Service Attack Detection Research Articles

DI-ADS: A Deep Intelligent Distributed Denial of Service Attack Detection Scheme for Fog-Based IoT Applications

Nowadays, fog computing plays a very vital role in providing many services to end-based IoT (Internet of Things) systems. The end IoT devices communicate with the middle layer fog nodes and to the above cloud layer to process the user tasks. However, this large data communication experiences many security challenges as IoT devices are being compromised and thus the fog nodes at the fog layer are more prone to a very critical attack known as Distributed Denial of Service (DDoS) attack. The attackers or the compromised IoT devices need to be detected well in the network. Deep Learning (DL) plays a prominent role in predicting the end-user behavior by extracting features and classifying the adversary in the network. But, due to IoT device’s constrained nature in computation and storage facilities, DL cannot be administered on those. In this paper, a deep intelligent DDoS attack detection scheme (DI-ADS) is proposed for fog-based IoT applications. The framework mainly uses a deep learning model (DLM) to detect DDoS attacks in the network. The DLM is installed on the computation module of the fog node that predicts the end IoT device behavior. For the selection of the best DLM model at the fog layer, the performance comparison is made on Deep Neural Multilayer Perceptron (DNMLP) and Long Short-Term Memory (LSTM) models along with the conventional machine learning (ML) models such as Support Vector Machine (SVM), K-Nearest Neighbours (KNN), Logistic Regression (LR), and Random Forest (RF). The simulation is performed using the Python Anaconda platform by considering a new DDoS-SDN (Mendeley Dataset) dataset that consists of three DDoS attacks such as TCP Syn, UDP Flood, and ICMP attacks. From the results, DNMLP showed the best accuracy of 99.44% as compared to other DL and ML models. By outperforming nature in the detection of DDoS attacks, DNMLP is considered in the proposed framework for being implemented at the fog layer.

Distributed denial of service attacks detection for software defined networks based on evolutionary decision tree model

The software defined networks (SDN) system has modern techniques in networking, it separates the forwarding plane from the control plane and works to collect control functions in a central unit (controller), and this separation process leads to many advantages, such as cost reduction and programming ability. Concurrently, because of its centralized architecture, it is prone to a variety of attacks. Distributed denial of service (DDoS) attack has a significant impact on SDN, it is characterized by its ability to consume network resources as well as its ability to turn off the entire network. The work in this study aims to improve and increase the security and robustness of SDN systems against the attack or intrusion, by using a machine learning model to detect attack traffic and classify traffic of SDN as (attack or normal), and optimization algorithm (genetic algorithm) for improving the accuracy of the classification. After preparing and preprocessing the dataset, we used the genetic algorithm (GA) to optimize the hyperparameters of the decision tree (DT) model, and the proposed evolutionary decision tree (EDT) model was used to classify traffic into normal and attack traffic. The results indicate that the suggested model achieved a high classification accuracy of 99.46.

Distributed Denial of Service Attack Detection and Prevention Model for IoT based Computing Environment using Ensemble Machine Learning Approach

Defending against Distributed Denial of Service (DDoS) in the Internet of Things (IoT) computing environment is a challenging task. DDoS attacks are type of collective attack in which attackers work together to compromise internet security and services. The resource-constrained devices used in IoT deployments have made it even easier for an attacker to break, because of the vast number of vulnerable IoT devices with significant compute power. This paper proposed an ensemble machine learning (ML) model using the bagging technique to detect and prevent DDoS attacks in the IoT computing environment. We carried out an Machine Learning experiment and evaluated our proposed model with the most recent DDoS attacks (CICDoS2019) dataset. We use seven validation metrics (classification accuracy, precision rate, recall rate, f1-score, Matthews Correlation Coefficient, false negative rate and false positive rate) to evaluate the performance of the proposed model. The results obtained in our experiment shows an improved performance with an overall maximum classification accuracy of 99.75%, precision rate of 99.99%, recall rate of 99.76%, f1-score of 99.87%, Matthews Correlation Coefficient of 0.000000214, false negative rate of 0.24% and 4.42% false positive rate.

