Distributed Denial Of Service Research Articles

HP-LSTM: Hawkes Process–LSTM-Based Detection of DDoS Attack for In-Vehicle Network

Connected and autonomous vehicles (CAVs) are advancing at a fast speed with the improvement of the automotive industry, which opens up new possibilities for different attacks. A Distributed Denial-of-Service (DDoS) attacker floods the in-vehicle network with fake messages, resulting in the failure of driving assistance systems and impairment of vehicle control functionalities, seriously disrupting the normal operation of the vehicle. In this paper, we propose a novel DDoS attack detection method for in-vehicle Ethernet Scalable service-Oriented Middleware over IP (SOME/IP), which integrates the Hawkes process with Long Short-Term Memory networks (LSTMs) to capture the dynamic behavioral features of the attacker. Specifically, we employ the Hawkes process to capture features of the DDoS attack, with its parameters reflecting the dynamism and self-exciting properties of the attack events. Subsequently, we propose a novel deep learning network structure, an HP-LSTM block, inspired by the Hawkes process, while employing a residual attention block to enhance the model’s detection efficiency and accuracy. Additionally, due to the scarcity of publicly available datasets for SOME/IP, we employed a mature SOME/IP generator to create a dataset for evaluating the validity of the proposed detection model. Finally, extensive experiments were conducted to demonstrate the effectiveness of the proposed DDoS attack detection method.

Kafka‐Shield: Kafka Streams‐based distributed detection scheme for IoT traffic‐based DDoS attacks

AbstractWith the rapid proliferation of insecure Internet of Things (IoT) devices, the security of Internet‐based applications and networks has become a prominent concern. One of the most significant security threats encountered in IoT environments is a Distributed Denial of Service (DDoS) attack. This attack can severely disrupt critical services and prevent smart devices from functioning normally, leading to severe consequences for businesses and individuals. It aims to overwhelm victims' resources, websites, and other services by flooding them with massive attack packets, making them inaccessible to legitimate users. Researchers have developed multiple detection schemes to detect DDoS attacks. As technology advances and other facilitating factors have increased, it is a challenge to identify such powerful attacks in real‐time. In this paper, we propose a novel distributed detection scheme for IoT network traffic‐based DDoS attacks by deploying it in a Kafka Streams processing framework named Kafka‐Shield. The Kafka‐Shield comprises two stages: design and deployment. Firstly, the detection scheme is designed on the Hadoop cluster employing a highly scalable H2O.ai machine learning platform. Secondly, a portable, scalable, and distributed detection scheme is deployed on the Kafka Streams processing framework. To analyze the incoming traffic data and categorize it into nine target classes in real time. Additionally, Kafka‐Shield stores each network flow with significant input features and the predicted outcome in the Hadoop Distributed File System (HDFS). It enables the development of new models or updating current ones. To validate the effectiveness of the Kafka‐Shield, we performed critical analysis using various configured attack scenarios. The experimental results affirm Kafka‐Shield's remarkable efficiency in detecting DDoS attacks. It has a detection rate of over 99% and can process 0.928 million traces in nearly 3.027 s.

MULTI-BLOCK: A novel ML-based intrusion detection framework for SDN-enabled IoT networks using new pyramidal structure

