Distributed Denial Of Service Detection Research Articles

XGBoost Classifier for DDOS Attack Detection in Software Defined Network Using sFlow Protocol

From a security perspective, Software Defined Network (SDN) separates security concerns into Control Plane and Data Plane. The Control Plane is responsible for managing the entire network centrally. Centralized SDN generates high vulnerability against the Distributed Denial of Service (DDOS). When the Software Defined Network overwhelms by DDOS, both Control Plane and Data Plane will lack resources. It can cause the SDN to fail to work if not detected early. Using the ability of sFlow Protocol to capture the flow traffic in real time, the data could be used to detect DDOS attacks. This sFlow sampling approach can reduce the workload of the network by lower down the processing in switches. This paper uses Extreme Gradient Boosting (XGBoost), Support Vector Machine (SVM), and Random Forest as detection methods. We use ONOS as SDN Controller and build the topology in GNS3. Prometheus retrieves data from the sFlow Collector as a time series database. The classifier then uses the data from Prometheus for DDOS detection. For the dataset, we use four different datasets. Datasets 1 and 2 consist of 6109 data, each divided into two classes and three classes. Datasets 3 and 4 consist of 400488 data divided into 2 and 3 classes, respectively. The evaluation results have proved the effectiveness of the proposed method. XGBoost has the highest accuracy of another algorithm. The best accuracy is 99.84% using Dataset 4 as the training set.

A Transfer Double Deep Q Network Based DDoS Detection Method for Internet of Vehicles

Distributed denial of service (DDoS) attacks have become one of the main factors restricting the development of internet of vehicles (IoV). Although some intelligent reinforcement learning based methods have been introduced to mitigate DDoS attacks, there are still many constraints in the training process, such as the long training time and dependence on large labeled data. In this paper, we propose a transfer double deep Q-network (DDQN) based DDoS detection method for IoV. By constructing a Kalman filter based reinforcement learning model, we can constantly improve the performance of DDoS detection in DDQN without depending on large labeled data. Furthermore, by utilizing the knowledge obtained by adjacent similar base stations, we design a transfer DDQN method based on traffic flow similarity to speed up the training of DDQN for a newly added base station. This enables the new base station to obtain DDoS detection policies quickly. We compare our proposed method with other popular machine learning based DDoS detection methods. The experimental results show that the transfer DDQN based DDoS detection method improves F1-measure and detection accuracy by 79.4% and 17.5% on average. Meanwhile, by means of traffic flow similarity based transfer learning, the time consumption and convergence time can be reduced by 41.3% and 31.1%, which makes our method adapt to the dynamic network.

Attack Detection and Prediction Using Machine Learning

Data plane and control plane are divided by Software Defined Networking (SDN). A centralized controller oversees and manages the entire network. With SDN, the network may be programmed and flow regulations can be created dynamically. Numerous benefits including adaptability, programmability, and centralized management are offered by this decoupling. However, SDN also creates new vulnerabilities as a result of desired data plane and control plane connectivity. Attacks on switch buffer overflows and control plane saturation are two examples of threats that exploit such flaws. The controller is vulnerable to Distributed Denial of Service (DDoS) attacks, which induce resource exhaustion and impair the controller's capacity to provide services. By flooding the control plane with TCP SYN packets from the data plane (i.e., switches), several attacks can be launched. SVM is the most popular and often used classifier, both for classification and regression, thanks to its high accuracy and low false positive rate. For DDoS detection, the SVM classifier is examined and contrasted with other classifiers. In order to identify anomalies, such as malicious traffic, and report them, Snort, an intrusion detection system, examines the traffic and packets. The entropy approach is used to assess the flow data's randomness. An IP address for the intended recipient and a few TCP flag attributes make up the entropy information. We implement it as an additional module in the Floodlight Controller and assess its viability and efficacy. We thoroughly evaluate how we have implemented things via Mininet, substantial emulation.

