Low-rate DDoS Research Articles

Detecting and Mitigating Low-Rate DoS and DDoS Attacks: Multimodal Fusion of Time-Frequency Analysis and Deep Learning model

Detecting and Mitigating Low-Rate DoS and DDoS Attacks: Multimodal Fusion of Time-Frequency Analysis and Deep Learning model

A Threshold Adaptation Mechanism for Detecting and Filtering Low-Rate DDoS Attacks


 
 
 TCP-targeted low-rate distributed denial-of-service (LDDoS) attacks pose a serious chal- lenge to the reliability and security of the Internet. Among various proposed solutions, we are par- ticularly interested in the Congestion Participation Rate (CPR) metric and the CPR-based approach. Through a simulation study, we show that if the algorithm makes use of a fixed CPR threshold, it cannot simultaneously preserve high TCP throughput under attacks and achieve good fairness per- formance for TCP flows without attacks. Then, we propose a method for adaptively changing the threshold over time to achieve both objectives. Simulation results show that our adaptive CPR-based approach can effectively protect TCP flows under attacks while keeping fairness in normal time.
 
 

A novel multi-scale CNN and Bi-LSTM arbitration dense network model for low-rate DDoS attack detection

Low-rate distributed denial of service attacks, as known as LDDoS attacks, pose the notorious security risks in cloud computing network. They overload the cloud servers and degrade network service quality with the stealthy strategy. Furthermore, this kind of small ratio and pulse-like abnormal traffic leads to a serious data scale problem. As a result, the existing models for detecting minority and adversary LDDoS attacks are insufficient in both detection accuracy and time consumption. This paper proposes a novel multi-scale Convolutional Neural Networks (CNN) and bidirectional Long-short Term Memory (bi-LSTM) arbitration dense network model (called MSCBL-ADN) for learning and detecting LDDoS attack behaviors under the condition of limited dataset and time consumption. The MSCBL-ADN incorporates CNN for preliminary spatial feature extraction and embedding-based bi-LSTM for time relationship extraction. And then, it employs arbitration network to re-weigh feature importance for higher accuracy. At last, it uses 2-block dense connection network to perform final classification. The experimental results conducted on popular ISCX-2016-SlowDos dataset have demonstrated that the proposed MSCBL-ADN model has a significant improvement with high detection accuracy and superior time performance over the state-of-the-art models.

A comprehensive survey on low-rate and high-rate DDoS defense approaches in SDN: taxonomy, research challenges, and opportunities

A comprehensive survey on low-rate and high-rate DDoS defense approaches in SDN: taxonomy, research challenges, and opportunities

Capturing low-rate DDoS attack based on MQTT protocol in software Defined-IoT environment

Capturing low-rate DDoS attack based on MQTT protocol in software Defined-IoT environment

LRDADF: An AI enabled framework for detecting low-rate DDoS attacks in cloud computing environments

DDoS attacks, also known as distributed denial-of-service attacks, pose a significant risk to networks in the cloud. The attackers aim to flood the target system with an overwhelming amount of data and requests until it becomes completely overloaded and unable to function properly. These attacks are becoming smarter and more dangerous all the time. A low-rate DDoS attack is one such strategy that makes detection difficult. At the same time, cloud infrastructure is rapidly evolving. Container-based technology makes it possible for cloud computing to use resources efficiently and scale services in a flexible way. Existing methods for detecting DDoS attacks in cloud computing are insufficient when adversaries use low-rate DDoS attacks. A method is required that can not only identify the attack but also prevent it to some extent. A Low-Rate DDoS Attack Detection Framework (LRDADF) was proposed for this purpose when adversaries use low-rate DDoS attacks. A comprehensive approach is required because low-rate DDoS attacks are difficult to detect. In addition to employing deep learning methods to detect such attacks, we proposed a mathematical model to realize a mitigation strategy. As a result, we proposed a new algorithm called the Hybrid Approach for Low-Rate DDoS Detection (HA-LRDD). The algorithm employs an AI-enabled method comprised of deep convolutional neural networks (CNN) and a deep auto encoder. We defined another algorithm called Dynamic Low-Rate DDoS Mitigation (DLDM), which mitigates the impact of an attack once it has been identified. It also ensures that the attack is defeated and that the infrastructure continues to operate. A comprehensive simulation study revealed that the proposed framework is capable of detecting and mitigating low-rate DDoS attacks to ensure an acceptable level of service in cloud computing environments.

