Distributed Denial Of Service Research Articles

Machine learning for network defense: automated DDoS detection with telegram notification integration

As the prevalence and sophistication of distributed denial of service (DDoS) attacks escalate, the imperative for advanced defense mechanisms becomes paramount, especially in rapidly growing digital landscapes like Indonesia. This research presents the development of an innovative intrusion detection system (IDS) that harnesses machine learning (ML) algorithms to automate the detection of DDoS attacks in real time. By monitoring TCP streams, the system utilizes ML-enhanced IDS components to identify malicious traffic patterns indicative of DDoS activities. An automatic alert is dispatched to network administrators via Telegram upon detection, ensuring immediate awareness and facilitating swift countermeasures. Additionally, the system embodies a self-improving architecture by retraining its ML model with newly encountered attack data, thus continuously refining its detection capabilities. The system's efficacy, marked by its adaptive learning and proactive notification system, not only contributes to the fortification of network security but also underscores the potential for ML in cybersecurity within Indonesia’s expanding digital domain. The deployment of this system is anticipated to significantly bolster cybersecurity infrastructure by addressing the urgent need for advanced and responsive defense strategies against the evolving landscape of cyber threats.

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Quantum-Enhanced Representation Learning: A Quanvolutional Autoencoder Approach against DDoS Threats

Motivated by the growing threat of distributed denial-of-service (DDoS) attacks and the emergence of quantum computing, this study introduces a novel “quanvolutional autoencoder” architecture for learning representations. The architecture leverages the computational advantages of quantum mechanics to improve upon traditional machine learning techniques. Specifically, the quanvolutional autoencoder employs randomized quantum circuits to analyze time-series data from DDoS attacks, offering a robust alternative to classical convolutional neural networks. Experimental results suggest that the quanvolutional autoencoder performs similarly to classical models in visualizing and learning from DDoS hive plots and leads to faster convergence and learning stability. These findings suggest that quantum machine learning holds significant promise for advancing data analysis and visualization in cybersecurity. The study highlights the need for further research in this fast-growing field, particularly for unsupervised anomaly detection.

DDoS Attack Detection and Classification using Machine Learning Algorithms

Abstract: In the dynamic realm of networking, Software Defined Networking (SDN) emerges as a transformative force, offering centralized control and programmable capabilities that empower network administrators to efficiently manage and secure network infrastructures. However, amidst the ever-present threat of distributed denial-of-service (DDoS) attacks, the need for robust detection mechanisms is imperative. This research proposes a machine learning-based approach to enhance DDoS attack detection and classification within SDN environments. Leveraging the SelectKBest algorithm for feature selection and employing various classifiers such as Decision tree, KMeans++, XGBoost, etc.. with a focus on Random Forest as the most effective, the project aims to bolster detection accuracy and efficiency. Through comprehensive experimentation and comparative analysis, the efficacy of the proposed methodology in identifying DDoS threats is demonstrated, contributing to the ongoing efforts in fortifying cybersecurity defenses against sophisticated adversarial tactics.

Distributed Denial of Service Attack Detection in IoT Networks using Deep Learning and Feature Fusion: A Review

The explosive growth of Internet of Things (IoT) devices has led to escalating threats from distributed denial of service (DDoS) attacks. Moreover, the scale and heterogeneity of IoT environments pose unique security challenges, and intelligent solutions tailored for the IoT are needed to defend critical infrastructure. The deep learning technique shows great promise because automatic feature learning capabilities are well suited for the complex and high-dimensional data of IoT systems. Additionally, feature fusion approaches have gained traction in enhancing the performance of deep learning models by combining complementary feature sets extracted from multiple data sources. This paper aims to provide a comprehensive literature review focused specifically on deep learning techniques and feature fusion for DDoS attack detection in IoT networks. Studies employing diverse deep learning models and feature fusion techniques are analysed, highlighting key trends and developments in this crucial domain. This review provides several significant contributions, including an overview of various types of DDoS attacks, a comparison of existing surveys, and a thorough examination of recent applications of deep learning and feature fusion for detecting DDoS attacks in IoT networks. Importantly, it highlights the current challenges and limitations of these deep learning techniques based on the literature surveyed. This review concludes by suggesting promising areas for further research to enhance deep learning security solutions, which are specifically tailored to safeguarding the fast-growing IoT infrastructure against DDoS attacks.

