Flooding Attack Detection Research Articles

Machine Learning-Based Detection of Synonymous IP Flood Attacks on Server Infrastructure

Machine Learning-Based Detection of Synonymous IP Flood Attacks on Server Infrastructure

Credible Link Flooding Attack Detection and Mitigation: A Blockchain-Based Approach

Credible Link Flooding Attack Detection and Mitigation: A Blockchain-Based Approach

A Hybrid Deep Learning Model for Securing Smart City Networks Against Flooding Attack

Due to the increasing digitization of city processes, there has been a significant shift in how cities are governed and how people make their living. However, several types of attacks could target smart cities, and Flooding Attacks (FA) are the most dangerous type. It is also a major issue for many people and programs using the Internet nowadays. Security in smart cities refers to preventative measures necessary to shield the city and its residents from direct or indirect harm by attackers who try to crash the system and deny legitimate users the use of the services. Smart city security, in contrast to standard security mechanisms, necessitates new and creative approaches to protecting the systems and applications while considering characteristics like resource limitations, distributed architecture nature, and geographic distribution. Smart cities are vulnerable to several particular issues, including faulty communication, insufficient data, and privilege protection. Therefore, a hybrid CRNN model that consists of Convolutional Neural Network (CNN) and Recurrent Neural Network (RNN) algorithms is employed for the detection of Flood Attacks based on the classification of traffic data. Subsequently, the performance of the CRNN is tested and evaluated using the CIC-Bell-DNS-EXF-2021 dataset. The obtained accuracy results of the proposed CRNN model achieved in FA detection is 99.2%.

IPv6 flood attack detection based on epsilon greedy optimized Q learning in single board computer

<span lang="EN-US">Internet of things is a technology that allows communication between devices within a network. Since this technology depends on a network to communicate, the vulnerability of the exposed devices increased significantly. Furthermore, the use of internet protocol version 6 (IPv6) as the successor to internet protocol version 4 (IPv4) as a communication protocol constituted a significant problem for the network. Hence, this protocol was exploitable for flooding attacks in the IPv6 network. As a countermeasure against the flood, this study designed an IPv6 flood attack detection by using epsilon greedy optimized Q learning algorithm. According to the evaluation, the agent with epsilon 0.1 could reach 98% of accuracy and 11,550 rewards compared to the other agents. When compared to control models, the agent is also the most accurate compared to other algorithms followed by neural network (NN), K-nearest neighbors (KNN), decision tree (DT), naive Bayes (NB), and support vector machine (SVM). Besides that, the agent used more than 99% of a single central processing unit (CPU). Hence, the agent will not hinder internet of things (IoT) devices with multiple processors. Thus, we concluded that the proposed agent has high accuracy and feasibility in a single board computer (SBC).</span>

An Adaptive Distributed Denial of Service Attack Prevention Technique in a Distributed Environment.

Cyberattacks in the modern world are sophisticated and can be undetected in a dispersed setting. In a distributed setting, DoS and DDoS attacks cause resource unavailability. This has motivated the scientific community to suggest effective approaches in distributed contexts as a means of mitigating such attacks. Syn Flood is the most common sort of DDoS assault, up from 76% to 81% in Q2, according to Kaspersky's Q3 report. Direct and indirect approaches are also available for launching DDoS attacks. While in a DDoS attack, controlled traffic is transmitted indirectly through zombies to reflectors to compromise the target host, in a direct attack, controlled traffic is sent directly to zombies in order to assault the victim host. Reflectors are uncompromised systems that only send replies in response to a request. To mitigate such assaults, traffic shaping and pushback methods are utilised. The SYN Flood Attack Detection and Mitigation Technique (SFaDMT) is an adaptive heuristic-based method we employ to identify DDoS SYN flood assaults. This study suggested an effective strategy to identify and resist the SYN assault. A decision support mechanism served as the foundation for the suggested (SFaDMT) approach. The suggested model was simulated, analysed, and compared to the most recent method using the OMNET simulator. The outcome demonstrates how the suggested fix improved detection.