Lightweight detection system for low-rate DDoS attack on software-defined-IoT

Low-rate Distributed Denial-of-Service (LR-DDoS) attack is an uninterrupted cybersecurity challenge within a Software- Defined Internet of Things (SD-IoT) network. If successful, LR-DDoS can severely impact the system availability and overall performance; therefore, this paper presents a machine learning model to detect LR-DDoS cyberattacks over SD-IoT. Three machine learning techniques, namely, J48 decision tree, Naive Bayes (NB), and Logistic regression, were implemented and evaluated based on recent network traffic with predefined attack scenarios. Our empirical results confirmed that detection-based J48 decision trees outperformed other ML-based models, scoring a high detection accuracy of 99.9%.

An Efficient DDoS Attack Detection Using Chaos Henry Gas Solubility Optimization Weight Initialization Based Rectified Linear Unit

The Denial of Service (DoS) attacks is one of the main issues faced by cloud service providers due to their intricate nature. The main aim of this attack is to disrupt the services of authorized users by forwarding massive malicious requests to the victim system. Even though the modern Artificial Intelligence-powered intrusion detection system offers improved benefits, it suffers from analyzing the traces of intrusion in the massive network flow. This article presents a novel Chaos-based Henry Gas Solubility Optimization—Weight initialization based-rectified linear Unit (HGSO-WIB-ReLU) framework to identify different types of DoS attacks like HTTP flood attacks, DNS flood attacks, and ICMP flood attacks. The main aim of this technique is to identify the low rate of DoS attacks which the state-of-art techniques often based on statistical analysis and machine learning are incapable of accomplishing. Convolutional neural network architecture incorporates the WIB-ReLU activation function primarily to prevent vanishing gradient issues and provide efficient training. The WIB-ReLU framework’s hyperparameters are primarily improved using the HGSO method by increasing the classifier’s accuracy rate for detecting DoS attacks. In this way, the proposed model minimized the high false positive rate in identifying low-rate DoS attacks in large datasets. Different benchmark datasets such as BUET- DDoS2020, CIC DoS Attacks, and Low Rate DDoS are used to conduct the experiments and the efficiency of the model is verified in terms of accuracy, F1-measure, and precision score. When evaluated using the BUET-DDoS, CIC-DoS, and Low rate DDoS datasets, the proposed model offers an accuracy of 97%, 96.67%, and 96%, respectively. The experimental analysis conducted demonstrates the effectiveness of the proposed HGSO-WIB-ReLU framework when compared to the different state-of-art methodologies.

Effectiveness of an Entropy-Based Approach for Detecting Low- and High-Rate DDoS Attacks against the SDN Controller: Experimental Analysis

Software-defined networking (SDN) is a unique network architecture isolating the network control plane from the data plane, offering programmable elastic features that allow network operators to monitor their networks and efficiently manage them. However, the new technology is security deficient. A DDoS attack is one of the common attacks that threaten SDN controllers, leading to the degradation or even collapse of the entire SDN network. Entropy-based approaches and their variants are considered the most efficient approaches to detecting DDoS attacks on SDN controllers. Therefore, this work analyzes the feasibility and impacts of an entropy-based DDoS attack detection approach for detecting low-rate and high-rate DDoS attacks against the controller, measured in terms of detection rate (DR) and false-positive rate (FPR), triggered by a single or multiple host attacks targeting a single or multiple victims. Eight simulation scenarios, representing low and high DDoS attack traffic rates on the controller, have been used to evaluate an entropy-based DDoS attack detection approach. The experimental results reveal that the entropy-based approach enhances the average DR for detecting high-rate DDoS attack traffic compared with low-rate DDoS attack traffic by 6.25%, 20.26%, 6.74%, and 8.81%. In addition, it reduces the average FPRs for detecting a high DDoS attack traffic rate compared with a low DDoS attack traffic rate by 67.68%, 77.54%, 66.94%, and 64.81.

