Distributed Denial Of Service Detection Mechanisms Research Articles

A novel CNN‐based approach for detection and classification of DDoS attacks

SummaryAmong the recent network security issues, Distributed Denial of Service (DDoS) attack is one of the most dangerous threats in today's cyberspace that can disrupt essential services. These attacks compromise network security by flooding the target with malicious traffic. Several researchers have designed effective DDoS detection mechanisms using machine learning (ML) and deep learning (DL)‐based techniques. However, existing detection approaches paid less attention to issues such as class imbalance, multi‐classification, or computational cost of the models, especially time. In this study, we propose a novel framework for detecting and classifying DDoS attacks with high accuracy and low computational cost. To address the class imbalance, we employ random sampling, while feature selection techniques such as low information gain, quasi‐constant elimination, and principal component analysis are utilized for optimal feature selection and reduction. Our proposed CNN‐based model achieves outstanding performance, boasting an accuracy of 99.99% for binary classification and 98.44% for multi‐classification. The proposed model is compared to existing works and baseline line models and found to be effective in binary and multi‐classification.

Bayesian Regularization (BR) Optimization Based DDoS Detection for SDN and Next Generation Communication Network

The rapid evolution of communication networks, particularly Software-Defined Networking (SDN) and next-generation communication infrastructures, has introduced new challenges in securing these dynamic and complex environments. Among the most persistent threats are Distributed Denial of Service (DDoS) attacks, which can disrupt critical services and inflict severe economic and operational damages. To combat these threats, novel and adaptive DDoS detection mechanisms are crucial. This paper proposes a Bayesian Regularization (BR) optimization-based approach for DDoS detection in SDN and next-generation communication networks. Bayesian Regularization is a statistical technique that combines the strength of Bayesian analysis with optimization methodologies, enabling the model to adapt to changing network conditions and attack strategies. This approach leverages the inherent advantages of SDN, such as centralized control and real-time network monitoring, to enhance the accuracy and timeliness of DDoS detection.

Deep learning model for distributed denial of service (DDoS) detection

Distributed denial of service (DDoS) attacks is one of the serious threats in the domain of cybersecurity where it affects the availability of online services by disrupting access to its legitimate users. The consequences of such attacks could be millions of dollars in worth since all of the online services are relying on high availability. The magnitude of DDoS attacks is ever increasing as attackers are smart enough to innovate their attacking strategies to expose vulnerabilities in the intrusion detection models or mitigation mechanisms. The history of DDoS attacks reflects that network and transport layers of the OSI model were the initial target of the attackers, but the recent history from the cybersecurity domain proves that the attacking momentum has shifted toward the application layer of the OSI model which presents a high degree of difficulty distinguishing the attack and benign traffics that make the combat against application-layer DDoS attack a sophisticated task. Striding for high accuracy with high DDoS classification recall is key for any DDoS detection mechanism to keep the reliability and trustworthiness of such a system. In this paper, a deep learning approach for application-layer DDoS detection is proposed by using an autoencoder to perform the feature selection and Deep neural networks to perform the attack classification. A popular benchmark dataset CIC DoS 2017 is selected by extracting the most appealing features from the packet flows. The proposed model has achieved an accuracy of 99.83% with a detection rate of 99.84% while maintaining the false-negative rate of 0.17%, which has the heights accuracy rate among the literature reviewed so far.

A hybrid method of entropy and SSAE-SVM based DDoS detection and mitigation mechanism in SDN

Software-defined networking (SDN) is a new network architecture that offers considerable management convenience and efficiency relative to conventional networks. However, the centralized control employed in SDN incurs a high risk of single point failure that is susceptible to distributed denial of service (DDoS) attacks. The present work addresses this issue by proposing a hybrid approach for detecting DDoS attacks using an initial detection module based on information entropy to quickly identify anomalous traffic and a second detection module based on machine learning with a stacked sparse autoencoder (SSAE)–support vector machine (SVM) architecture to confirm the suspected anomalous traffic. If DDoS traffic is detected, a defense module is implemented to restore normal network communication in a timely manner via an issued flow table. The effectiveness and efficiency of the proposed approach for DDoS detection is experimentally evaluated using both real-time and benchmark datasets in comparison with state-of-the-art methods. The results demonstrate that the proposed approach provides superior detection performance and identifies greater than 98% of existing DDoS traffic with greatly reduced training time and computational burden.