Cybersecurity Considerations for Smart Bangladesh: Challenges and Solutions

Cybersecurity stands as a cornerstone for safeguarding the integrity, security, and prosperity of a nation in the digital era. It involves a multifaceted approach to protect interconnected digital systems, critical infrastructure, and sensitive data. In the context of a smart nation, where interconnected devices, sensors, and systems are integrated to enhance efficiency and quality of life, cybersecurity becomes even more crucial. As Bangladesh progresses towards its vision of becoming a Smart Nation, characterized by extensive integration of digital technologies into various sectors, cybersecurity emerges as a critical concern. The rapid digitization of infrastructure and services, driven by initiatives such as smart cities, e-governance, and digital healthcare, introduces new vulnerabilities and threats that must be addressed to safeguard against cyber-attacks and protect sensitive data. This paper explores the cybersecurity landscape of Bangladesh in the context of its Smart Nation aspirations, identifying key challenges and proposing solutions to mitigate risks. The cybersecurity challenges facing Smart Bangladesh initiatives are multifaceted and include inadequate cybersecurity policies, limited awareness and education, insufficient investment in cybersecurity infrastructure, and the proliferation of Internet of Things (IoT) devices with inherent vulnerabilities. These challenges expose smart systems to a range of threats, including malware and ransomware attacks, data breaches, insider threats, Distributed Denial of Service (DDoS) attacks, and IoT vulnerabilities. To address these challenges, stakeholders must adopt a proactive and multi-layered approach to cybersecurity. Recommendations include the development of comprehensive cybersecurity policies, enhanced public awareness and education campaigns, investment in cybersecurity infrastructure, implementation of secure-by-design principles in smart infrastructure development, and fostering public-private partnerships to share threat intelligence and resources. By prioritizing cybersecurity considerations and implementing robust cybersecurity measures, Bangladesh can build a resilient and secure digital ecosystem that supports its Smart Nation goals. However, addressing cybersecurity challenges requires coordinated efforts from government agencies, private sector organizations, academia, and civil society to create a cyber-resilient environment conducive to sustainable development and innovation. The author found this area of utmost interest and decided to delve deep into the aspects related to cybersecurity, in order to develop a well-designed journey towards a digitally transformed Bangladesh.

Improvement of Distributed Denial of Service Attack Detection through Machine Learning and Data Processing

The early and accurate detection of Distributed Denial of Service (DDoS) attacks is a fundamental area of research to safeguard the integrity and functionality of organizations’ digital ecosystems. Despite the growing importance of neural networks in recent years, the use of classical techniques remains relevant due to their interpretability, speed, resource efficiency, and satisfactory performance. This article presents the results of a comparative analysis of six machine learning techniques, namely, Random Forest (RF), Decision Tree (DT), AdaBoost (ADA), Extreme Gradient Boosting (XGB), Multilayer Perceptron (MLP), and Dense Neural Network (DNN), for classifying DDoS attacks. The CICDDoS2019 dataset was used, which underwent data preprocessing to remove outliers, and 22 features were selected using the Pearson correlation coefficient. The RF classifier achieved the best accuracy rate (99.97%), outperforming other classifiers and even previously published neural network-based techniques. These findings underscore the feasibility and effectiveness of machine learning algorithms in the field of DDoS attack detection, reaffirming their relevance as a valuable tool in advanced cyber defense.