A robust tuned classifier-based distributed denial of service attacks detection for quality of service enhancement in software-defined network

In today’s world, Software-Defined Networking (SDN) plays a significant role in the advancement of next-generation network architecture that offers vast control to the network operators. However, the control layer is vulnerable to Distributed Denial of Service (DDoS) attacks where DDoS is one of the most powerful and devastating cyber-attacks. Thus, the development of a DDoS attack detection mechanism is very essential since these kinds of attacks have a direct impact on the overall performance of the SDN. In this paper, a new robust Tuned support vector machine-based DDoS attack detection methodology has been proposed to categorize the benign traffic from DDoS attack traffic on the SDN. Primarily, the network is created with controller and OpenFlow switch and the communication can be carried out through secure channels among different benign users and also attackers. Afterward, the multi-characteristic values are extracted by the effective extraction strategy which consists of the six-tuple characteristic values matrix. Finally, the tuned classifier has been implemented with the aid of optimization algorithm for differentiating the abnormal traffic and the normal traffic. The performance results manifest that the proposed detection framework achieves a higher accuracy of 98% and precision of 99% when compared with existing classifiers.

Adaptive Learning Based Whale Optimization and Convolutional Neural Network Algorithm for Distributed Denial of Service Attack Detection in Software Defined Network Environment

SDNs (Software Defined Networks) have emerged as a game-changing network concept. It can fulfill the ever-increasing needs of future networks and is increasingly being employed in data centres and operator networks. It does, however, confront certain fundamental security concerns, such as DDoS (Distributed Denial of Service) assaults. To address the aforementioned concerns, the ALWO+CNN method, which combines ALWOs (Adaptive Learning based Whale Optimizations) with CNNs (Convolution Neural Networks), is suggested in this paper. Initially, preprocessing is performed using the KMC (K-Means Clustering) algorithm, which is used to significantly reduce noise data. The preprocessed data is then used in the feature selection process, which is carried out by ALWOs. Its purpose is to pick out important and superfluous characteristics from the dataset. It enhances DDoS classification accuracy by using the best algorithms. The selected characteristics are then used in the classification step, where CNNs are used to identify and categorize DDoS assaults efficiently. Finally, the ALWO+CNN algorithm is used to leverage the rate and asymmetry properties of the flows in order to detect suspicious flows specified by the detection trigger mechanism. The controller will next take the necessary steps to defend against DDoS assaults. The ALWO+CNN algorithm greatly improves detection accuracy and efficiency, as well as preventing DDoS assaults on SDNs. Based on the experimental results, it was determined that the suggested ALWO+CNN method outperforms current algorithms in terms of better accuracies, precisions, recalls, f-measures, and computational complexities.

SVM Based Intrusion Detection Method with Nonlinear Scaling and Feature Selection

Intrusion is one of major security issues of internet with the rapid growth in smart and Internet of Thing (IoT) devices, and it becomes important to detect attacks and set out alarm in IoT systems. In this paper, the support vector machine (SVM) and principal component analysis (PCA) based method is used to detect attacks in smart IoT systems. SVM with nonlinear scheme is used for intrusion classification and PCA is adopted for feature selection on the training and testing datasets. Experiments on the NSL-KDD dataset show that the test accuracy of the proposed method can reach 82.2% with 16 features selected from PCA for binary-classification which is almost the same as the result obtained with all the 41 features; and the test accuracy can achieve 78.3% with 29 features selected from PCA for multi-classification while 79.6% without feature selection. The Denial of Service (DoS) attack detection accuracy of the proposed method can achieve 8.8% improvement compared with existing artificial neural network based method.

Majority Vote-Based Ensemble Approach for Distributed Denial of Service Attack Detection in Cloud Computing

Cloud computing is considered as technical advancement in information technology. Many organizations have been motivated by this advancement to outsource their data and computational needs. Such platforms are required to fulfil basic security principles such as confidentiality, availability, and integrity. Cloud computing offers scalable and virtualized services with a high flexibility level and decreased maintenance costs to end-users. The infrastructure and protocols that are behind cloud computing may contain bugs and vulnerabilities. These vulnerabilities are being exploited by attackers, leading to attacks. Among the most reported attacks in cloud computing are distributed denial-of-service (DDOS) attacks. DDOS attacks are conducted by sending many data packets to the targeted infrastructure. This leads to most network bandwidth and server time being consumed, thus causing a denial of the service problem. Several methods have been proposed and experimented with for early DDOS attack detection. Employing a single machine learning classification model may give an adequate level of attack detection accuracy but needs an enhancement. In this study, we propose an approach based on an ensemble of machine learning classifiers. The proposed approach uses a majority vote-based ensemble of classifiers to detect attacks more accurately. A subset of the CICDDOS2019 dataset consisting of 32,000 instances, including 8450 benign and 23,550 DDOS attack instances was used in this study for results and evaluation. The experimental results showed that 98.02% accuracy was achieved with 97.45% sensitivity and 98.65% specificity.

