Distributed Denial Of Service Research Articles

Energy efficiency in 5G systems: A systematic literature review

To ensure Energy Efficiency (EE) and better Quality of service (QoS), it is necessary to analyze the energy saving possibilities for low resource utilization in the current networks caused by rigorous QoS requirements and implementing EE approach in the planned model for performance improvement. Distributed Denial of Service (DDoS) attacks aim to exhaust the network’s processing and communication capacity by saturating it with packets and generating malicious traffic. There are numerous advantages that make Digital Twin (DT) and Intrusion Detection technique (ID) an effective remedy for a range of (fifth generation) 5G problems. A DDoS attack must be immediately detected and stopped before a legitimate user can access the target of the attacker for the 5G network to provide an efficient energy service. Although they clearly show promise in assisting with the creation and implementation of the challenging 5G environment, Digital Twins is still a relatively new technology for 5G networks but will increase EE. In this research, a thorough examination of the materials was carried out to identify the most cutting-edge DT and ID methods. The purpose of this study was to comprehend the problems with Energy Efficiency, the need for DT, and the methods for dealing with large-scale attack by DDoS on Energy Efficient networks. Only 94 of the 1555 articles produced by the procedure were determined to be relevant using inclusion and exclusion criteria. The outcome demonstrates that in 5G networks, DT, and its fundamental approaches, like QoS and DDoS attack mitigation, can be used to regulate the network’s Energy Efficiency. Numerous practical applications focusing on 5G Systems use their own principles. The effectiveness of these strategies was evaluated using several assessment criteria, including DT, Intrusion Detection, QoS, Energy Efficiency, and 5G Systems. Each study issue is thoroughly explained, along with typical methods, advantages, disadvantages, and performance metrics. Energy economy, network reliability, privacy, and cost reduction are all considerably increased by the implementation of intrusion detection technology in 5G systems. The decision is supported by the technology’s demonstrated efficacy, scalability, real-time detection capacities, low error level, and personalized learning attributes, all of which contribute to the long-term viability of 5G networks as an entire system.

A Comparative Review on DDoS Attack Detection Using Machine Learning Techniques

The rapid growth of the internet and the increasing reliance on digital infrastructures have posed significant challenges to cybersecurity. Among the other variants of attacks, Distributed Denial of Service (DDoS) attacks have emerged as one of the most destructive and common threats. These attacks disrupt or slow down network services by overwhelming the network infrastructure with a massive volume of malicious traffic. To effectively identify and mitigate DDoS attacks, machine learning techniques have been extensively employed in intrusion detection systems. Machine learning approaches offer the advantage of automating the detection process by learning patterns and characteristics of DDoS attacks from historical data. Researchers have explored various machine learning algorithms such as K-Nearest Neighbours (KNN), Support Vector Machine (SVM), Random Forest (RF), and Naïve Bayes to classify and detect DDoS attacks. These algorithms leverage features extracted from network traffic data, including packet size, packet delay patterns, and traffic behaviour, to differentiate between normal and malicious traffic.

Drift Adaptive Online DDoS Attack Detection Framework for IoT System

Internet of Things (IoT) security is becoming important with the growing popularity of IoT devices and their wide applications. Recent network security reports revealed a sharp increase in the type, frequency, sophistication, and impact of distributed denial of service (DDoS) attacks on IoT systems, making DDoS one of the most challenging threats. DDoS is used to commit actual, effective, and profitable cybercrimes. The current machine learning-based IoT DDoS attack detection systems use batch learning techniques, and hence are unable to maintain their performance over time in a dynamic environment. The dynamicity of heterogeneous IoT data causes concept drift issues that result in performance degradation and automation difficulties in detecting DDoS. In this study, we propose an adaptive online DDoS attack detection framework that detects and adapts to concept drifts in streaming data using a number of features often used in DDoS attack detection. This paper also proposes a novel accuracy update weighted probability averaging ensemble (AUWPAE) approach to detect concept drift and optimize zero-day DDoS detection. We evaluated the proposed framework using IoTID20 and CICIoT2023 dataset containing benign and DDoS traffic data. The results show that the proposed adaptive online DDoS attack detection framework is able to detect DDoS attacks with an accuracy of 99.54% and 99.33% for the respective datasets.