PETRAK: A solution against DDoS attacks in vehicular networks

In recent years, the frequently reported incidents of Distributed Denial of Service assaults on vehicular networks in various countries have made researchers find new protective solutions. DDoS attacks can propagate through the charging points for electric vehicles in a charging station and affect the production of critical infrastructures such as electric grids. Existing solutions are efficient in attack detection; however, current systems do not offer multi-level protection, and zero-day vulnerabilities are prone to escape from the detection systems.In this paper, we address the problems mentioned above and introduce the first Machine Learning (ML)–based DDoS protective solution to combine prevention and detection mechanisms in vehicular networks. To be more specific, our proposed model is the first to consider the adaptive traffic threshold to generate the alarm for a suspicious amount of traffic flow in an Intrusion Detection Prevention System (IDPS). We call our proposed approach Protecting vEhicular neTworks against distRibuted deniAl of service attacKs (PETRAK). PETRAK uses four functions: prevention, alarm, training, and detection. The alarming system uses the flow parameters and activates the detection module to detect malicious packets. The prevention system works in two modes: immediate and future. PETRAK uses logistic regression to identify incoming packets and signatures of malicious packets to prevent future attacks. We also show that our proposed model is implacable towards advanced post-quantum cryptography-based traffic and also able to analyse side-channel attacks. We run a comprehensive set of experiments to test PETRAK on our synthesized dataset, KDDCUP’99 dataset, CIC-MalMem-2022, and the ToN-IoT dataset. We observe that PETRAK shows an accuracy of 99%. The results claim the efficiency of PETRAK in detecting and preventing DDoS attacks in vehicular networks.

Intrusion Detection System

Our project introduces an Integrated Intrusion Detection System (IDS) designed to bolster network and system security through a multi-faceted approach. This comprehensive IDS seamlessly combined Machine Learning, Anomaly Detection, File Scanning, and DDoS Prevention mechanisms to offer robust defense against diverse cyber threats. At the heart of the system lies the Machine Learning component, which continuously adapts to the evolving threat landscape. By analyzing network traffic and system behavior, it identifies both known and emerging threats in real-time, reducing reliance on traditional signature-based detection methods and allowing organizations to proactively stay ahead of cybercriminals. Anomaly Detection constantly monitors network and system activity, comparing it against established baselines. Any deviations from these baselines trigger alerts, facilitating swift responses to unusual activities that may indicate security breaches. File Scanning is another vital component ensuring data integrity and preventing malware infiltration or data exfiltration. It conducts thorough file analysis, checking for suspicious code, behavior, or unauthorized access, and offers continuous monitoring to detect anomalies in real-time. Additionally, our IDS includes Distributed Denial of Service (DDoS) Prevention mechanisms. By detecting and mitigating DDoS attacks, the system ensures the continuous availability of network resources and services even under intense traffic loads. This integrated approach to intrusion detection and prevention leverages Machine Learning, Honeypots, Anomaly Detection, File Scanning, and DDoS Prevention, empowering organizations to safeguard critical assets, maintain data integrity, and ensure network security in today's dynamic and perilous digital landscape. Our IDS solution serves as a valuable addition to the cybersecurity toolkit for organizations seeking comprehensive security against a wide range of threats.

Predicting DoS and DDoS attacks in network security scenarios using a hybrid deep learning model

Abstract Network security faces increasing threats from denial of service (DoS) and distributed denial of service (DDoS) attacks. The current solutions have not been able to predict and mitigate these threats with enough accuracy. A novel and effective solution for predicting DoS and DDoS attacks in network security scenarios is presented in this work by employing an effective model, called CNN-LSTM-XGBoost, which is an innovative hybrid approach designed for intrusion detection in network security. The system is applied and analyzed to three datasets: CICIDS-001, CIC-IDS2017, and CIC-IDS2018. We preprocess the data by removing null and duplicate data, handling imbalanced data, and selecting the most relevant features using correlation-based feature selection. The system is evaluated using accuracy, precision, F1 score, and recall. The system achieves a higher accuracy of 98.3% for CICIDS-001, 99.2% for CICIDS2017, and 99.3% for CIC-ID2018, compared to other existing algorithms. The system also reduces the overfitting of the model using the most important features. This study shows that the proposed system is an effective and efficient solution for network attack detection and classification.