Detection of Different DDoS Attacks Using Machine Learning Classification Algorithms

Cyber attacks are one of the world's most serious challenges nowadays. A Distributed Denial of Service (DDoS) attack is one of the most common cyberattacks that has affected availability, which is one of the most important principles of information security. It leads to so many negative consequences in terms of business, production, reputation, data theft, etc. It shows the importance of effective DDoS detection mechanisms to reduce losses. In order to detect DDoS attacks, statistical and data mining methods have not been given good accuracy values. Researchers get good accuracy values while detecting DDoS attacks by using classification algorithms. But researchers, use individual classification algorithms on generalized DDoS attacks. This study used six machine learning classification algorithms to detect eleven different DDoS attacks on different DDoS attack datasets. We used the CICDDoS2019 dataset which is collected from the Canadian Institute of Cyber security in this study. It contains eleven different DDoS attack datasets in CSV file format. On each DDoS attack, we evaluated the effectiveness of the classification methods Logistic regression, Decision tree, Random Forest, Ada boost, KNN, and Naive Bayes, and determined the best classification algorithms for detection.

ADVICE: Towards adaptive scheduling for data collection and DDoS detection in SDN

Distributed Denial of Service (DDoS) is one of the most rampant attacks which threaten network security. To overcome DDoS in Software-Defined Networking (SDN), many DDoS detection methods have been presented, among which periodic detection approaches with a specific interval are widely utilized. However, periodic data collection and DDoS detection may result in high network load occupancy between SDN controller and switches, high overhead of SDN controller, and long response time to DDoS attacks. Hence, in order to address those issues above, an ADaptiVe schedulIng for data Collection and DDoS dEtection (ADVICE) mechanism is proposed in this work, to flexibly adjust the data collection and detection interval and decrease the workload of the SDN controller. Instead of detects all flow entries at one period, ADVICE collects the flow statistic information with dynamic intervals and finely-grained initiate DDoS detection for each flow entry. Based on the survival time and credence degree of each flow entry, ADVICE can reduce the network load occupancy and assure the rapid detection of DDoS. Experimental results indicate that ADVICE can effectively minimize the controller's workload and optimize the usage of the limited switch-controller connection bandwidth, shorten the response time of DDoS attacks compared with state-of-the-art methods, and thus protect the network from various DDoS attacks.

Detection of DDoS Attacks in OpenStack-based Private Cloud Using Apache Spark

Security is a critical concern for cloud service providers. Distributed denial of service (DDoS) attacks are the most frequent of all cloud security threats, and the consequences of damage caused by DDoS are very serious. Thus, the design of an efficient DDoS detection system plays an important role in monitoring suspicious activity in the cloud. Real-time detection mechanisms operating in cloud environments and relying on machine learning algorithms and distributed processing are an important research issue. In this work, we propose a real-time detection of DDoS attacks using machine learning classifiers on a distributed processing platform. We evaluate the DDoS detection mechanism in an OpenStack-based cloud testbed using the Apache Spark framework. We compare the classification performance using benchmark and real-time cloud datasets. Results of the experiments reveal that the random forest method offers better classifier accuracy. Furthermore, we demonstrate the effectiveness of the proposed distributed approach in terms of training and detection time.