An optimal secure defense mechanism for DDoS attack in IoT network using feature optimization and intrusion detection system

Now, the Cyber security is facing unprecedented difficulties as a result of the proliferation of smart devices in the Internet of Things (IoT) environment. The rapid growth in the number of Internet users over the past two decades has increased the need for cyber security. Users have provided new opportunities for attackers to do harm. Limited security budgets leave IoT devices vulnerable and easily hacked to launch distributed denial-of-service (DDoS) attacks, with disastrous results. Unfortunately, due to the unique nature of the Internet of Things environment, most security solutions and intrusion detection systems (IDS) cannot be directly adapted to the IoT with acceptable security performance and are vulnerable to various attacks that do not benefit. In this paper we propose an optimal secure defense mechanism for DDoS in IoT network using feature optimization and intrusion detection system (OSD-IDS). In OSD-IDS mechanism, first we introduce an enhanced ResNet architecture for feature extraction which extracts more deep features from given traffic traces. An improved quantum query optimization (IQQO) algorithm for is used feature selection to selects optimal best among multiple features which reduces the data dimensionality issues. The selected features have given to the detection and classification module to classify the traffic traces are affected by intrusion or not. For this, we design a fast and accurate intrusion detection mechanism, named as hybrid deep learning technique which combines convolutional neural network (CNN) and diagonal XG boosting (CNN-DigXG) for the fast and accurate intrusion detection in IoT network. Finally, we validate the performance of proposed technique by using different benchmark datasets are BoNeSi-SlowHTTPtest and CIC-DDoS2019. The simulation results of proposed IDS mechanism are compared with the existing state-of-art IDS mechanism and analyze the performance with respects to different statistical measures. The results show that the DDoS detection accuracy of proposed OSD-IDS mechanism is high as 99.476% and 99.078% for BoNeSi-SlowHTTPtest, CICDDoS2019, respectively.

ML-Based Detection of DDoS Attacks Using Evolutionary Algorithms Optimization.

The escalating reliance of modern society on information and communication technology has rendered it vulnerable to an array of cyber-attacks, with distributed denial-of-service (DDoS) attacks emerging as one of the most prevalent threats. This paper delves into the intricacies of DDoS attacks, which exploit compromised machines numbering in the thousands to disrupt data services and online commercial platforms, resulting in significant downtime and financial losses. Recognizing the gravity of this issue, various detection techniques have been explored, yet the quantity and prior detection of DDoS attacks has seen a decline in recent methods. This research introduces an innovative approach by integrating evolutionary optimization algorithms and machine learning techniques. Specifically, the study proposes XGB-GA Optimization, RF-GA Optimization, and SVM-GA Optimization methods, employing Evolutionary Algorithms (EAs) Optimization with Tree-based Pipelines Optimization Tool (TPOT)-Genetic Programming. Datasets pertaining to DDoS attacks were utilized to train machine learning models based on XGB, RF, and SVM algorithms, and 10-fold cross-validation was employed. The models were further optimized using EAs, achieving remarkable accuracy scores: 99.99% with the XGB-GA method, 99.50% with RF-GA, and 99.99% with SVM-GA. Furthermore, the study employed TPOT to identify the optimal algorithm for constructing a machine learning model, with the genetic algorithm pinpointing XGB-GA as the most effective choice. This research significantly advances the field of DDoS attack detection by presenting a robust and accurate methodology, thereby enhancing the cybersecurity landscape and fortifying digital infrastructures against these pervasive threats.