KS-SDN-DDoS: A Kafka streams-based real-time DDoS attack classification approach for SDN environment

 Software-Defined Networking (SDN) is a modern networking architecture that segregates control logic from data plane and supports a loosely coupled architecture. It provides flexibility in this advanced networking paradigm for any changes. Further, it controls the complete network in a centralized using controller(s). However, it comes with several security issues: Exhausting bandwidth and flow tables, Distributed Denial of Service (DDoS) attacks, etc. DDoS is a powerful attack for Internet-based applications and services, traditional and SDN paradigms. In the case of the SDN environment, attackers frequently target the central controller(s). This paper proposes a Kafka Streams-based real-time DDoS attacks classification approach for the SDN environment, named KS-SDN-DDoS. The KS-SDN-DDoS has been designed using highly scalable H2O ML techniques on the two-node Apache Hadoop Cluster (AHC). It consists of two modules: (i) Network Traffic Capture (NTCapture) and (ii) Attack Detection and Traffic Classification (ADTClassification). The NTCapture is deployed on the two nodes Apache Kafka Streams Cluster (AKSC-1). It captures incoming network traffic, extracts and formulates attributes, and publishes significant network traffic attributes on the Kafka topic. The ADTClassification is deployed on the two nodes Apache Kafka Streams Cluster (AKSC-2). It consumes network flows from the Kafka topic, classifies it based on the ten attributes, and publishes it to the decision Kafka topic. Further, it saves attributes with outcome to the Hadoop Distributed File System (HDFS). The KS-SDN-DDoS approach is designed and validated using the recent “DDoS Attack SDN dataset”. The result shows that the proposed system gives better classification accuracy (100%).

Enhancing DDoS Attack Detection and Network Resilience Through Ensemble-Based Packet Processing and Bandwidth Optimization

It is critical to identify Distributed Denial of Service (DDoS) attacks to preserve network integrity and guarantee continuous service delivery. Our research suggests a novel way to lower the network's packet drop ratio and improve the accuracy of DDoS attack detection. Conventional techniques occasionally just use anomaly detection or signature-based detection, which might not be sufficient to protect against DDoS assault schemes that are always changing. To increase the precision and resilience of DDoS detection, our system incorporates several detection strategies, such as signature-based, anomaly-based, and machine learning-based techniques. Additionally, we use network traffic analysis and anomaly detection tools to quickly discover and block harmful traffic patterns. During suspected DDoS attempts, we dynamically modify network parameters and reroute data to reduce the packet drop ratio and maintain service for authorized users. Additionally, our system has feedback systems that allow us to continuously adjust and improve detection algorithms, improving the overall dependability and effectiveness of DDoS attack detection. We illustrate how successfully our method lowers packet drop ratios and strengthens network resilience against DDoS attacks using both simulation and real-world experience.

Smart network security using advanced ensemble-DDoS attack detection and hybrid JA-SLOA-linked optimal routing-based mitigation

ABSTRACT Distributed Denial of Service (DDoS) attacks are distributed at a faster rate, and they are considered to be fatal threats over the Internet. Moreover, several deep learning approaches are insufficient to attain the maximum efficiency and appropriate detection due to the complexity and diversity of DDoS attack traffic under fast fast-speed network environment since they are providing with individual performance. Hence, an ensemble learning model is developed for DDoS detection and mitigation with the hybrid optimization algorithm to ensure good detective performance against DDoS attacks. The pre-processed data is fed to the feature extraction process where it is done through the Deep Belief Network (DBN) and Autoencoder techniques for acquiring the deep features. The optimized fusion of deep features takes place using hybrid meta-heuristic algorithm of Adaptive Sound Speed-based Jaya Sea Lion Optimization (ASS-JSLnO). The attack detection is performed by the Improved Ensemble Learning (IEL) approach. Then, the mitigation strategy is applied by the optimal routing and multi-objective function. Finally, the experiments are made to establish the high detection efficacy of the implemented attack detection and mitigation framework.