Online DDoS attack detection using Mahalanobis distance and Kernel-based learning algorithm

Distributed denial-of-service (DDoS) attacks are constantly evolving as the computer and networking technologies and attackers' motivations are changing. In recent years, several supervised DDoS detection algorithms have been proposed. However, these algorithms require a priori knowledge of the classes and cannot automatically adapt to frequently changing network traffic trends. This emphasizes the need for the development of new DDoS detection mechanisms that target zero-day and sophisticated DDoS attacks. In this paper, we propose an online, sequential, DDoS detection scheme that is suitable for use with multivariate data. The proposed algorithm utilizes a kernel-based learning algorithm, the Mahalanobis distance, and a chi-square test. Initially, we extract four entropy-based and four statistical features from network flows per minute as detection metrics. Then, we employ the kernel-based learning algorithm using the entropy features to detect input vectors that were suspected to be DDoS. This algorithm assumes no model for network traffic or DDoS. It constructs and adapts a dictionary of features that approximately span the subspace of normal behavior. Every T minutes, the Mahalanobis distance between suspicious vectors and the distribution of dictionary members is measured. Subsequently, the chi-square test is used to evaluate the Mahalanobis distance. The proposed DDoS detection scheme was applied to the CICIDS2017 dataset, and we compared the results with those given by existing algorithms. It was demonstrated that the proposed online detection scheme outperforms almost all available DDoS classification algorithms with an offline learning process.

Multiplexed Asymmetric Attacks: Next-Generation DDoS on HTTP/2 Servers

Distributed Denial of Service (DDoS) attacks using the HTTP protocol have started gaining popularity in recent years. A recent trend in this direction has been the use of computationally expensive requests to launch attacks. These attacks, called Asymmetric Workload attacks can bring down servers using limited resources, and are extremely difficult to detect. The introduction of HTTP/2 has been welcomed by developers because it improves user experience and efficiency. This was made possible by the ability to transport HTTP requests and their associated inline resources simultaneously by using Multiplexing and Server Push. However multiplexing has made request traffic bursty and rendered DDoS detection mechanisms based on connection limiting obsolete. Contrary to its intention, multiplexing can also be misused to launch sophisticated DDoS attacks using multiple high workload requests in a single TCP connection. However, sufficient research has not been done in this area. Existing research demonstrates that the HTTP/2 protocol allows users to launch DDoS attacks easily, but does not focus on whether an HTTP/2 server can handle DDoS attacks more efficiently or not. Also, sufficient research has not been done on the possibility of Multiplexing and Server Push being misused. In this work, we analyse the performance of an HTTP/2 server compared to an HTTP/1.1 server under an Asymmetric DDoS attack for the same load. We propose a new DDoS attack vector called a Multiplexed Asymmetric DDoS attack, which uses multiplexing in a different way than intended. We show that such an attack can bring down a server with just a few attacking clients. We also show that a Multiplexed Asymmetric Attack on a server with Server Push enabled can trigger an egress network layer flood in addition to an application layer attack.

DDoS detection and defense mechanism based on cognitive-inspired computing in SDN

Software-defined networking (SDN) provides a promising architecture for future networks, and can provide advantages as central control programmability and global view. However, it faces numerous security challenges. Distributed denial of service (DDoS) is a security threat to SDN. Most existing schemes only perform DDoS attack detection and do not address how to defend and recover after detecting DDoS. In this paper, a DDoS attack detection and defense mechanism based on cognitive-inspired computing with dual address entropy is proposed. The flow table characteristics of the switch are extracted, and a DDoS attack model is built by incorporating the support vector machine classification algorithm. This mechanism can realize real-time detection and defense at the preliminary stage of the DDoS attack and can restore normal communication in time. The experiment shows that our mechanism not only detects attacks quickly but also has a high detection rate and low false positive rate. More importantly, it can take appropriate defense and recovery measures in the time after the attack has been identified.

Systematic literature review and taxonomy for DDoS attack detection and prediction

Distributed denial of service (DDoS) attack has been significantly discussed in the computer security domain, particularly due to the damaging effects it causes to organisations' assets. However, it confronts the challenge under massive growth of internet user traffic and lightning speed of computer access. In this paper, we present a comprehensive systematic literature review and measurement analysis of the DDoS impact, including: a) DDoS definition; b) types of DDoS attack; c) various types of existing DDoS detecting techniques; d) different kinds of DDoS attack prediction techniques. Furthermore, this paper provides an in-depth analysis the advantages and the drawbacks of existing DDoS detection and prediction technique to assist for both academia and industry researchers towards produce better DDoS detection and prediction mechanism.