Effective Intrusion Detection System Using Deep Learning for DDoS Attacks

An increasing demand for information technology and cloud computing has led to various security threats over internet. Amongst all types of threats, Distributed Denial of Service (DDoS) attacks are the most common, posing a challenge to a cyber security. It allows unauthorized users to gain access to services, and preventing authorized users. Traditional intrusion detection, antivirus software, and firewalls are not enough to detect these attacks. This paper proposed an efficient deep learning-based intrusion detection system (IDS) for DDoS attacks detection. Proposed model is a hybrid CNN-LSTM model which is combination of best DL algorithms to take advantage of CNN to extract spatial features and LSTM to extract temporal features. The real-time DDoS-specific benchmark-dataset CICDDoS2019 used for training, testing, and validation. An autoencoder has been used for dimensionality reduction, and SMOTE method is used to balance the minority class of dataset. The experimental results proved that the model outperforms than other state-of-the-art models, with an accuracy score of 99.86%.

Secure Enhancement for MQTT Protocol Using Distributed Machine Learning Framework.

The Message Queuing Telemetry Transport (MQTT) protocol stands out as one of the foremost and widely recognized messaging protocols in the field. It is often used to transfer and manage data between devices and is extensively employed for applications ranging from smart homes and industrial automation to healthcare and transportation systems. However, it lacks built-in security features, thereby making it vulnerable to many types of attacks such as man-in-the-middle (MitM), buffer overflow, pre-shared key, brute force authentication, malformed data, distributed denial-of-service (DDoS) attacks, and MQTT publish flood attacks. Traditional methods for detecting MQTT attacks, such as deep neural networks (DNNs), k-nearest neighbor (KNN), linear discriminant analysis (LDA), and fuzzy logic, may exist. The increasing prevalence of device connectivity, sensor usage, and environmental scalability become the most challenging aspects that novel detection approaches need to address. This paper presents a new solution that leverages an H2O-based distributed machine learning (ML) framework to improve the security of the MQTT protocol in networks, particularly in IoT environments. The proposed approach leverages the strengths of the H2O algorithm and architecture to enable real-time monitoring and distributed detection and classification of anomalous behavior (deviations from expected activity patterns). By harnessing H2O's algorithms, the identification and timely mitigation of potential security threats are achieved. Various H2O algorithms, including random forests, generalized linear models (GLMs), gradient boosting machine (GBM), XGBoost, and the deep learning (DL) algorithm, have been assessed to determine the most reliable algorithm in terms of detection performance. This study encompasses the development of the proposed algorithm, including implementation details and evaluation results. To assess the proposed model, various evaluation metrics such as mean squared error (MSE), root-mean-square error (RMSE), mean per class error (MCE), and log loss are employed. The results obtained indicate that the H2OXGBoost algorithm outperforms other H2O models in terms of accuracy. This research contributes to the advancement of secure IoT networks and offers a practical approach to enhancing the security of MQTT communication channels through distributed detection and classification techniques.

SECURING MOBILE AD-HOC NETWORKS USING ROBUST SECURED IPS ROUTING APPROACH THROUGH ATTACK IDENTIFICATION AND ELIMINATION IN MANETS

Mobile Ad-hoc Networks (MANETs) are susceptible to various security threats due to their decentralized and dynamic nature. Among these threats, Distributed Denial of Service (DDoS) and sibling attacks pose significant challenges to the integrity and availability of network services. This paper presents a novel approach for securing MANETs against DDoS and sibling attacks through a robust Intrusion Prevention System (IPS) integrated with a secured routing mechanism. The proposed methodology leverages residual transfer learning to adapt a pre-trained model for intrusion detection to the MANET environment, enhancing its effectiveness in identifying and mitigating attacks. The problem of securing MANETs against DDoS and sibling attacks is exacerbated by the lack of centralized infrastructure and the dynamic topology of the network. Traditional security mechanisms designed for wired networks are often ineffective in MANETs due to their reliance on centralized control and communication. This research addresses this gap by proposing an IPS solution tailored specifically for MANETs, capable of detecting and preventing attacks without relying on centralized coordination. By utilizing residual transfer learning, the proposed methodology addresses the challenge of limited labeled data in the MANET domain. Transfer learning enables the adaptation of knowledge from a pre-trained model on non-MANET data to improve the performance of intrusion detection in MANET environments. The integration of the IPS with a secured routing approach ensures that detected attacks are efficiently handled within the network, minimizing their impact on performance and ensuring continued operation. Experimental results demonstrate the effectiveness of the proposed approach in mitigating DDoS and sibling attacks in MANETs. The integrated solution achieves high detection rates while minimizing false positives, thereby enhancing the security and resilience of MANETs against evolving threats.