Enhancing Multi-Class DDoS Attack Classification using Machine Learning Techniques

Distributed Denial of Service (DDoS) attacks, which adversely impact network availability, confidentiality, and integrity, represent a persistent threat. These attacks involve affected systems consuming resources through spurious requests instead of serving legitimate clients. Various methodologies exist for detecting and mitigating DDoS attacks, with Machine Learning (ML) emerging as a particularly effective approach due to its predictive capabilities after training on pertinent data. The primary objective of this study is to identify an improved ML algorithm for the detection of multiple DDoS types, considering metrics such as accuracy, precision, recall, and training time. Leveraging WEKA tools and the CICDDoS2019 dataset, several machine-learning algorithms, including Multilayer Perceptron, Reduced Error Pruning (REP) Tree, Partial Decision Tree (PART), RandomForest, and J48, were trained and evaluated. Among these, J48 was determined to be the superior algorithm for classifying four DDoS types (UDP, SYN, Portmap, MSSQL), based on the aforementioned criteria. The algorithms were experimented with using diverse sets of features, and optimal results were obtained using six features, resulting in an overall accuracy of 99.97%. Subsequently, the selected algorithm was integrated into a real-time model, exhibiting exceptional performance, which will be thoroughly elucidated and discussed in a forthcoming paper.

Cyber security Vulnerabilities and Remediation Through Cloud Security Tools

The proliferation of internet usage has surged dramatically, prompting individuals and businesses to conduct myriad transactions online rather than in physical spaces. The onset of the COVID-19 pandemic has further propelled this trend. Consequently, traditional forms of crime have migrated to the digital realm alongside the widespread adoption of digital technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and crypto currencies, amplifying security concerns in cyberspace. Notably, cybercriminals have begun offering cyber attacks as a service, automating attacks to magnify their impact. These attackers exploit vulnerabilities across hardware, software, and communication layers, perpetrating various forms of cyber attacks including distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware attacks. The sophistication of these attacks renders conventional protection systems, such as firewalls, intrusion detection systems, antivirus software, and access control lists, ineffective in detection. Consequently, there is an urgent imperative to devise innovative and pragmatic solutions to thwart cyber attacks. This paper elucidates the primary drivers behind cyber attacks, surveys recent attack instances, patterns, and detection methodologies, and explores contemporary technical and non-technical strategies for preemptively identifying and mitigating attacks. Leveraging cutting-edge technologies like machine learning, deep learning, cloud platforms, big data analytics, and blockchain holds promise in combating present and future cyber threats. These technological interventions can aid in malware detection, intrusion detection, spam filtering, DNS attack classification, fraud detection, identification of covert channels, and discernment of advanced persistent threats. Nonetheless, it's crucial to acknowledge that some promising solutions, notably machine learning and deep learning, are susceptible to evasion techniques, necessitating careful consideration when formulating defenses against sophisticated cyber attacks.

Cyber security Vulnerabilities and Remediation Through Cloud Security Tools

The proliferation of internet usage has surged dramatically, prompting individuals and businesses to conduct myriad transactions online rather than in physical spaces. The onset of the COVID-19 pandemic has further propelled this trend. Consequently, traditional forms of crime have migrated to the digital realm alongside the widespread adoption of digital technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and crypto currencies, amplifying security concerns in cyberspace. Notably, cybercriminals have begun offering cyber attacks as a service, automating attacks to magnify their impact. These attackers exploit vulnerabilities across hardware, software, and communication layers, perpetrating various forms of cyber attacks including distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware attacks. The sophistication of these attacks renders conventional protection systems, such as firewalls, intrusion detection systems, antivirus software, and access control lists, ineffective in detection. Consequently, there is an urgent imperative to devise innovative and pragmatic solutions to thwart cyber attacks. This paper elucidates the primary drivers behind cyber attacks, surveys recent attack instances, patterns, and detection methodologies, and explores contemporary technical and non-technical strategies for preemptively identifying and mitigating attacks. Leveraging cutting-edge technologies like machine learning, deep learning, cloud platforms, big data analytics, and blockchain holds promise in combating present and future cyber threats. These technological interventions can aid in malware detection, intrusion detection, spam filtering, DNS attack classification, fraud detection, identification of covert channels, and discernment of advanced persistent threats. Nonetheless, it's crucial to acknowledge that some promising solutions, notably machine learning and deep learning, are susceptible to evasion techniques, necessitating careful consideration when formulating defenses against sophisticated cyber attacks.