The ever-expanding Internet of Things (IoT) landscape faces significant security challenges due to limitations in traffic monitoring, device heterogeneity, and weak security practices, leaving networks vulnerable to multi-target and coordinated attacks like large-scale botnets and Distributed Denial-of-Service (DDoS). Existing intrusion detection systems can be computationally expensive and resource-intensive. This can be problematic for resource-constrained IoT devices with limited processing power, memory, and battery life. This paper proposes MULTI-BLOCK, a novel, multi-module framework that leverages machine learning, stateful P4 processing, and a Software-Defined Networking (SDN)-based multi-controller architecture. MULTI-BLOCK tackles critical management tasks within IoT networks, including synchronized communication, traffic monitoring, intrusion detection, and attack mitigation. This comprehensive framework comprises four modules. The first, the proposed pyramidal conceptually decentralized multi-controller structure (PCDMCS), introduces Decentralized Control Interfaces (DCIs) for real-time threat identification through a Decentralized Warning Conduit (DWC). The second module provides comprehensive network monitoring using P4-enabled 24-state tables. The third module leverages 30 new P4-extracted/calculated features and the Enhanced Weighted Ensemble Algorithm (EWEA) for enhanced anomaly detection. The final module presents a novel mitigation approach with 22 steps distributed across multiple controllers for scalability. Extensive evaluation using established IoT datasets (X-IIoTID, TON_IoT, and Edge-IIoTset) and diverse test scenarios (including single-victim and multi-victim attacks) demonstrates MULTI-BLOCK's exceptional performance, achieving high accuracy (99.75 %), precision (99.32 %), F1-score (99.53 %), recall (99.67 %), specificity (99.60 %), low false positive rates (FPR) (0.40 %), and low Average Detection Time (ADT) (2.11 ms). By offering a robust and adaptable solution against evolving threats, MULTI-BLOCK represents a significant advancement in IoT network security.

ELIDS: Ensemble Feature Selection for Lightweight IDS against DDoS Attacks in Resource-Constrained IoT Environment

Distributed Denial of Service (DDoS) attacks are increasingly prevalent in today’s digital era, particularly due to the growth of unprotected Internet of Things (IoT) devices. This escalation in attacks necessitates the development of adaptive Intrusion Detection Systems (IDS) that are both efficient in detection and less resource intensive, suitable for resource-constraint IoT devices. Feature Selection (FS) techniques are most popular for developing efficient and lightweight IDS, but their reliance on a single method can be risky due to inherent dataset biasness, necessitating diverse and adaptable FS approaches. This paper proposes a new Ensemble FS approach, termed as Ensemble Feature Selection for Lightweight IDS (ELIDS), by leveraging the strength of seven different filter-based methods. ELIDS not only reduces features but also converges the selection towards the most significant features out of those identified by the individual FS methods. Considering several learning algorithms, robust classification models are built out of ELIDS that are comprehensively evaluated for performance and resumption through both in-domain and cross-domain testing. During in-domain testing, results indicate that classification models built out of ELIDS generally exhibit similar accuracy to those built out of the existing individual FS techniques, where peak accuracy rates of 99.8% are achieved. However, cross-domain testing reveals that classifiers built using individual FS methods fall noticeably in their accuracy whereas the proposed ELIDS show robustness by outperforming existing techniques by large margins. In-fact, ELIDS exhibits a higher accuracy rate by at-least 23.7% over existing solutions while considering Random Forest (RF) as the learning algorithm.

FTG-Net-E: A hierarchical ensemble graph neural network for DDoS attack detection

Distributed Denial-of-Service (DDoS) attacks are a major threat to computer networks. These attacks can be carried out by flooding a network with malicious traffic, overwhelming its resources, and/or making it unavailable to legitimate users. Existing machine learning methods for DDoS attack detection typically use statistical features of network traffic, such as packet sizes and inter-arrival times. However, these methods often fail to capture the complex relationships between different traffic flows. This paper proposes a new DDoS attack detection approach that uses Graph Neural Networks (GNN) ensemble learning. GNN ensemble learning is a type of machine learning that combines multiple GNN models to improve the detection accuracy. We evaluated our approach on the Canadian Institute for Cybersecurity Intrusion Detection Evaluation Dataset (CICIDS2018) and CICIDS2017 datasets, a benchmark dataset for DDoS attack detection. Our work provides two main contributions. First, we extend our DDoS attack detection approach using GNN ensemble learning. Second, we explore the evaluation and fine-tuning of hyperparameter metrics through ensemble learning, significantly enhancing accuracy compared to a single GNN model and achieving an average 3.2% higher F1-score. Additionally, our approach effectively reduces overfitting by incorporating regularization techniques, such as dropout and early stopping. Specifically, we use a hierarchical ensemble of GNN, where each GNN learns the relationships between traffic flows at a different granularity level. We then use bagging and boosting to combine the predictions of the individual GNN, further improving detection accuracy. Results show that our system can achieve 99.67% accuracy, with a F1-score of 99.29%, which is better than state-of-the-art methods, even using single traffic architecture.

