting Distributed Denial-of-Service (DDoS) attacks that generate false authentications on Electric Vehicle (EV) charging infrastructure

In recent years, smart grid-based Electric Vehicle (EV) charging systems have increasingly faced vulnerabilities to Distributed Denial of Service (DDoS) attacks, especially through malicious authentication failures. These attacks typically involve monopolizing the Grid Server (GS), thereby hindering the authentication process for legitimate EVs. Despite the severity of this issue, no research (to the best of our knowledge) has focused on detecting DDoS attacks exploiting weaknesses in EV authentication. This study introduces a DDoS attack detection model specifically designed for EV authentication. The approach involves developing a machine learning model involving unique feature selection and combination. The proposed approach has been evaluated using a new DDOS attack dataset. The model is engineered to optimize feature combination, aiming for high sampling resolution, minimal information loss, and robust performance under 16 distinct attack scenarios. The feature combination used in this study shows improved accuracy over traditional DDoS detection methods based on access time variation while minimizing information loss.