A Blockchain-Assisted Security Protocol for Group Handover of MTC Devices in 5G Wireless Networks.

In the realm of the fifth-generation (5G) wireless cellular networks, renowned for their dense connectivity, there lies a substantial facilitation of a myriad of Internet of Things (IoT) applications, which can be supported by the massive machine-type communication (MTC) technique, a fundamental communication framework. In some scenarios, a large number of machine-type communication devices (MTCD) may simultaneously enter the communication coverage of a target base station. However, the current handover mechanism specified by the 3rd Generation Partnership Project (3GPP) Release 16 incurs high signaling overhead within the access and core networks, which may have negative impacts on network efficiency. Additionally, other existing solutions are vulnerable to malicious attacks such as Denial of Service (DoS), Distributed Denial of Service (DDoS) attacks, and the failure of Key Forward Secrecy (KFS). To address this challenge, this paper proposes an efficient and secure handover authentication protocol for a group of MTCDs supported by blockchain technology. This protocol leverages the decentralized nature of blockchain technology and combines it with certificateless aggregate signatures to mutually authenticate the identity of a base station and a group of MTCDs. This approach can reduce signaling overhead and avoid key escrow while significantly lowering the risk associated with single points of failure. Additionally, the protocol protects device anonymity by encrypting device identities with temporary anonymous identity markers with the Elliptic Curve Diffie-Hellman (ECDH) to abandon serial numbers to prevent linkage attacks. The resilience of the proposed protocol against predominant malicious attacks has been rigorously validated through the application of the BAN logic and Scyther tool, underscoring its robust security attributes. Furthermore, compared to the existing solutions, the proposed protocol significantly reduces the authentication cost for a group of MTCDs during handover, while ensuring security, demonstrating commendable efficiency.

Adversarially robust and real-time DDoS detection and classification framework using AutoML

ABSTRACT Denial of Service (DoS) attacks target the availability part of the CIA triad (Confidentiality, Availability, and Integrity). A special category of these attacks is the Distributed DoS (DDoS) attack, where the attacker uses a network of compromised systems called a botnet to flood a target server with requests and refuses to serve legitimate users. DDoS attacks can cost an organization millions of dollars in terms of lost revenue, remediation costs, and damage to brand reputation. Hence, all organizations need speedy real-time detection of DDoS attacks. This work presents a DDoS detection and classification framework using the flow-based approach for feature engineering and the AutoML technique. Our detection system is trained on the latest DDoS datasets – CIC-DDoS 2019 and CIC-IDS 2017, which contain various categories of DDoS attacks. We use various tools to perform adversarial attacks on our trained model. We retrain our models using adversarially crafted network packet captures and then test our models for robustness against practical adversarial attacks that an attacker might use to evade detection. Finally, we deploy our model in real-time using a GUI-based tool. Our model achieves a validation accuracy of 99.9% and a low false positive rate of 0.05%.

SDN-Based Secure Common Emergency Service for Railway and Road Co-Existence Scenarios

In the near future, there will be a greater emphasis on sharing network resources between roads and railways to improve transportation efficiency and reduce infrastructure costs. This could enable the development of global Cooperative Intelligent Transport Systems (C-ITSs). In this paper, a software-defined networking (SDN)-based common emergency service is developed and validated for a railway and road telecommunication shared infrastructure. Along with this, the developed application is capable of reducing the chances of distributed denial-of-service (DDoS) situations. A level-crossing scenario is considered to demonstrate the developed solution where railway tracks are perpendicular to the roads. Two cases are considered to validate and analyze the developed SDN application for common emergency scenarios. In case 1, no cross-communication is available between the road and railway domains. In this case, emergency message distribution is carried out by the assigned emergency servers with the help of the SDN controller. In case 2, nodes (cars and trains) are defined with two wireless interfaces, and one interface is reserved for emergency data communication. To add the DDoS resiliency to the developed system the messaging behavior of each node is observed and if an abnormality is detected, packets are dropped to avoid malicious activity.