Using Machine Learning in Software Defined Networks to Recognize and Avoid DDOS Attacks

Abstract: In recent years, Distributed Denial of Service (DDoS) attacks have become a significant concern for network administrators and internet service providers. DDoS attacks are designed to overwhelm a target network with a flood of traffic, causing it to crash or become unavailable. These attacks can have severe consequences, including financial losses, reputational damage, and disruption of critical services. In response to this growing threat, researchers have been exploring various techniques to detect and mitigate DDoS attacks. One promising approach is to use machine learning (ML) algorithms in software-defined networks (SDN). SDN provides a centralized control plane that enables fine-grained control over network traffic, making it an ideal platform for deploying ML-based DDoS detection and mitigation techniques. This paper discusses the use of ML in SDN to recognize and avoid DDoS attacks, providing an overview of the key concepts, techniques, and challenges involved in this emerging field. Six ML algorithms were assessed, viz. Logistic Regression (LR), Naive Bayes (NB), K-Nearest Neighbor (KNN), Support Vector Machine (SVM), Decision Tree (DT), and Random Forest (RF). The inspection showed that KNN, DT and RF is the best appearing ML algorithm. Results showed that our model is able to recognize attacks precisely and rapidly.

RETRACTED ARTICLE: Detecting distributed denial of service (DDoS) in SD-IoT environment with enhanced firefly algorithm and convolution neural network

The Internet of Things (IoT) devices have become part of today’s human life and the amplified use of smart phones as well as number of IoT devices in everyday life has made network security more important. These IoT devices are less secure and often abandoned making them a easy target of DDoS attacks which caused by extreme network packet flow threaten vital network services. The DoS is a single-server attack in which the DDoS is a multi-server attack and IoT devices are managed through Software-defined networks (SDN). This research is proposed to improve the Firefly method in optimizing the Convolution neural network (CNN) for detecting DDoS attacks in Software Defined-IoT (SD-IoT). The suggested SD-IoT framework has been structured into three layers, namely application layer, control layer and user infrastructure layer. The SDN-IoT architecture layer model, Security apps identify DDoS attack in Application layer C-DAD attack detection. The second layer manages the SD-IoT network with the SDNWISE controller and the IoT controller. The infrastructure layer contains SOFS (Sensor Open Flow Switch) and IoT devices. However, this proposal has considered each firefly as a single hyperparameter and by updating the position of firefly periodically results in the reduction of the search iteration. Hence, the proposed model is evaluated by Root mean square and used for measuring the training accuracy of the proposed model. DDoS attacks use a backtracking technique to pinpoint the source, which increases response time. Four CNN models by varying layers and parameters has implemented to improve DDoS detection yielded results with 98% accuracy.

Real-Time DDoS Defense in 5G-Enabled IoT: A Multidomain Collaboration Perspective

While 5G networks have accelerated the development of the Internet of Things (IoT), they have also introduced a large number of vulnerable IoT devices into the network, which would lead to severe Distributed Denial-of-Service (DDoS) attacks. The newly emerging DDoS attack methods generally have a shorter duration, which imposes higher requirements for the response time of DDoS mitigation technologies. Existing DDoS defense methods cannot achieve real-time detection due to the difficulty of reducing the delay of feature extraction and large-scale data processing. In this article, we focus on the timeliness of DDoS detection and mitigation. We hope that deploying effective defense countermeasures at the source side will block the majority of DDoS attack traffic in real time before it enters the data network (DN). To this end, we propose a real-time DDoS defense framework based on multidomain collaboration that combines multisource information to detect attack sessions with high accuracy in 5G networks. To operate the framework at line rate, we propose an optimal packet sampling strategy based on the accurate session size estimation, which can greatly reduce the detection overhead while ensuring good accuracy. In a typical scenario with an attack session size larger than 10, this method can achieve a 99% detection rate while reducing the packet inspection rate (PIR) to less than 37%.