Research on the reliability of bloom filters to defend a distributed denial-of-service

Distributed denial of service (DDoS) attacks are one of the threats to network security, and reasonable means of defense are sought. Bloom filter is a commonly used detection method, the research have listed different attacks in the paper and made it possible to compare it with other detection methods by analyzing how Bloom filter works. The research shows that the Bloom filter works by comparing the element to be queried with an already stored vector. If the query result is zero then the element does not exist, if it is one then it means that in most cases the element exists, but false positives are not excluded causing the element to be judged as existing. In this paper, the comparison with other methods also needs focus, the time complexity of inserting, searching, and deleting data is an important feature to consider when Bloom filters outperform other methods. The research also shows that the Bloom filter is to some extent better than other detection methods in terms of insertion, search, and deletion time. At the same time, the research showed that the use of Bloom filters in response to DDoS attacks is also very impressive, for the detection of link flooding attacks and the detection and processing speed of packets is commendable, can take up less memory to achieve better results.

Detection and Mitigation of SYN Flooding Attacks through SYN/ACK Packets and Black/White Lists.

Software-defined networking (SDN) is a new network architecture that provides programmable networks, more efficient network management, and centralized control than traditional networks. The TCP SYN flooding attack is one of the most aggressive network attacks that can seriously degrade network performance. This paper proposes detection and mitigation modules against SYN flooding attacks in SDN. We combine those modules, which have evolved from the cuckoo hashing method and innovative whitelist, to get better performance compared to current methods Our approach reduces the traffic through the switch and improves detection accuracy, also the required register size is reduced by half for the same accuracy.

Early detection and mitigation of TCP SYN flood attacks in SDN using chi-square test

Early detection and mitigation of TCP SYN flood attacks in SDN using chi-square test

Recent Trends on Sophisticated types of Flooding Attacks and Detection Methods based on Multi Sensors Fusion Data for Cloud Computing Systems

Data storage, software services, infrastructure services, and platform services are only some of the benefits of today's widespread use of cloud computing. Since most cloud services run via the internet, they are vulnerable to a comprehensive range of attacks that might end it the disclosure of sensitive information. The distributed denial-of-service (DDoS) is amongst the attacks that pose an active threat to the cloud environment and disrupts the provided services for the legitimate participants. The main aim of this review paper is to present the recent trends on sophisticated flooding attacks detection methods for cloud computing systems. The review only considers the papers published within the period of 2014 until 2022.This study aims to examine the various deep learning-based DDoS detection algorithms and machine learning used across different cloud environments. Also, the study covers the Sophisticated types of Flooding Attacks and the testing dataset. The review outcomes several research challenges, gaps and future research guidelines related to protection of DDoS attack in cloud computing environment.

Detection and mitigation of field flooding attacks on oil and gas critical infrastructure communication

Industrial Cyber-Physical Systems (ICPS) are highly dependent on Supervisory Control and Data Acquisition (SCADA) for process monitoring and control. Such SCADA systems are known to communicate using various insecure protocols such as Modbus, DNP3, and Open Platform Communication (OPC) Data Access standards (providing access to real-time automation data), which are vulnerable to a range of attacks. This leads to increased cyber risks faced in critical infrastructures, especially in the Oil and Gas sector. One of the most popular and critical attacks deployed against such infrastructure is Denial of Service (DoS), as it can have severe consequences that range from financial loss to loss of life. Such attacks can disrupt the ability of an operator to control hazardous operations leading to potentially unsafe scenarios. A novel Field Flooding attack is described which takes advantage of the packet memory structure of the Modbus protocol to perform a DoS attack. This attack can cause overflowing of the memory bank allocated in the Programmable Logic Controller (PLC) for Modbus operations. The attack is deployed and evaluated on a real industrial testbed and its impact against the Mitre ATT&CK framework is assessed, in order to identify which tactics an adversary could use to compromise the system. A novel mechanism that utilises supervised machine learning to detect this attack in industrial control system networks is also described. Experimental results show that the proposed mechanism, using the XGBoost algorithm, can identify this attack with 99% accuracy.