A novel multi-scale CNN and Bi-LSTM arbitration dense network model for low-rate DDoS attack detection

Low-rate distributed denial of service attacks, as known as LDDoS attacks, pose the notorious security risks in cloud computing network. They overload the cloud servers and degrade network service quality with the stealthy strategy. Furthermore, this kind of small ratio and pulse-like abnormal traffic leads to a serious data scale problem. As a result, the existing models for detecting minority and adversary LDDoS attacks are insufficient in both detection accuracy and time consumption. This paper proposes a novel multi-scale Convolutional Neural Networks (CNN) and bidirectional Long-short Term Memory (bi-LSTM) arbitration dense network model (called MSCBL-ADN) for learning and detecting LDDoS attack behaviors under the condition of limited dataset and time consumption. The MSCBL-ADN incorporates CNN for preliminary spatial feature extraction and embedding-based bi-LSTM for time relationship extraction. And then, it employs arbitration network to re-weigh feature importance for higher accuracy. At last, it uses 2-block dense connection network to perform final classification. The experimental results conducted on popular ISCX-2016-SlowDos dataset have demonstrated that the proposed MSCBL-ADN model has a significant improvement with high detection accuracy and superior time performance over the state-of-the-art models.

A lightweight Intrusion Detection for Internet of Things‐based smart buildings

AbstractThe integration of Internet of Things (IoT) devices into commercial or industrial buildings to create smart environments, such as Smart Buildings (SBs), has enabled real‐time data collection and processing to effectively manage building operations. Due to poor security design and implementation in IoT devices, SB networks face an array of security challenges and threats (e.g., botnet malware) that leverage IoT devices to conduct Distributed Denial of Service (DDoS) attacks on the Internet infrastructure. Machine Learning (ML)‐based traffic classification systems aim to automatically detect such attacks by effectively differentiating attacks from benign traffic patterns in IoT networks. However, there is an inherent accuracy‐efficiency tradeoff in network traffic classification tasks. To balance this tradeoff, we develop an accurate yet lightweight device‐specific traffic classification model. This model classifies SB traffic flows into four types of coarse‐grained flows, based on the locations of traffic sources and the directions of traffic transmissions. Through these four types of coarse‐grained flows, the model can extract simple yet effective flow rate features to conduct learning and predictions. Our experiments find the model to achieve an overall accuracy of 96%, with only 32 features to be learned by the ML model.

Research on Detection and Defense Methods for Software‐Defined Network Architecture after Hybrid Attack by Distributed Denial of Service

The architecture of software‐defined network (SDN)enhances the openness of the network by separating the control and forwarding functions, but the centralized SDN control form is susceptible to distributed denial of service (DDoS) attacks. In this paper, entropy value and back‐propagation neural network (BPNN) were applied to the DDoS attack detection of SDN, and then the two detection algorithms were simulated in MATLAB software and compared with the K‐means algorithm. The results showed that in the face of four DDoS attacks, SYN Flood, ACK Flood, UDP Flood and ICMP Flood, the BPNN‐based DDoS detection had higher accuracy and less detection time; the switch that adopted the BPNN‐based DDoS detection algorithm adjusted the traffic ratio back to normal level faster when facing DDoS attacks, reducing the impact on other switches and maintaining the traffic stability of the network. © 2024 Institute of Electrical Engineers of Japan. Published by Wiley Periodicals LLC.