Detecting and mitigating security anomalies in Software-Defined Networking (SDN) using Gradient-Boosted Trees and Floodlight Controller characteristics

Cutting-edge and innovative software solutions are provided to address network security, network virtualization, and other network-related challenges in highly congested SDN-powered networks. However, these networks are susceptible to the same security issues as traditional networks. For instance, SDNs are significantly vulnerable to distributed denial of service (DDoS) attacks. Previous studies have suggested various anomaly detection techniques based on machine learning, statistical analysis, or entropy measurement to combat DDoS attacks and other security threats in SDN networks. However, these techniques face challenges such as collecting sufficient and relevant flow data, extracting and selecting the most informative features, and choosing the best model for identifying and preventing anomalies. This paper introduces a new and advanced multi-stage modular approach for anomaly detection and mitigation in SDN networks. The approach consists of four modules: data collection, feature selection, anomaly classification, and anomaly response. The approach utilizes the NetFlow standard to gather data and generate a dataset, employs the Information Gain Ratio (IGR) to select the most valuable features, uses gradient-boosted trees (GBT), and leverages Representational State Transfer Application Programming Interfaces (REST API) and Static Entry Pusher within the floodlight controller to construct an exceptionally efficient structure for detecting and mitigating anomalies in SDN design. We conducted experiments on a synthetic dataset containing 15 types of anomalies, such as DDoS attacks, port scans, worms, etc. We compared our model with four existing techniques: SVM, KNN, DT, and RF. Experimental results demonstrate that our model outperforms the existing techniques in terms of enhancing Accuracy (AC) and Detection Rate (DR) while simultaneously reducing Classification Error (CE) and False Alarm Rate (FAR) to 98.80 %, 97.44 %, 1.2 %, and 0.38 %, respectively.

Analyzing the impact of cyber-attacks on the performance of digital twin-based industrial organizations

Digital twin is a virtual copy of their “real-world counterparts”, which refer to physical objects, systems, or entities that exist in the physical world. They share valuable information about how the system works by connecting the replica with the real product via the internet and sensors. In digital twin organizations, industrial control systems and the internet are the main sources of data collection and synchronization, resulting in an increase in cyber-attacks. As a result, they could cause data leaks and be used by hackers to launch attacks without being detected. Researching the appropriate defenses against such attacks is of paramount interest. To that end, in this study, we build an integrated model utilizing the combination of a Dynamic Bayesian Network (DBN) and a Discrete-Time Markov Chain (DTMC) to analyze the considerable consequences of cyberattacks on a digital twin-based organization over different time period. DTMC models recovery and vulnerability for DT-based organizations, and then it is paired with the DBN model to simulate the cyberattack propagation behavior in the organization's IT performance. Next, we calculate the organization's work level and total expected utility under two different cyber-attack scenarios to determine its IT performance and financial behavior. Finally, we evaluate the organization's IT system's reliability and resilience after implementing two prevention mechanisms. Result indicates that Distributed Denial-of-Service (DDoS) cyberattack can cause more destruction to the digital twin organization's IT system than a malware attack in terms of cyberattack propagation, work and utility level, reliability, and resilience capability. The findings of the analysis hold practical applicability in real-world settings, enabling the identification of high-risk cyberattacks within DT-based organizations, the analysis and prediction of an organization's IT performance during actual cyberattacks, and the formulation of effective prevention strategies to address cyber security concerns within DT-based organizations.