Comparison of ML/DL Approaches for Detecting DDoS Attacks in SDN

Software-defined networking (SDN) presents novel security and privacy risks, including distributed denial-of-service (DDoS) attacks. In response to these threats, machine learning (ML) and deep learning (DL) have emerged as effective approaches for quickly identifying and mitigating anomalies. To this end, this research employs various classification methods, including support vector machines (SVMs), K-nearest neighbors (KNNs), decision trees (DTs), multiple layer perceptron (MLP), and convolutional neural networks (CNNs), and compares their performance. CNN exhibits the highest train accuracy at 97.808%, yet the lowest prediction accuracy at 90.08%. In contrast, SVM demonstrates the highest prediction accuracy of 95.5%. As such, an SVM-based DDoS detection model shows superior performance. This comparative analysis offers a valuable insight into the development of efficient and accurate techniques for detecting DDoS attacks in SDN environments with less complexity and time.

Analysis of Various Distributed Denial of Service Networks Attacks Detection and Prevention Techniques: An Overview

Attacks known as Distributed Denial of Service (DDoS) aim to prevent the use of Internet resources and services. To create DDoS attack networks, DDoS attackers infect vast numbers of machines. Thus, a coordinated, large-scale assault on one or more victim systems is launched. Aside from improving current DDoS attack methods, attackers create new and derivative DDoS assault tools. Develop thorough DDoS solutions that prevent known and future DDoS attack variations rather than reactive defenses. Nevertheless, this needs a thorough comprehension of the scope and strategy of DDoS attacks. This investigation attempts a full DDoS scope. We suggest a new taxonomy of DDoS attack networks, DDoS attack methods, and software tools used to build DDoS attack networks. These categories help you understand the scope of DDoS attacks, tools, and issues. We propose a type of mitigation that addresses DDoS before, during, and after an attack. This initiative aims to promote research into innovative DDoS defenses and detection systems and to help develop complete solutions that defeat both known and derivative DDoS assaults.

Q-learning based distributed denial of service detection

<span lang="EN-US">Distributed denial of service (DDoS) attacks the target service providers by sending a huge amount of traffic to prevent legitimate users from getting the service. These attacks become more challenging in the software-defined network paradigm, due to the separation of the control plane from the data plane. Centralized software defined networks are more vulnerable to DDoS attacks that may cause the failure of all networks. In this work, a new approach is proposed based on q-learning to enhance the detection of DDoS attacks and reduce false positives and false negatives. The results of this work are compared with entropy detection in terms of the number of received packets to detect the attack and also the continuity of service for legitimate users. Moreover, these results indicate that the proposed system detects the DDoS attack from flash crowds and redirects the traffic to the edge of the data center. A second controller is used to redirect traffic to a honeypot server that works as a mirror server. This guarantees the continuity of service for both normal and suspected traffic until further analysis is done. The results indicate an increase of up to 50% in the throughput compared to other approaches.</span>

Intrusion Detection for Electric Vehicle Charging Systems (EVCS)

The market for Electric Vehicles (EVs) has expanded tremendously as seen in the recent Conference of the Parties 27 (COP27) held at Sharm El Sheikh, Egypt in November 2022. This needs the creation of an ecosystem that is user-friendly and secure. Internet-connected Electric Vehicle Charging Stations (EVCSs) provide a rich user experience and add-on services. Eventually, the EVCSs are connected to a management system, which is the Electric Vehicle Charging Station Management System (EVCSMS). Attacking the EVCS ecosystem remotely via cyberattacks is rising at the same rate as physical attacks and vandalism happening on the physical EVCSs. The cyberattack is more severe than the physical attack as it may affect thousands of EVCSs at the same time. Intrusion Detection is vital in defending against diverse types of attacks and unauthorized activities. Fundamentally, the Intrusion Detection System’s (IDS) problem is a classification problem. The IDS tries to determine if each traffic stream is legitimate or malicious, that is, binary classification. Furthermore, the IDS can identify the type of malicious traffic, which is called multiclass classification. In this paper, we address IoT security issues in EVCS by using different machine learning techniques and using the native IoT dataset to discover fraudulent traffic in EVCSs, which has not been performed in any previous research. We also compare different machine learning classifier algorithms for detecting Distributed Denial of Service (DDoS) attacks in the EVCS network environment. A typical Internet of Things (IoT) dataset obtained from actual IoT traffic is used in the paper. We compare classification algorithms that are placed in line with the traffic and contain DDoS attacks targeting the EVCS network. The results obtained from this research improve the stability of the EVCS system and significantly reduce the number of cyberattacks that could disrupt the daily life activities associated with the EVCS ecosystem.