Denial of service attack detection and mitigation for internet of things using looking-back-enabled machine learning techniques

IoT (Internet of Things) systems are still facing a great number of attacks due to their integration in several areas of life. The most-reported attacks against IoT systems are "Denial of Service" (DoS) and "Distributed Denial of Service" (DDoS) attacks. In this paper, we investigate DoS/DDoS attacks detection for IoT using machine learning techniques. We propose a new architecture composed of two components: DoS/DDoS detection and DoS/DDoS mitigation. The detection component provides fine-granularity detection, as it identifies the specific type of attack, and the packet type used in the attack. In this way, it is possible to apply the corresponding mitigation countermeasure on specific packet types. The proposed DoS/DDoS detection component is a multi-class classifier that adopts the "Looking-Back" concept, and is evaluated on the Bot-IoT dataset. Evaluation results show promising results as a Looking-Back-enabled Random Forest classifier achieves an accuracy of 99.81%.

An approach for slow distributed denial of service attack detection and alleviation in software defined networks

Over the last few years, the need for programmable networks has captured the interest of industrialists and academicians. It has led to the development of a paradigm called software defined network (SDN). It separates the network intelligence into the control plane and forwarding logic into the data plane. This architecture gives scope to various security issues of which denial of service (DoS) is the most common and challenging to detect. This paper focuses on the detection and mitigation of a slow DoS attack called Slowloris on Apache2 server in SDN based networks. The proposed solution is called Slowloris detection and mitigation mechanism (SDMM). Mininet, an emulator, and SimpleHTTPServer are used for simulation and the same is implemented using Zodiac FX OpenFlow switch, Ryu controller and Apache2 server. SDMM algorithm detects and mitigates prolonged Slowloris attack in typical networks as well as in slow networks with low bandwidth and high delay in 240-280s with an accuracy of 100% and 98% respectively. It uses expectation of burst size as a key factor for detection.

Construct an efficient distributed denial of service attack detection system based on data mining techniques

<span>Distributed denial-of-service (DDoS) attack is bluster to network security that purpose at exhausted the networks with malicious traffic. Although several techniques have been designed for DDoS attack detection, intrusion detection system (IDS) It has a great role in protecting the network system and has the ability to collect and analyze data from various network sources to discover any unauthorized access. The goal of IDS is to detect malicious traffic and defend the system against any fraudulent activity or illegal traffic. Therefore, IDS monitors outgoing and incoming network traffic. This paper contains a based intrusion detection system for DDoS attack, and has the ability to detect the attack intelligently, dynamically and periodically by evaluating the set of attackers of the current node with its neighbors. We use dataset named CICDDoS2019 that contains on binary classes benign and DDoS. Performance has evaluated by applying data mining algorithms as well as applying the best features to discover potential attack classes.</span>

Deep belief network and support vector machine fusion for distributed denial of service and economical denial of service attack detection in cloud

SummaryCloud computing is a progressive technology that offers computing resources as Internet‐based services, revolutionized information, and communication technologies. From an economic standpoint, this transformation is beneficial because it allows them to streamline technology infrastructure and capital costs. However, economical denial of service (EDoS) potential is a crucial impediment to cloud computing success. Several improved ways to detect EDoS and distributed denial of service (DDoS) attacks in the cloud have been presented; nevertheless, these approaches still result in a considerable reduction in detection accuracy when employed in a cloud setting. Because selecting relevant features and precise classifiers for attack detection is a challenge. We recommend using an EDoS and DDoS attack identification framework in the cloud based on optimized deep learning techniques for higher detection accuracy. The experimental results reveal True Positive Rate (TPR) varies from 98.9% to 99.8% when using deep belief network with support vector machine as a learning mechanism, while True Negative Rate (TNR) from 99.6% to 99.9%. TPR and TNR were found to have average values of 99.32% and 99.67%, respectively. At 1600 requests/s, the maximum accuracy achieved and the overall accuracy of the proposed strategy was 99.78%.

Distributed denial of service attack detection in cloud computing using hybrid extreme learning machine

Cloud computing has become popular due to its on-demand, pay-as-you-use and ubiquitous features. This technology suffers from various security risks. Distributed denial of service (DDoS) attack is one of these security risks. It is used to disrupt the services provided by cloud computing. In DDoS attack, the cloud server is overwhelmed with fake requests by the attacker. This makes long response time for legitimate users or shut down of the service completely. In this work, a DDoS attack detection model based on extreme learning machine (ELM) has been proposed. Experiments show that proposed model can be trained in a very short period of time and provides high detection accuracy.