DDoS SourceTracer: An Intelligent Application for DDoS Attack Mitigation in SDN

Software-Defined Networking (SDN) enhances network management and efficiency and is particularly effective in defending against Distributed Denial of Service (DDoS) attack through its centralized structure. Our proposed DDoS SourceTracer Application utilizes SDN to efficiently identify and mitigate DDoS attack by employing tracebacking and clustering techniques. This application uses supervised and ensemble machine learning algorithms for attack detection, and feature selection methods like the Chi-square test, ANOVA (Analysis of Variance) F-test, Correlation matrix, and Extra tree classifier to optimize the feature set. Our results show that the clustering approach outperforms traditional methods like rate limiting and blocking and effectively mitigates the attack in just 3.5 s. We used the sFlow-RT tool on the Zoo topology to perform real-time analysis and validate our application’s effectiveness during attack and normal traffic. This tool analyzes how attack traffic is impacted when using clustering and tracebacking methods to mitigate DDoS attack.

Deep Learning-based DDoS Detection in Network Traffic Data

Deep Learning-based DDoS Detection in Network Traffic Data

NGMD: next generation malware detection in federated server with deep neural network model for autonomous networks

Distributed denial-of-service (DDoS) attacks persistently proliferate, impacting individuals and Internet Service Providers (ISPs). Deep learning (DL) models are paving the way to address these challenges and the dynamic nature of potential threats. Traditional detection systems, relying on signature-based techniques, are susceptible to next-generation malware. Integrating DL approaches in cloud-edge/federated servers enhances the resilience of these systems. In the Internet of Things (IoT) and autonomous networks, DL, particularly federated learning, has gained prominence for attack detection. Unlike conventional models (centralized and localized DL), federated learning does not require access to users’ private data for attack detection. This approach is gaining much interest in academia and industry due to its deployment on local and global cloud-edge models. Recent advancements in DL enable training a quality cloud-edge model across various users (collaborators) without exchanging personal information. Federated learning, emphasizing privacy preservation at the cloud-edge terminal, holds significant potential for facilitating privacy-aware learning among collaborators. This paper addresses: (1) The deployment of an optimized deep neural network for network traffic classification. (2) The coordination of federated server model parameters with training across devices in IoT domains. A federated flowchart is proposed for training and aggregating local model updates. (3) The generation of a global model at the cloud-edge terminal after multiple rounds between domains and servers. (4) Experimental validation on the BoT-IoT dataset demonstrates that the federated learning model can reliably detect attacks with efficient classification, privacy, and confidentiality. Additionally, it requires minimal memory space for storing training data, resulting in minimal network delay. Consequently, the proposed framework outperforms both centralized and localized DL models, achieving superior performance.

A Robust DDoS Intrusion Detection System Using Convolutional Neural Network

In today’s digital age, the proliferation of network-connected devices has triggered a surge in cyberattacks. Distributed Denial-of-Service (DDoS) attacks pose a particularly formidable challenge to network security by disrupting access to vital services. While numerous researchers have proposed DDoS detection methods utilizing machine learning and deep learning techniques, developing a robust and reliable DDoS intrusion detection system remains challenging. This challenge is exacerbated by issues such as highly imbalanced data, multi-classification, and computational complexity. This paper proposes an innovative feature selection approach to create a robust intrusion detection system capable of detecting and classifying recent common DDoS attack types. We evaluate the performance of our model on the CICDDoS2019 benchmark dataset. Our experimental results demonstrate that our proposed model outperforms existing methods, achieving a detection accuracy of 96.82%, a recall of 96.82%, a precision of 96.76%, and an F1 score of 96.50%. Additionally, our model exhibits faster prediction times, with the ability to predict an attack in just 0.189 ms. Notably, our approach, combined with preprocessing and feature selection techniques, outperforms previous works and baseline models in DDoS attack classification.

A novel framework of DDoS attack detection in network using hybrid heuristic deep learning approaches with attention mechanism