Detecting DDoS attacks using adversarial neural network

In a Distributed Denial of Service (DDoS) attack, a network of compromised devices is used to overwhelm a target with a flood of requests, making it unable to serve legitimate requests. The detection of these attacks is a challenging issue in cybersecurity, which has been addressed using Machine Learning (ML) and Deep Learning (DL) algorithms. Although ML/DL can improve the detection accuracy, but they can still be evaded - ironically - through the use of ML/DL techniques in the generation of the attack traffic. In particular, Generative Adversarial Networks (GAN) have proven their efficiency in mimicking legitimate data. We address the above aspects of ML/DL-based DDoS detection and anti-detection techniques. First, we propose a DDoS detection method based on the Long Short-Term Memory (LSTM) model, which is a type of Recurrent Neural Networks (RNNs) capable of learning long-term dependencies. The detection scheme yields a high accuracy level in detecting DDoS attacks. Second, we tested the same technique against different types of adversarial DDoS attacks generated using GAN. The results show the inefficiency of the LSTM-based detection scheme. Finally, we demonstrate how to enhance this scheme to detect adversarial DDoS attacks. Our experimental results show that our detection model is efficient and accurate in identifying GAN-generated adversarial DDoS traffic with a detection ratio ranging between 91.75% and 100%.

Deep learning in distributed denial-of-service attacks detection method for Internet of Things networks

Abstract With the rapid growth of informatics systems’ technology in this modern age, the Internet of Things (IoT) has become more valuable and vital to everyday life in many ways. IoT applications are now more popular than they used to be due to the availability of many gadgets that work as IoT enablers, including smartwatches, smartphones, security cameras, and smart sensors. However, the insecure nature of IoT devices has led to several difficulties, one of which is distributed denial-of-service (DDoS) attacks. IoT systems have several security limitations due to their disreputability characteristics, like dynamic communication between IoT devices. The dynamic communications resulted from the limited resources of these devices, such as their data storage and processing units. Recently, many attempts have been made to develop intelligent models to protect IoT networks against DDoS attacks. The main ongoing research issue is developing a model capable of protecting the network from DDoS attacks that is sensitive to various classes of DDoS and can recognize legitimate traffic to avoid false alarms. Subsequently, this study proposes combining three deep learning algorithms, namely recurrent neural network (RNN), long short-term memory (LSTM)-RNN, and convolutional neural network (CNN), to build a bidirectional CNN-BiLSTM DDoS detection model. The RNN, CNN, LSTM, and CNN-BiLSTM are implemented and tested to determine the most effective model against DDoS attacks that can accurately detect and distinguish DDoS from legitimate traffic. The intrusion detection evaluation dataset (CICIDS2017) is used to provide more realistic detection. The CICIDS2017 dataset includes benign and up-to-date examples of typical attacks, closely matching real-world data of Packet Capture. The four models are tested and assessed using Confusion Metrix against four commonly used criteria: accuracy, precision, recall, and F-measure. The performance of the models is quite effective as they obtain an accuracy rate of around 99.00%, except for the CNN model, which achieves an accuracy of 98.82%. The CNN-BiLSTM achieves the best accuracy of 99.76% and precision of 98.90%.

In-network DDoS detection and mitigation using INT data for IoT ecosystem

Due to the limited capabilities and diversity of Internet of Things (IoT) devices, it is challenging to implement robust and unified security standards for these devices. Additionally, the fact that vulnerable IoT devices are beyond the network’s control makes them susceptible to being compromised and used as bots or part of botnets, leading to a surge in attacks involving these devices in recent times. We proposed a real-time IoT anomaly detection and mitigation solution at the programmable data plane in a Software-Defined Networking (SDN) environment using Inband Network telemetry (INT) data to address this issue. As far as we know, it is the first experiment in which INT data is used to detect IoT attacks in the programmable data plane. Based on our performance evaluation, the detection delay of our proposed approach is much lower than the results of previous Distributed Denial-of-Service (DDoS) research, and the detection accuracy is similarly high.