DDOS Attack Detection

A Distributed Denial of Service (DDoS) attack is an attempt to make a service unavailable by overwhelming the server with malicious traffic. DDoS attacks have become the most tedious and cumbersome issue in recent past. The number and magnitude of attacks have increased from few megabytes of data to 100s of terabytes of data these days. Due to the differences in the attack patterns or new types of attack, it is hard to detect these attacks effectively. In this paper, we devise new techniques for causing DDoS attacks and mitigation which are clearly shown to perform much better than the existing techniques. We also categorize DDoS attack techniques as well as the techniques used in their detection and thus attempt an extensive scoping of the DDoS problem. We also compare our attack module with a couple of tools available

Comparing Metaheuristic Search Techniques in Addressing the Effectiveness of Clustering-Based DDoS Attack Detection Methods

Distributed Denial of Service (DDoS) attacks have increased in frequency and sophistication over the last ten years. Part of the challenge of defending against such attacks requires the analysis of very large volumes of data. Metaheuristic algorithms can assist in selecting relevant features from the network traffic data for use in DDoS detection models. By efficiently exploring different combinations of features, these methods can identify subsets that are informative for distinguishing between normal and attack traffic. However, identifying an optimized solution in this area is an open research question. Tuning the parameters of metaheuristic search techniques in the optimization process is critical. In this study, a switching approximation is used in a variety of metaheuristic search techniques. This approximation is used to find the best solution for the analysis of the network traffic features in either lower or upper values between 0 and 1. We compare the fine-tuning of this parameter against standard approaches and find that it is not substantially better than the BestFirst algorithm (a standard default approach for feature selection). This study contributes to the literature by testing and eliminating various fine-tuning strategies for the metaheuristic approach.

Ensembling Supervised and Unsupervised Machine Learning Algorithms for Detecting Distributed Denial of Service Attacks

The distributed denial of service (DDoS) attack is one of the most pernicious threats in cyberspace. Catastrophic failures over the past two decades have resulted in catastrophic and costly disruption of services across all sectors and critical infrastructure. Machine-learning-based approaches have shown promise in developing intrusion detection systems (IDSs) for detecting cyber-attacks, such as DDoS. Herein, we present a solution to detect DDoS attacks through an ensemble-based machine learning approach that combines supervised and unsupervised machine learning ensemble frameworks. This combination produces higher performance in detecting known DDoS attacks using supervised ensemble and for zero-day DDoS attacks using an unsupervised ensemble. The unsupervised ensemble, which employs novelty and outlier detection, is effective in identifying prior unseen attacks. The ensemble framework is tested using three well-known benchmark datasets, NSL-KDD, UNSW-NB15, and CICIDS2017. The results show that ensemble classifiers significantly outperform single-classifier-based approaches. Our model with combined supervised and unsupervised ensemble models correctly detects up to 99.1% of the DDoS attacks, with a negligible rate of false alarms.

GEMLIDS-MIOT: A Green Effective Machine Learning Intrusion Detection System based on Federated Learning for Medical IoT network security hardening

The increasing use of Internet of Things (IoT) gadgets in a daily rate has heightened security apprehension, particularly within the healthcare sector. In order to prevent the unauthorized disclosure of sensitive data, it is imperative for Internet of Things (IoT) systems to promptly and effectively respond to harmful activities. Nevertheless, the act of transferring data to distant cloud servers for the purpose of analysis gives rise to both temporal delays and apprehensions regarding privacy. To ensure the security of medical Internet of Things (MIoT) networks, a power-efficient Intrusion Detection System (IDS) is employed for three primary objectives that it will result in three stages of execution: (i) The objective is to categorize different types of attacks, such as Man-in-the-Middle (MitM) and Distributed Denial of Service (DDoS), by utilizing well-established machine learning (ML) techniques. This classification stage will serve to enhance the Intrusion Detection System (IDS) and the reporting system. (ii) Anomaly detection (unknown attack identification), or detection of unknown attacks, will be employed to identify previously unknown attacks. This identification stage involves retraining the ML model to enable future recognition and classification of these unknown attacks when the anomaly attack detector identifies that an unknown attack is recognized. Then, a retraining of the first stage classification model is executed due to the anomaly detection. (iii) To ensure that a remote cloud server remains current with the latest classification model changes, Federated Learning (FL) will be utilized. FL allows for collaborative model training while preserving data privacy and security. The experimental findings indicate that the Enhanced Random Forest (also called ensemble random forest) algorithm achieves a remarkable accuracy rate of 99.98% in classifying attacks. Thus, it will be our first stage classifier. Continuing, the One-Class Support Vector Machine (SVM) algorithm demonstrates a high level of accuracy, reaching 99.7% in detecting anomalies so that it will be our second stage identifier. Finally, the third-stage approach, which has as a target the overall system model updater, will be our introduced Federated Learning approach that works with the Enhanced Random Forests and identifies the ERF differences from the old model in an optimal way. The efficacy of our technique is confirmed through the implementation of experiments involving an Internet of Things (IoT) system and a Raspberry Pi MIoT gateway and with simulations that simulate the FL updating process. These experiments successfully identify known and unknown attacks with a high reliability level while limiting resource utilization and energy consumption. Future studies of this work will focus on enhancing the scalability and efficiency of our Intrusion Detection System in MIoT networks.