The “Distributed Denial of Service (DDoS)” threats have become a tool for the hackers, cyber swindlers, and cyber terrorists. Despite the high amount of conventional mitigation mechanisms that are present nowadays, the DDoS threats continue to enhance in severity, volume, and frequency. The DDoS attack has highly affected the availability of the networks for the previous years and still, there is no efficient defense technique against it. Moreover, the new and complex DDoS attacks are increasing on a daily basis but the traditional DDoS attack detection techniques cannot react to these threats. On the other hand, the hackers are employing very innovative strategies to initiate the threats. But, the traditional methods can become effective and reliable when combined with the deep learning-aided approaches. To solve these certain issues, a framework detection mechanism for DDoS attacks utilizes an attention-aided deep learning methodology. The primary thing is the acquisition of data from standard data online sources. Further, from the garnered data, the significant features are drawn out from the “Deep Weighted Restricted Boltzmann Machine (RBM)” using a “Deep Belief Network (DBN)”, in which the parameters are tuned by employing the recommended Enhanced Gannet Optimization Algorithm (EGOA). This feature extraction operation increases the network performance rate and also diminishes the dimensionality issues. Lastly, the acquired features are transferred to the model of “Attention and Cascaded Recurrent Neural Network (RNN) with Residual Long Short Term Memory (LSTM) (ACRNN-RLSTM)” blocks for the DDoS threat detection purpose. This designed network precisely identifies the complex and new attacks, thus it increases the trustworthiness of the network. In the end, the performance of the approach is contrasted with other traditional algorithms. Hence, the simulation outcomes are obtained that prove the system’s efficiency. Also, the outcomes displayed that the designed system overcame the conventional threat detection techniques.

VAIDANSHH: Adaptive DDoS detection for heterogeneous hosts in vehicular environments

Vehicular networks are vulnerable to Distributed Denial of Service (DDoS), an extension of a Denial of Service (DoS) attack. The existing solutions for DDoS detection in vehicular networks use various Machine Learning (ML) algorithms. However, these algorithms are applicable only in a single layer in a vehicular network environment and are incapable of detecting DDoS dynamics for different layers of the network infrastructure. The recently reported attacks on transport networks reveal the fact that a research gap exists between the existing solutions and the multi-layer DDoS detection strategy requirements. Additionally, the majority of the current detection methods fail in the consideration of traffic heterogeneity and are not rate-adaptive, where both the mentioned parameters are important for an effective detection system.In this paper, we introduce a comprehensive ML-based Network Intrusion Detection System (NIDS) against DDoS attacks in vehicular networks. Our proposed NIDS combines a three-tier security model, traffic adaptivity, and heterogeneity traffic provisions. We call our model Vehicular Adaptive Intrusion Detection And Novel System for Heterogeneous Hosts (VAIDANSHH). As mentioned earlier, VAIDANSHH has a three-tier security system: at RSU's hardware, communication channel, and RSU application level. VAIDANSHH combines the Adaptive Alarming Module (AAM) and the Detection Module (DM) for data generation, collection of generated data, flow monitoring, pre-processing, and classification. We use the NS3 simulation tool for our experiments to generate synthetic data and apply ML with WEKA. We run a thorough set of experiments, which show that VAIDANSHH detects UDP flooding, a form of DDoS attack, with 99.9% accuracy within a very short time. We compare VAIDANSHH with other state-of-the-art models; the comparative analysis shows that VAIDANSHH is superior in terms of accuracy and its multi-tier workflow.

Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models

A botnet is a network of compromised computer systems, or bots, remotely controlled by an attacker through bot controllers. This covert network poses a threat through large-scale cyber attacks, including phishing, distributed denial of service (DDoS), data theft, and server crashes. Botnets often camouflage their activity by utilizing common internet protocols, such as HTTP and IRC, making their detection challenging. This paper addresses this threat by proposing a method to identify botnets based on distinctive communication patterns between command and control servers and bots. Recognizable traits in botnet behavior, such as coordinated attacks, heartbeat signals, and periodic command distribution, are analyzed. Probabilistic models, specifically Hidden Markov Models (HMMs) and Profile Hidden Markov Models (PHMMs), are employed to learn and identify these activity patterns in network traffic data. This work utilizes publicly available datasets containing a combination of botnet, normal, and background traffic to train and test these models. The comparative analysis reveals that both HMMs and PHMMs are effective in detecting botnets, with PHMMs exhibiting superior accuracy in botnet detection compared to HMMs.