An Asynchronous Federated Learning Arbitration Model for Low-Rate DDoS Attack Detection

Low-rate Distributed Denial of Service (LDDoS) attacks have been one of the most notorious network security threats, which use periodic slight multi-variate time series pulse flows to degrade network quality. Limited by the poor data in a single client, a powerful and satisfactory LDDoS attack detection model is hard to be trained. Federated Learning (FL) is a promising paradigm offering joint learning through multiple clients. We propose an asynchronous federated learning arbitration framework based on bidirectional LSTM (bi-LSTM) and attention mechanism (AsyncFL-bLAM). In the AsyncFL-bLAM, the leader node election algorithm is proposed for constructing the framework of asynchronous federated learning. The proposed bLAM model composed of feature extracter and arbitrator takes on the responsibility of LDDoS detection locally. Furthermore, the novel AsyncFL framework helps to upload and aggregate the bLAM models’ parameters asynchronously between leader node and client nodes. Experimental results show that the AsyncFL-bLAM outperforms the state-of-the-art models in accuracy, and reduces the overall communication rounds.

Identifikasi Serangan Low-Rate DDOS Berbasis Deep Learning

LowRate DDoS (LDDoS) is a variation of DDoS attack that sends fewer packets than conventional DDoS attacks. However, by sending a smaller number of packets and using a unique attack period, low-rate DDoS is very effective in reducing the quality of an internet network-based service due to full access. On the other hand, the low-rate DDoS with its nature also makes it difficult to detect because it looks more mixed with normal user access. The Deep Learning model that will be used in this research is the RNN LSTM (Long Short Term Memory) model. LSTM is a neural network architecture which is good enough to process sequential data. This model is better than the simple RNN model. The research method is adapted to the SKKNI No. 299 of 2020. However, this research will be carried out until the model development stage, namely the evaluation model. From the results of the research that has been done, it can be concluded that the RNN LSTM model can be used to classify low-rate DDOS attacks using feature selection. The accuracy of the training data on the validation data is around 98% and after visualizing the data for accuracy and loss, it can be concluded that the model is quite good, aka there is no underfitting or overfitting. While the accuracy obtained for testing data is 0.97%.

Light Weighted CNN Model to Detect DDoS Attack over Distributed Scenario

The minimal-degree distributed denial-of-service attack takes advantage of flaws in the adaptive mechanisms of network protocols, which could have a big impact on network service quality. It is very hard to find, has a low attack rate, and comes at a set time. Detection methods that have been used before have problems because they only use one type of detection and are not very good at identifying the object. In the end, a way to detect many sorts of minimal DDoS assaults that use deep hybrid learning is suggested. To construct multi-type limited DDoS threat data sets and mimic diverse sorts DDoS assaults and legitimate traffic in varying situations in the 5G setting, collect congestion at the networking entry and extract flow feature info are considered. From a statistical threshold and feature engineering point of view, these data sets show how many sorts of minimal DDoS assaults are there. This study aims to develop a deep hybrid learning-based multi-type low-rate DDoS attack detection solution for 5G networks which is the novel model that is recently deployed, and a hybrid deep learning algorithm was used to train the algorithm offline, and the algorithm’s performance was compared to that of the LSTM-Light GBM and LSTM-RF algorithms. The CNN-RF revealing model was then used to detect minimal DDoS assaults at the gateway, so that multiple attacks could be detected at the same time. It can identify 4 sorts of low-rate DDoS assaults like Slow-Headers, Slow-Body, Slow-Read, and Shrew assaults, in a 120-second window. The false intercept rate is 11.03 percent. This means that 96.22 percent of traffic could be found. Using the strategy suggested can help cut down on the traffic concentration of minimal DDoS attacks at the net ingress. It can also be used in real-world situations.