Recent Trends on Sophisticated types of Flooding Attacks and Detection Methods based on Multi Sensors Fusion Data for Cloud Computing Systems

Data storage, software services, infrastructure services, and platform services are only some of the benefits of today's widespread use of cloud computing. Since most cloud services run via the internet, they are vulnerable to a comprehensive range of attacks that might end it the disclosure of sensitive information. The distributed denial-of-service (DDoS) is amongst the attacks that pose an active threat to the cloud environment and disrupts the provided services for the legitimate participants. The main aim of this review paper is to present the recent trends on sophisticated flooding attacks detection methods for cloud computing systems. The review only considers the papers published within the period of 2014 until 2022.This study aims to examine the various deep learning-based DDoS detection algorithms and machine learning used across different cloud environments. Also, the study covers the Sophisticated types of Flooding Attacks and the testing dataset. The review outcomes several research challenges, gaps and future research guidelines related to protection of DDoS attack in cloud computing environment.

Evaluating the Effectiveness of Machine Learning Algorithms in Detecting Distributed Denial of Service Attacks in Mobile Edge Computing

Mobile Edge Computing (MEC) is the last mile technology in 5G designed to reduce latency and to execute delay-sensitive applications closer to the end-user. MEC is also known as Multi-Access Edge Computing, which extends the capabilities of cloud computing to the network's edge and brings more capabilities closer to the user. By deploying cloud capabilities to the edge servers, MEC reduces latency and delay. As a result, the end-user experience is enhanced. Unfortunately, the MEC is susceptible to security challenges. Therefore, security is a challenge that requires attention. This paper investigates and compares the effectiveness of machine learning algorithms designed to detect distributed denial of service (DDoS) attacks in MEC. DDoS is one of the security concerns that are negating the advantages of MEC. It degrades the performance of the network. In this work, network and application layer DDoS attacks were considered. The study observed that the Support Vector Machine outperformed other machine learning techniques, and the findings are fundamental to the development of our proposed security framework for MEC.

Comparison of Feature Selection Methods for DDoS Attacks on Software Defined Networks using Filter-Based, Wrapper-Based and Embedded-Based

The development of internet technology is growing very rapidly. Moreover, keeping internet users protected from cyberattacks is part of the security challenges. Distributed Denial of Service (DDoS) is a real attack that continues to grow. DDoS attacks have become one of the most difficult attacks to detect and mitigate appropriately. Software Defined Network (SDN) architecture is a novel network management and a new concept of the infrastructure network. A controller is a single point of failure in SDN, which is the most dangerous of various attacks because the attacker can take control of the controller so that it can control all network traffic. Various detection and mitigation methods have been offered, but not many consider the capacity of the SDN controller. In this research, we propose a feature selection method for DDoS attacks. This research aims to select the most important features of DDoS attacks on SDN so that the detection of DDoS on SDN can be lightweight and early. This research uses a dataset [1] generated by a Mininet emulator. The simulation runs for benign TCP, UDP, and ICMP traffic and malicious traffic, which is the collection of TCP SYN attacks, UDP Flood attacks, and ICMP attacks. A total of 23 features are available in the dataset, some are extracted from the switches, and others are calculated. By using three methods, filter-based, wrapper-based, and embedded-based, we get consistent results where the pktcount feature is the highest feature importance of DDoS attacks on SDN.

Entropic DDoS Detection for Quantum Networks

Distributed Denial-of-Service (DDoS) attacks are a significant issue in classical networks. These attacks have been shown to impact the critical infrastructure of a nation, such as its major financial institutions. The possibility of DDoS attacks has also been identified for quantum networks. In this theoretical work, we introduce a quantum analogue of classical entropic DDoS detection systems and apply it in the context of detecting an attack on a quantum network. In particular, we examine DDoS attacks on a quantum repeater and harness the associated entanglement entropy for the detection system. Our results extend the applicability of quantum information from the domain of data security to the area of network security.