Machine Learning-based Distributed Denial of Service Attacks Detection Technique using New Features in Software-defined Networks

Software-Defined Networking is a new network architecture that separates control and data planes. It has central network control and programmability facilities, so it improves manageability, scaling, and performance. However, it may suffer from creating a single point of failure against the controller, which represents the network control plane. So, defending the controller against attacks such as a distributed denial of service attack is a valuable and urgent issue. The advances of this paper are to implement an accurate and significant method to detect this attack with high accuracy using machine learning-based algorithms exploiting new advanced features obtained from traffic flow information and statistics. The developed model is trained with kernel radial basis function. The technique uses advanced features such as unknown destination addresses, packets inter-arrival time, transport layer protocol header, and type of service header. To the best knowledge of the authors, the proposed approach of the paper had not been used before. The proposed work begins with generating both normal and attack traffic flow packets through the network. When packets reach the controller, it extracts their headers and performs necessary flow calculations to get the needed features. The features are used to create a dataset that is used as an input to linear support vector machine classifier. The classifier is used to train the model with kernel radial basis function. Methods such as Naive Bayes, K-Nearest Neighbor, Decision Tree, and Random Forest are also utilized and compared with the SVM model to improve the detection operation. Hence, suspicious senders are blocked and their information is stored. The experimental results prove that the proposed technique detects the attack with high accuracy and low false alarm, compared to other related techniques.

A cooperative DDoS attack detection scheme based on entropy and ensemble learning in SDN

In order to solve the problem of distributed denial of service (DDoS) attack detection in software-defined network, we proposed a cooperative DDoS attack detection scheme based on entropy and ensemble learning. This method sets up a coarse-grained preliminary detection module based on entropy in the edge switch to monitor the network status in real time and report to the controller if any abnormality is found. Simultaneously, a fine-grained precise attack detection module is designed in the controller, and a ensemble learning-based algorithm is utilized to further identify abnormal traffic accurately. In this framework, the idle computing capability of edge switches is fully utilized with the design idea of edge computing to offload part of the detection task from the control plane to the data plane innovatively. Simulation results of two common DDoS attack methods, ICMP and SYN, show that the system can effectively detect DDoS attacks and greatly reduce the southbound communication overhead and the burden of the controller as well as the detection delay of the attacks.

Distributed Denial of Service Attacks Detection System by Machine Learning Based on Dimensionality Reduction

Data mining algorithms have essential methods and rules that can contribute in detecting and preventing various types of network attacks. These methods are utilized with the intrusion detection systems that can be designed and developed preserve the information in organizations from damage. Specifically, the data mining technique allows users to effectively distinguish between normal and malicious traffic with good accuracy. In this paper, a methodology for revealing and detecting (DDOS) network attack was suggested using DM algorithms. The utilized methodology is divided especially into four parts, each part has its own rules, as the following: First one is the pre-processing which consists of three sub-steps: (i) encoding, (ii) log2, and (iii) PCA. Encoding is used by converting the original nominal packets into numeric features. Standardization of data was performed using logarithmic algorithm. Finally the PCA technique is applied eight times for several different features to reduce the dimensions of the dataset. The second stage is an anomaly detection model, (RF) algorithm is implemented for the extraction of data patterns while classification the types of the given features in training step, (NB) algorithm was also used in classifying the data to compare the results of its classification with the results of using the classifier (RF). In the third stage, the outcomes were tested by implementing the already trained datasets. In the fourth stage, the proposed system performance evaluation metrics were collected such as the rates of accuracy, false alarm, detection, precision, and F.measure.MIX dataset were utilized to train and test the proposed model which resulted from merging two datasets (PORTMAP+LDAP), which are used from the CICDDOS2019 datasets, each consisting of several types of attack packets, and benign packets.Several metrics were utilized in the evaluation of the proposed system. The best outcomes were obtained for detection by using the log2 algorithm and PCA technique in the preprocessing step and using (RF)classifier to classify the dataset. the accuracy when using MIX dataset was 99.9764%, the detection rate was 100%, false alarm rate ≍ 0, and the F.measure was 99.9% when PCA = 25.

Data Mining Approach for Cyber Security

Use of internet and communication technologies plays significant role in our day to day life. Data mining capability is leveraged by cybercriminals as well as security experts. Data mining applications can be used to detect future cyber-attacks by analysis, program behavior, browsing habits and so on. Number of internet users are gradually increasing so there is huge challenges of security while working in the cyber world. Malware, Denial of Service, Sniffing, Spoofing, cyber stalking these are the major cyber threats. Data mining techniques are provides intelligent approach for threat detections by monitoring abnormal system activities, behavioral and signatures patterns. This paper highlights data mining applications for threat analysis and detection with special approach for malware and denial of service attack detection with high precision and less time.