IOT COMMUNICATION SECURITY: CHALLENGES AND SOLUTIONS

This paper investigates the obstacles and resolutions concerning the security of communicationin the Internet of Things (IoT). It commences with a discussion of the remarkable proliferationof internet-connected devices, ranging from personal computers to mobile devices, and now tothe era of IoT and IoE. The paper illuminates the impact of IoT on network addresses, leading tothe depletion of IPv4 addresses and the necessity for address translation services. Subsequently,the article delves into the risks confronted by IoT systems, encompassing physical and digitalassaults, unauthorized access, system failures, as well as diverse forms of malicious software. Thesignificance of IoT security in industrial and agricultural systems is underscored. Finally, the paperconcludes by presenting strategies to combat these risks, including antivirus countermeasures,safeguards against Distributed Denial-of-Service (DDoS) attacks, and security considerations inIoT systems for agriculture. In essence, this paper offers valuable insights into the challenges andsolutions associated with ensuring the security of IoT communication.

SecEG: A Secure and Efficient Strategy against DDoS Attacks in Mobile Edge Computing

Application-layer distributed denial-of-service (DDoS) attacks incapacitate systems by using up their resources, causing service interruptions, financial losses, and more. Consequently, advanced deep-learning techniques are used to detect and mitigate these attacks in cloud infrastructures. However, in mobile edge computing (MEC), it becomes economically impractical to equip each node with defensive resources, as these resources may largely remain unused in edge devices. Furthermore, current methods are mainly concentrated on improving the accuracy of DDoS attack detection and saving CPU resources, neglecting the effective allocation of computational power for benign tasks under DDoS attacks. To address these issues, this paper introduces SecEG, a secure and efficient strategy against DDoS attacks for MEC that integrates container-based task isolation with lightweight online anomaly detection on edge nodes. More specifically, a new model is proposed to analyze resource contention dynamics between DDoS attacks and benign tasks. Subsequently, by employing periodic packet sampling and real-time attack intensity predicting, an autoencoder-based method is proposed to detect DDoS attacks. We leverage an efficient scheduling method to optimize the edge resource allocation and the service quality for benign users during DDoS attacks. When executed in the real-world edge environment, our experimental findings validate the efficacy of the proposed SecEG strategy. Compared to conventional methods, the service rate of benign requests increases by 23% under intense DDoS attacks, and the CPU resource is saved up to 35%.