FAPDRP: a flooding attacks prevention and detection routing protocol in vehicular ad hoc network using behavior history and nonlinear median filter transformation

FAPDRP: a flooding attacks prevention and detection routing protocol in vehicular ad hoc network using behavior history and nonlinear median filter transformation

WOGRU-IDS — An intelligent intrusion detection system for IoT assisted Wireless Sensor Networks

One of the key mechanisms of the current electronic and wireless frameworks is the assistance of Wireless Sensor Networks (WSN) in Internet of Things (IoT) networks. A WSN typically consists of multipurpose sensor hubs for data sensing, processing, and communication. These networks are more suited to conveying medical data from various geographical regions and sending private medical data to the network owner. However, the worry about various attacks on health care data normally grows daily. These assaults could quickly have adverse impacts on the WSN-IoT (Internet of Things) nodes. Additionally, the low detection rate, significant processing overhead, and resource limitations of current intrusion detection systems all contribute to an increase in false alarm rates when trying to identify various attacks. The unique Whale Optimized Gate Recurrent Unit (WOGRU) Intrusion Detection System (IDS) for WSN-IoT networks is proposed in this research in light of the aforementioned issues in order to effectively identify various attacks. The whale algorithm was used in the proposed framework to tune the hyperparameters of the deep long short-term memory in order to achieve low computational overhead and great performance. Last but not least, validations are carried out using the WSN-DS dataset, and the performance of the suggested work is evaluated using the parameters accuracy, recall, precision, specificity, and F1-score. Additionally, the comparison study was conducted using the current frameworks. The data demonstrates that the suggested framework had an average performance of 99.85 percent for the detection of flooding, scheduling, black hole, and gray hole attacks.

Multi-classifier and meta-heuristic based cache pollution attacks and interest flooding attacks detection and mitigation model for named data networking

ABSTRACT This study’s main goal is to provide a novel assault detection model with two phases. The features such node, distribution, pattern, frequency, and run time are extracted in the first phase. The Deep Convolutional Neural Network (CNN) is then used to detect cache pollution attacks (also known as content poisoning attacks), which include interest flooding for existing data, interest flooding for non-existing data, hijacking incoming interest packets, and signing data with the incorrect key. Similar to the first phase, the second phase involves extracting the aforementioned attributes and feeding them into a fuzzy decision tree (FDT) in order to identify an interest flooding attack. For accurate attack detection, this paper aims to optimise both DCNN and FDT classifiers. This work provided a fresh Decision Oriented Rider Optimisation Algorithm (DO-ROA), an enhancement of the traditional ROA, to address the optimisation problem. With regard to specific Type I and Type II performance measures, the suggested DO-ROA algorithm’s performance is compared to that of other traditional models, demonstrating the superiority of the presented work.

A SYN Flood Attack Detection Method Based on Hierarchical Multihead Self-Attention Mechanism

Existing SYN flood attack detection methods have obvious problems such as poor feature selectivity, weak generalization ability, easy overfitting, and low accuracy during training. In the paper, we present a SYN flood attack detection method based on the Hierarchical Multihad Self-Attention (HMHSA) mechanism. First, we use one-hot encoding and normalization to preprocess traffic data. Then the preprocessed traffic data is transmitted to the Feature-based Multihead Self-Attention (FBMHA) layer for feature selection. Finally, we use data slices to determine the features of the preprocessed traffic data under time series by passing the preprocessed traffic data into the Slice-based Multihead Self-Attention (SBMHA) layer. We tested the proposed method on different datasets. The experimental results show that compared with other works, our method presents better in feature selection and higher detection accuracy (even up to 99.97%).

TFAD: TCP flooding attack detection in software-defined networking using proxy-based and machine learning-based mechanisms

TFAD: TCP flooding attack detection in software-defined networking using proxy-based and machine learning-based mechanisms

Real-time DDoS flood attack monitoring and detection (RT-AMD) model for cloud computing.

In recent years, the advent of cloud computing has transformed the field of computing and information technology. It has been enabling customers to rent virtual resources and take advantage of various on-demand services with the lowest costs. Despite the advantages of cloud computing, it faces several threats; an example is a distributed denial of service (DDoS) attack, which is considered among the most serious. This article presents real-time monitoring and detection of DDoS attacks on the cloud using a machine learning approach. Naïve Bayes, K-nearest neighbor, decision tree, and random forest machine learning classifiers have been selected to build a predictive model named “Real-Time DDoS flood Attack Monitoring and Detection RT-AMD.” The DDoS-2020 dataset was constructed with 70,020 records to evaluate RT-AMD’s accuracy. The DDoS-2020 contains three protocols for network/transport-level, which are TCP, DNS, and ICMP. This article evaluates the proposed model by comparing its accuracy with related works. Our model has shown improvement in the results and reached real-time attack detection using incremental learning. The model achieved 99.38% accuracy for the random forest in real-time on the cloud environment and 99.39% on local testing. The RT-AMD was evaluated on the NSL-KDD dataset as well, in which it achieved 99.30% accuracy in real-time in a cloud environment.