Distributed Denial of Service Attacks Prevention, Detection and Mitigation – A Review

A distributed denial of service (DDoS) is an attack to stop the server machine partially/completely with a request flood using internet or intranet. The main aim of the DDoS attack is to collapse the network or server with abnormal traffic to make the service unavailable for the legitimate users. It has been reported in the article "Coronavirus Pandemic Based Cyber-attacks" dated 23 Mar 2020 in Indian Computer Emergency Response Team (CERT-In) website. In April 10, 2020, the Indian governmental agency sends precautionary notice to all schools, colleges and universities regarding the measures for the prevention of web intrusion, DDoS and malware attacks. In this survey, the DDoS attacks, preventive measures, detection techniques, mitigation approaches, challenges and limitations of the existing research work were clearly analyzed. Finally, the broad research area on this attack is discussed which need more precautionary measures in future with the advancement of technologies to avoid severe cyber-attacks.

Mathematical Approach as Qualitative Metrics of Distributed Denial of Service Attack Detection Mechanisms

The distributed denial of service (DDoS) attack is one of the most destructive organized cyber-attacks against online services or computers on the network. Despite the existence of many mechanisms to detect DDoS attacks, the problem is still prevalent. This research dissected and analyzed twenty-two existing DDoS attack detection mechanisms, representing all types of DDoS attack defense approaches, to determine the reason for the persistent successful DDoS attacks. This research posits two hypotheses concerning this gap: First, a lack of mathematical function usage by the existing detection mechanisms. The few functions used are limited to logical, statistical, or probability functions, resulting in reduced detection effectiveness. Second, researchers unintentionally or inadvertently miscalculate the mechanisms’ detection accuracy rate by partially using quantitative metrics. This research has three objectives; to propose a set of qualitative metrics based on mathematical functions, to measure the relationship between the quantitative and qualitative metrics in the DDoS attack detection mechanisms, and to prove the relationship between the genuineness of the existing mechanisms’ detection accuracy, and full consideration of quantitative metrics and diversity of qualitative and metrics. The result revealed a correlation rate of 84.22 %, which reflects the correctness of the detection accuracy. Third, identifying the manipulation percentage of reported detection accuracy by employing the correlation rate complement. The result indicated that 15.78 % of the reviewed mechanisms had manipulated or inadvertently miscalculated the accuracy.

Tensor based framework for Distributed Denial of Service attack detection

Distributed Denial of Service (DDoS) attacks are one of the most important security threats, since multiple compromised systems perform massive attacks over a victim, overwhelming its bandwidth and/or resources. Such attacks can be detected, for example, by using supervised machine learning based solutions previously trained on large DDoS attack datasets in order to automatically identify malicious patterns present in the incoming traffic. In addition, since large datasets show inherent multidimensional structures, tensor based detection techniques can outperform the matrix based counterparts. In this context, the development of a DDoS attack detection framework which exploits both machine learning and tensor based approaches is crucial. To face this challenge, this paper proposes a novel tensor based framework for DDoS attack detection using concepts of multiple denoising, tensor decomposition and machine learning supervised classification. Moreover, we also propose an extension of the recent Multiple Denoising algorithm such that the noise present in the dataset instances is more efficiently attenuated. Finally, we validate the effectiveness of our proposed framework through comparison with state-of-the-art low-rank approximation techniques as well as with related works. The proposed approach outperforms its competitor schemes in terms of accuracy, detection rate and false alarm rate.

Error-Robust Distributed Denial of Service Attack Detection Based on an Average Common Feature Extraction Technique.

In recent years, advanced threats against Cyber–Physical Systems (CPSs), such as Distributed Denial of Service (DDoS) attacks, are increasing. Furthermore, traditional machine learning-based intrusion detection systems (IDSs) often fail to efficiently detect such attacks when corrupted datasets are used for IDS training. To face these challenges, this paper proposes a novel error-robust multidimensional technique for DDoS attack detection. By applying the well-known Higher Order Singular Value Decomposition (HOSVD), initially, the average value of the common features among instances is filtered out from the dataset. Next, the filtered data are forwarded to machine learning classification algorithms in which traffic information is classified as a legitimate or a DDoS attack. In terms of results, the proposed scheme outperforms traditional low-rank approximation techniques, presenting an accuracy of , detection rate of and false alarm rate of for a dataset corruption level of with a random forest algorithm applied for classification. In addition, for error-free conditions, it is found that the proposed approach outperforms other related works, showing accuracy, detection rate and false alarm rate of , and , respectively, for the gradient boosting classifier.