Toward a Real-Time TCP SYN Flood DDoS Mitigation Using Adaptive Neuro-Fuzzy Classifier and SDN Assistance in Fog Computing

The growth of the Internet of Things (IoT) has recently impacted our daily lives in many ways. As a result, a massive volume of data are generated and need to be processed in a short period of time. Therefore, a combination of computing models such as cloud computing is necessary. The main disadvantage of the cloud platform is its high latency due to the centralized mainframe. Fortunately, a distributed paradigm known as fog computing has emerged to overcome this problem, offering cloud services with low latency and high-access bandwidth to support many IoT application scenarios. However, attacks against fog servers can take many forms, such as distributed denial of service (DDoS) attacks that severely affect the reliability and availability of fog services. To address these challenges, we propose mitigation of fog computing-based SYN Flood DDoS attacks using an adaptive neuro-fuzzy inference system (ANFIS) and software defined networking (SDN) assistance (FASA). The simulation results show that the FASA system outperforms other algorithms in terms of accuracy, precision, recall, and F1-score. This shows how crucial our system is for detecting and mitigating TCP-SYN floods and DDoS attacks.

Novel Machine Learning Approach for DDoS Cloud Detection: Bayesian-Based CNN and Data Fusion Enhancements.

Cloud computing has revolutionized the information technology landscape, offering businesses the flexibility to adapt to diverse business models without the need for costly on-site servers and network infrastructure. A recent survey reveals that 95% of enterprises have already embraced cloud technology, with 79% of their workloads migrating to cloud environments. However, the deployment of cloud technology introduces significant cybersecurity risks, including network security vulnerabilities, data access control challenges, and the ever-looming threat of cyber-attacks such as Distributed Denial of Service (DDoS) attacks, which pose substantial risks to both cloud and network security. While Intrusion Detection Systems (IDS) have traditionally been employed for DDoS attack detection, prior studies have been constrained by various limitations. In response to these challenges, we present an innovative machine learning approach for DDoS cloud detection, known as the Bayesian-based Convolutional Neural Network (BaysCNN) model. Leveraging the CICDDoS2019 dataset, which encompasses 88 features, we employ Principal Component Analysis (PCA) for dimensionality reduction. Our BaysCNN model comprises 19 layers of analysis, forming the basis for training and validation. Our experimental findings conclusively demonstrate that the BaysCNN model significantly enhances the accuracy of DDoS cloud detection, achieving an impressive average accuracy rate of 99.66% across 13 multi-class attacks. To further elevate the model's performance, we introduce the Data Fusion BaysFusCNN approach, encompassing 27 layers. By leveraging Bayesian methods to estimate uncertainties and integrating features from multiple sources, this approach attains an even higher average accuracy of 99.79% across the same 13 multi-class attacks. Our proposed methodology not only offers valuable insights for the development of robust machine learning-based intrusion detection systems but also enhances the reliability and scalability of IDS in cloud computing environments. This empowers organizations to proactively mitigate security risks and fortify their defenses against malicious cyber-attacks.

An intelligent multi-layer framework with SHAP integration for botnet detection and classification

In increasingly interconnected digital world, the threat of cyber-attacks and data breaches are a pervasive and growing concern. The Botnets are the most dangerous threats that launch a wide range of cyberattacks such as distributed denial of service (DDoS) attacks, sending spam emails, spreading malware, and stealing sensitive information. The identification and categorization of botnets has become a highly complex and critical process due to the massive amount of network traffic generated every second. This paper presents a multilayer botnet detection and classification framework based on explainable machine learning algorithms. The proposed approach comprises of three distinct layers: Feature Selection Layer, Botnet Detection Layer and Botnet Classification Layer. The Feature Selection Layer reduces the dataset into six essential features, that enhance the accuracy and efficiency of the framework. The botnet detection layer detects botnet activity by filtering the reduced dataset into normal packets and botnet packets. The filtered botnet packets further examined by botnet classification layer to classify the botnet packets into different types of botnets. Moreover, SHAP (SHapley Additive exPlanations) technique is utilized to provide transparency to the model's decision-making process. To evaluate the effectiveness of the proposed model, NCC-2 and CTU-13 datasets are examined. 10-fold cross-validation technique is applied to validate the experimental findings. The average accuracy achieved by proposed approach in botnet detection stands impressively at 99.98%, while the average accuracy achieved in classifying botnet families is 99.30%, exhibiting an exceptional level of performance. The comparative analysis is performed which demonstrates its superiority over existing methods in terms of accuracy, precision, recall, F1-Score.