Advanced DDos Attack Detection in SD-IoT Using DNFN and Nature-Inspired Optimizations

The purpose of this research is to improve the detection of Distributed Denial of Service (DDoS) attacks in systems that employ Software-Defined Internet of Things (SD-IoT). First, feature selection techniques such as PCA is used to improve the Deep Neuro Fuzzy Network (DNFN) model's detection accuracy of DDoS assaults. With an overall accuracy of 0.969, the findings show that the DNFN model has above average accuracy rates when applied to feature selection technique. To further improve the DDoS detection capabilities, optimization approaches like Elephant Herding Optimization (EHO) and the hybrid Elephant-Herding-Water-Cycle-Algorithm (EHWCA) are then developed. The EHWCA approach is superior than the current EHO method, as shown by a comparative study that compares the two. The DNFN model achieves an accuracy of 0.99 when optimized using EHWCA, whereas it only achieves 0.97 with EHO. The suggested system's scalability and efficiency are greatly enhanced by the inclusion of the water cycle in the optimization process. Overall, this research contributes to the development of strong cybersecurity solutions for IoT networks by demonstrating the efficacy of sophisticated optimization approaches, in particular EHWCA, in improving the detection of DDoS assaults in SD-IoT settings.

Machine learning for network defense: automated DDoS detection with telegram notification integration

As the prevalence and sophistication of distributed denial of service (DDoS) attacks escalate, the imperative for advanced defense mechanisms becomes paramount, especially in rapidly growing digital landscapes like Indonesia. This research presents the development of an innovative intrusion detection system (IDS) that harnesses machine learning (ML) algorithms to automate the detection of DDoS attacks in real time. By monitoring TCP streams, the system utilizes ML-enhanced IDS components to identify malicious traffic patterns indicative of DDoS activities. An automatic alert is dispatched to network administrators via Telegram upon detection, ensuring immediate awareness and facilitating swift countermeasures. Additionally, the system embodies a self-improving architecture by retraining its ML model with newly encountered attack data, thus continuously refining its detection capabilities. The system's efficacy, marked by its adaptive learning and proactive notification system, not only contributes to the fortification of network security but also underscores the potential for ML in cybersecurity within Indonesia’s expanding digital domain. The deployment of this system is anticipated to significantly bolster cybersecurity infrastructure by addressing the urgent need for advanced and responsive defense strategies against the evolving landscape of cyber threats.

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Quantum-Enhanced Representation Learning: A Quanvolutional Autoencoder Approach against DDoS Threats

Motivated by the growing threat of distributed denial-of-service (DDoS) attacks and the emergence of quantum computing, this study introduces a novel “quanvolutional autoencoder” architecture for learning representations. The architecture leverages the computational advantages of quantum mechanics to improve upon traditional machine learning techniques. Specifically, the quanvolutional autoencoder employs randomized quantum circuits to analyze time-series data from DDoS attacks, offering a robust alternative to classical convolutional neural networks. Experimental results suggest that the quanvolutional autoencoder performs similarly to classical models in visualizing and learning from DDoS hive plots and leads to faster convergence and learning stability. These findings suggest that quantum machine learning holds significant promise for advancing data analysis and visualization in cybersecurity. The study highlights the need for further research in this fast-growing field, particularly for unsupervised anomaly detection.

DDoS Attack Detection and Classification using Machine Learning Algorithms

Abstract: In the dynamic realm of networking, Software Defined Networking (SDN) emerges as a transformative force, offering centralized control and programmable capabilities that empower network administrators to efficiently manage and secure network infrastructures. However, amidst the ever-present threat of distributed denial-of-service (DDoS) attacks, the need for robust detection mechanisms is imperative. This research proposes a machine learning-based approach to enhance DDoS attack detection and classification within SDN environments. Leveraging the SelectKBest algorithm for feature selection and employing various classifiers such as Decision tree, KMeans++, XGBoost, etc.. with a focus on Random Forest as the most effective, the project aims to bolster detection accuracy and efficiency. Through comprehensive experimentation and comparative analysis, the efficacy of the proposed methodology in identifying DDoS threats is demonstrated, contributing to the ongoing efforts in fortifying cybersecurity defenses against sophisticated adversarial tactics.