A Resource-Efficient Collaborative System for DDOS Attack Detection and Victim Identification

Distributed Denial of Service (DDoS) attacks seriously threaten network security. Most countermeasures perceive attacks after the damage has been down. This paper thus focuses on the detection of DDoS attacks, and more importantly, victim identification as early as possible, so asto promote attack reaction in time. We present a resource-efficient collaborative DDoS detection system, called F-LOW. Profiting from bitwise-based hash function, split sketch, and lightweight IP reconstruction, F-LOW can defeat shortcomings of principle component analysis (PCA) and regular sketch. With a certain number of distributed detection nodes, F-LOW can detect DDoS attacks and identify victim IPs before the attack traffic arrives victim network. Outperforming previous work, our system fits all Four-LOW properties, low profile, low dimensional, low overhead and low transmission, of a promising DDoS countermeasure. Through simulation and theoretical analysis, we demonstrate such properties and remarkable efficacy of our approach in DDoS mitigation.

Towards an Optimized Ensemble Feature Selection for DDoS Detection Using Both Supervised and Unsupervised Method

With recent advancements in artificial intelligence (AI) and next-generation communication technologies, the demand for Internet-based applications and intelligent digital services is increasing, leading to a significant rise in cyber-attacks such as Distributed Denial-of-Service (DDoS). AI-based DoS detection systems promise adequate identification accuracy with lower false alarms, significantly associated with the data quality used to train the model. Several works have been proposed earlier to select optimum feature subsets for better model generalization and faster learning. However, there is a lack of investigation in the existing literature to identify a common optimum feature set for three main AI methods: machine learning, deep learning, and unsupervised learning. The current works are compromised either with the variation of the feature selection (FS) method or limited to one type of AI model for performance evaluation. Therefore, in this study, we extensively investigated and evaluated the performance of 15 individual FS methods from three major categories: filter-based, wrapper-based, and embedded, and one ensemble feature selection (EnFS) technique. Furthermore, the individual feature subset's quality is evaluated using supervised and unsupervised learning methods for extracting a common best-performing feature subset. According to our experiment, the EnFS method outperforms individual FS and provides a universal best feature set for all kinds of AI models.

A Survey of DDOS Attack Detection Techniques for IoT Systems Using BlockChain Technology

The Internet of Things (IoT) is a network of sensors that helps collect data 24/7 without human intervention. However, the network may suffer from problems such as the low battery, heterogeneity, and connectivity issues due to the lack of standards. Even though these problems can cause several performance hiccups, security issues need immediate attention because hackers access vital personal and financial information and then misuse it. These security issues can allow hackers to hijack IoT devices and then use them to establish a Botnet to launch a Distributed Denial of Service (DDoS) attack. Blockchain technology can provide security to IoT devices by providing secure authentication using public keys. Similarly, Smart Contracts (SCs) can improve the performance of the IoT–blockchain network through automation. However, surveyed work shows that the blockchain and SCs do not provide foolproof security; sometimes, attackers defeat these security mechanisms and initiate DDoS attacks. Thus, developers and security software engineers must be aware of different techniques to detect DDoS attacks. In this survey paper, we highlight different techniques to detect DDoS attacks. The novelty of our work is to classify the DDoS detection techniques according to blockchain technology. As a result, researchers can enhance their systems by using blockchain-based support for detecting threats. In addition, we provide general information about the studied systems and their workings. However, we cannot neglect the recent surveys. To that end, we compare the state-of-the-art DDoS surveys based on their data collection techniques and the discussed DDoS attacks on the IoT subsystems. The study of different IoT subsystems tells us that DDoS attacks also impact other computing systems, such as SCs, networking devices, and power grids. Hence, our work briefly describes DDoS attacks and their impacts on the above subsystems and IoT. For instance, due to DDoS attacks, the targeted computing systems suffer delays which cause tremendous financial and utility losses to the subscribers. Hence, we discuss the impacts of DDoS attacks in the context of associated systems. Finally, we discuss Machine-Learning algorithms, performance metrics, and the underlying technology of IoT systems so that the readers can grasp the detection techniques and the attack vectors. Moreover, associated systems such as Software-Defined Networking (SDN) and Field-Programmable Gate Arrays (FPGA) are a source of good security enhancement for IoT Networks. Thus, we include a detailed discussion of future development encompassing all major IoT subsystems.