The Robustness of Detecting Known and Unknown DDoS Saturation Attacks in SDN via the Integration of Supervised and Semi-Supervised Classifiers

The design of existing machine-learning-based DoS detection systems in software-defined networking (SDN) suffers from two major problems. First, the proper time window for conducting network traffic analysis is unknown and has proven challenging to determine. Second, it is unable to detect unknown types of DoS saturation attacks. An unknown saturation attack is an attack that is not represented in the training data. In this paper, we evaluate three supervised classifiers for detecting a family of DDoS flooding attacks (UDP, TCP-SYN, IP-Spoofing, TCP-SARFU, and ICMP) and their combinations using different time windows. This work represents an extension of the runner-up best-paper award entitled ‘Detecting Saturation Attacks in SDN via Machine Learning’ published in the 2019 4th International Conference on Computing, Communications and Security (ICCCS). The results in this paper show that the trained supervised models fail in detecting unknown saturation attacks, and their overall detection performance decreases when the time window of the network traffic increases. Moreover, we investigate the performance of four semi-supervised classifiers in detecting unknown flooding attacks. The results indicate that semi-supervised classifiers outperform the supervised classifiers in the detection of unknown flooding attacks. Furthermore, to further increase the possibility of detecting the known and unknown flooding attacks, we propose an enhanced hybrid approach that combines two supervised and semi-supervised classifiers. The results demonstrate that the hybrid approach has outperformed individually supervised or semi-supervised classifiers in detecting the known and unknown flooding DoS attacks in SDN.

Real-time DDoS flooding attack detection in intelligent transportation systems

Integrated Intelligent Transportation System (IITS) is built by the emergence of the Internet of Vehicles (IoV) and the employment of the Internet of Things (IoT) in the transportation field for improving traffic efficiency, avoiding accidents, and improving the safety experience in driving. Large-scale networks, dynamic topology structure, uneven nodes distribution, and unlimited mobility are the characteristics of IITS. It increased the risk of a variety of attacks related to authentication, credentials, availability, privacy, routing, and legitimacy of data. Distributed Denial of Service (DDoS) flooding attack plays a vital role in impairing Road Side Units (RSU) of IITS and is capable of evading classical data filtering methods. In this paper, a novel DDoS flooding attack detection method is proposed for ensuring the security of IITS by employing reinforcement learning. The proposed framework is implemented by addressing the security requirements of ITS and overcoming the flaws of existing detection methods in advanced vehicular systems. In addition, the Q learning algorithm is designed along with the framework. Other attacks, in addition to DDoS flooding attacks, should be mitigated in the future to ensure a completely secure connection.

A Robust DNS Flood Attack Detection with a Hybrid Deeper Learning Model

In this article, an innovative hybrid deep learning model which consists of convolutional neural network architecture that improves with long short term memory cells is used to recognize domain name system flood attacks. The proposed model provides a comprehensive solution for direct detection of domain system flood attacks without label coding, normalization and feature selection in CICIDS dataset derived from real world data. The performance metrics is evaluated through a comprehensive performance comparison of selected machine learning, shallow neural network and deep learning classifiers. Although there is no normalization, label encoding and feature removal, very low false alarms and significantly high detection accuracy (99.87%) have been achieved. The deep learning architecture, including the proposed Long Short Term Memory cell, has contributed to the detection of domain name system flood attacks with a low false-positive diagnosis rate compared to machine learning and shallow neural networks.

A SYN flooding attack detection approach with hierarchical policies based on self‐information

The SYN flooding attack is widely used in cyber attacks because it paralyzes the network by causing the system and bandwidth resources to be exhausted. This paper proposed a self-information approach for detecting the SYN flooding attack and provided a detection algorithm with a hierarchical policy on a detection time domain. Compared with other detection methods of entropy measurement, the proposed approach is more efficient in detecting the SYN flooding attack, providing low misjudgment, hierarchical detection policy, and low time complexity. Furthermore, we proposed a detection algorithm with limiting system resources. Thus, the time complexity of our approach is only (log n) with lower time complexity and misjudgment rate than other approaches. Therefore, the approach can detect the denial-of-service/distributed denial-of-service attacks and prevent SYN flooding attacks.