Multi-type low-rate DDoS attack detection method based on hybrid deep learning

Multi-type low-rate DDoS attack detection method based on hybrid deep learning

Detection and defence method of low-rate DDoS attacks in vehicle edge computing network using information metrics

Detection and defence method of low-rate DDoS attacks in vehicle edge computing network using information metrics

Detection and defence method of low-rate DDoS attacks in vehicle edge computing network using information metrics

Detection and defence method of low-rate DDoS attacks in vehicle edge computing network using information metrics

Detection of the botnets’ low-rate DDoS attacks based on self-similarity

An article presents the approach for the botnets’ low-rate a DDoS-attacks detection based on the botnet’s behavior in the network. Detection process involves the analysis of the network traffic, generated by the botnets’ low-rate DDoS attack. Proposed technique is the part of botnets detection system – BotGRABBER system. The novelty of the paper is that the low-rate DDoS-attacks detection involves not only the network features, inherent to the botnets, but also network traffic self-similarity analysis, which is defined with the use of Hurst coefficient. Detection process consists of the knowledge formation based on the features that may indicate low-rate DDoS attack performed by a botnet; network monitoring, which analyzes information obtained from the network and making conclusion about possible DDoS attack in the network; and the appliance of the security scenario for the corporate area network’s infrastructure in the situation of low-rate attacks.

Exploring New Opportunities to Defeat Low-Rate DDoS Attack in Container-Based Cloud Environment

DDoS attacks are rampant in cloud environments and continually evolve into more sophisticated and intelligent modalities, such as low-rate DDoS attacks. But meanwhile, the cloud environment is also developing in constant. Now container technology and microservice architecture are widely applied in cloud environment and compose container-based cloud environment. Comparing with traditional cloud environments, the container-based cloud environment is more lightweight in virtualization and more flexible in scaling service. Naturally, a question that arises is whether these new features of container-based cloud environment will bring new possibilities to defeat DDoS attacks. In this paper, we establish a mathematical model based on queueing theory to analyze the strengths and weaknesses of the container-based cloud environment in defeating low-rate DDoS attack. Based on this, we propose a dynamic DDoS mitigation strategy, which can dynamically regulate the number of container instances serving for different users and coordinate the resource allocation for these instances to maximize the quality of service. And extensive simulations and testbed-based experiments demonstrate our strategy can make the limited system resources be utilized sufficiently to maintain the quality of service acceptable and defeat DDoS attack effectively in the container-based cloud environment.

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

While there have been extensive studies of denial of service (DoS) attacks and DDoS attack mitigation, such attacks remain challenging to mitigate. For example, Low-Rate DDoS (LR-DDoS) attacks are known to be difficult to detect, particularly in a software-defined network (SDN). Hence, in this paper we present a flexible modular architecture that allows the identification and mitigation of LR-DDoS attacks in SDN settings. Specifically, we train the intrusion detection system (IDS) in our architecture using six machine learning (ML) models (i.e., J48, Random Tree, REP Tree, Random Forest, Multi-Layer Perceptron (MLP), and Support Vector Machines (SVM)) and evaluate their performance using the Canadian Institute of Cybersecurity (CIC) DoS dataset. The findings from the evaluation demonstrate that our approach achieves a detection rate of 95%, despite the difficulty in detecting LR-DoS attacks. We also remark that in our deployment, we use the open network operating system (ONOS) controller running on Mininet virtual machine in order for our simulated environment to be as close to real-world production networks as possible. In our testing topology, the intrusion prevention detection system mitigates all attacks previously detected by the IDS system. This demonstrates the utility of our architecture in identifying and mitigating LR-DDoS attacks.

Machine learning based low-rate DDoS attack detection for SDN enabled IoT networks

The software-defined network (SDN) enabled internet of things (IoT) architecture is deployed in many industrial systems. The ability of SDN to intelligently route traffic and use underutilised network resources, enables IoT networks to cope with data onslaught smoothly. SDN also eliminates bottlenecks and helps to process IoT data efficiently without placing a larger strain on the network. The SDN-based IoT network is vulnerable to DDoS attack in a sophisticated usage environment. The SDN-based IoT network behaviours are different from traditional networks, which makes the detection of low-traffic DDoS attacks more difficult. In this paper, we propose a learning-based detection approach that deploys learning algorithms and utilizes stateful and stateless features from Openflow packages to identify attack traffics in SDN control and data planes. Our prototype approach and experiment results show that our system identified the low-rate DDoS attack traffic accurately with relatively low system performance overheads.

Machine learning based low-rate DDoS attack detection for SDN enabled IoT networks

Machine learning based low-rate DDoS attack detection for SDN enabled IoT networks