Systematic literature review and taxonomy for DDoS attack detection and prediction

Distributed denial of service (DDoS) attack has been significantly discussed in the computer security domain, particularly due to the damaging effects it causes to organisations' assets. However, it confronts the challenge under massive growth of internet user traffic and lightning speed of computer access. In this paper, we present a comprehensive systematic literature review and measurement analysis of the DDoS impact, including: a) DDoS definition; b) types of DDoS attack; c) various types of existing DDoS detecting techniques; d) different kinds of DDoS attack prediction techniques. Furthermore, this paper provides an in-depth analysis the advantages and the drawbacks of existing DDoS detection and prediction technique to assist for both academia and industry researchers towards produce better DDoS detection and prediction mechanism.

Application Layer Distributed Denial of Service Attacks Defense Techniques : A review

Currently distributed denial of service (DDoS) is the most sever attack that effect on the internet convenience. The main goal of these attacks is to prevent normal users from accessing the internet services such as web servers. However the more challenge and difficult types to detect is application layer DDoS attacks because of using legitimate client to create connection with victims. In this paper we give a review on application layer DDoS attacks defense or detection mechanisms. Furthermore, we summarize several experimental approaches on detection techniques of application layer DDoS attacks. The main goal of this paper is to get a clear view and detailed summary of the recent algorithms, methods and techniques presented to tackle these serious types of attacks.

HADEC: Hadoop-based live DDoS detection framework

Distributed denial of service (DDoS) flooding attacks are one of the main methods to destroy the availability of critical online services today. These DDoS attacks cannot be prevented ahead of time, and once in place, they overwhelm the victim with huge volume of traffic and render it incapable of performing normal communication or crashes it completely. Any delays in detecting the flooding attacks completely halts the network services. With the rapid increase of DDoS volume and frequency, the new generation of DDoS detection mechanisms are needed to deal with huge attack volume in reasonable and affordable response time.In this paper, we propose HADEC, a Hadoop-based live DDoS detection framework to tackle efficient analysis of flooding attacks by harnessing MapReduce and HDFS. We implemented a counter-based DDoS detection algorithm for four major flooding attacks (TCP-SYN, HTTP GET, UDP, and ICMP) in MapReduce, consisting of map and reduce functions. We deployed a testbed to evaluate the performance of HADEC framework for live DDoS detection on low-end commodity hardware. Based on the experiment, we showed that HADEC is capable of processing and detecting DDoS attacks in near to real time.

A Service-oriented DDoS detection mechanism using pseudo state in a flow router

As distributed denial-of-service (DDoS) attacks have caused serious economic and social problems, there have been numerous researches to defend against them. The current DDoS defense system relies on a dedicated security device, which is located in front of the server it is required to protect. To detect DDoS attacks, this security device compares incoming traffic to known attack patterns. Since such a defense mechanism cannot prevent an influx of attack traffic into the network, and every packet must be compared against the known attack patterns, the mechanism often degrades the service. In this paper, we propose the Service-oriented DDoS Detection Mechanism using a Pseudo State (SDM-P), which runs on network devices to defend against DDoS attacks without sacrificing performance in terms of data forwarding. The SDM-P mechanism is suitable for both low- and high-rate attacks. In addition, we verified the performance of the SDM-P mechanism by evaluating its performance using a DDoS attack similar to the one that occurred in Korea and the USA on July 7th, 2009.

The GAIA sensor

Distributed Denial of Service (DDoS) attacks are a major network security threat. Most recent host-based DDoS detection mechanisms are dedicated to a particular set of attacks, focusing either on the recent dynamic of the traffic, or on its long range dependence. We propose a DDoS early detection component based on anomaly detection which combines static and dynamic behavior analysis, including experimental results.