Service Attacks Research Articles

Enhancing Multi-Class DDoS Attack Classification using Machine Learning Techniques

Distributed Denial of Service (DDoS) attacks, which adversely impact network availability, confidentiality, and integrity, represent a persistent threat. These attacks involve affected systems consuming resources through spurious requests instead of serving legitimate clients. Various methodologies exist for detecting and mitigating DDoS attacks, with Machine Learning (ML) emerging as a particularly effective approach due to its predictive capabilities after training on pertinent data. The primary objective of this study is to identify an improved ML algorithm for the detection of multiple DDoS types, considering metrics such as accuracy, precision, recall, and training time. Leveraging WEKA tools and the CICDDoS2019 dataset, several machine-learning algorithms, including Multilayer Perceptron, Reduced Error Pruning (REP) Tree, Partial Decision Tree (PART), RandomForest, and J48, were trained and evaluated. Among these, J48 was determined to be the superior algorithm for classifying four DDoS types (UDP, SYN, Portmap, MSSQL), based on the aforementioned criteria. The algorithms were experimented with using diverse sets of features, and optimal results were obtained using six features, resulting in an overall accuracy of 99.97%. Subsequently, the selected algorithm was integrated into a real-time model, exhibiting exceptional performance, which will be thoroughly elucidated and discussed in a forthcoming paper.

Smart network security using advanced ensemble-DDoS attack detection and hybrid JA-SLOA-linked optimal routing-based mitigation

ABSTRACT Distributed Denial of Service (DDoS) attacks are distributed at a faster rate, and they are considered to be fatal threats over the Internet. Moreover, several deep learning approaches are insufficient to attain the maximum efficiency and appropriate detection due to the complexity and diversity of DDoS attack traffic under fast fast-speed network environment since they are providing with individual performance. Hence, an ensemble learning model is developed for DDoS detection and mitigation with the hybrid optimization algorithm to ensure good detective performance against DDoS attacks. The pre-processed data is fed to the feature extraction process where it is done through the Deep Belief Network (DBN) and Autoencoder techniques for acquiring the deep features. The optimized fusion of deep features takes place using hybrid meta-heuristic algorithm of Adaptive Sound Speed-based Jaya Sea Lion Optimization (ASS-JSLnO). The attack detection is performed by the Improved Ensemble Learning (IEL) approach. Then, the mitigation strategy is applied by the optimal routing and multi-objective function. Finally, the experiments are made to establish the high detection efficacy of the implemented attack detection and mitigation framework.

Cyber security Vulnerabilities and Remediation Through Cloud Security Tools

The proliferation of internet usage has surged dramatically, prompting individuals and businesses to conduct myriad transactions online rather than in physical spaces. The onset of the COVID-19 pandemic has further propelled this trend. Consequently, traditional forms of crime have migrated to the digital realm alongside the widespread adoption of digital technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and crypto currencies, amplifying security concerns in cyberspace. Notably, cybercriminals have begun offering cyber attacks as a service, automating attacks to magnify their impact. These attackers exploit vulnerabilities across hardware, software, and communication layers, perpetrating various forms of cyber attacks including distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware attacks. The sophistication of these attacks renders conventional protection systems, such as firewalls, intrusion detection systems, antivirus software, and access control lists, ineffective in detection. Consequently, there is an urgent imperative to devise innovative and pragmatic solutions to thwart cyber attacks. This paper elucidates the primary drivers behind cyber attacks, surveys recent attack instances, patterns, and detection methodologies, and explores contemporary technical and non-technical strategies for preemptively identifying and mitigating attacks. Leveraging cutting-edge technologies like machine learning, deep learning, cloud platforms, big data analytics, and blockchain holds promise in combating present and future cyber threats. These technological interventions can aid in malware detection, intrusion detection, spam filtering, DNS attack classification, fraud detection, identification of covert channels, and discernment of advanced persistent threats. Nonetheless, it's crucial to acknowledge that some promising solutions, notably machine learning and deep learning, are susceptible to evasion techniques, necessitating careful consideration when formulating defenses against sophisticated cyber attacks.

Cyber security Vulnerabilities and Remediation Through Cloud Security Tools

The proliferation of internet usage has surged dramatically, prompting individuals and businesses to conduct myriad transactions online rather than in physical spaces. The onset of the COVID-19 pandemic has further propelled this trend. Consequently, traditional forms of crime have migrated to the digital realm alongside the widespread adoption of digital technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and crypto currencies, amplifying security concerns in cyberspace. Notably, cybercriminals have begun offering cyber attacks as a service, automating attacks to magnify their impact. These attackers exploit vulnerabilities across hardware, software, and communication layers, perpetrating various forms of cyber attacks including distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware attacks. The sophistication of these attacks renders conventional protection systems, such as firewalls, intrusion detection systems, antivirus software, and access control lists, ineffective in detection. Consequently, there is an urgent imperative to devise innovative and pragmatic solutions to thwart cyber attacks. This paper elucidates the primary drivers behind cyber attacks, surveys recent attack instances, patterns, and detection methodologies, and explores contemporary technical and non-technical strategies for preemptively identifying and mitigating attacks. Leveraging cutting-edge technologies like machine learning, deep learning, cloud platforms, big data analytics, and blockchain holds promise in combating present and future cyber threats. These technological interventions can aid in malware detection, intrusion detection, spam filtering, DNS attack classification, fraud detection, identification of covert channels, and discernment of advanced persistent threats. Nonetheless, it's crucial to acknowledge that some promising solutions, notably machine learning and deep learning, are susceptible to evasion techniques, necessitating careful consideration when formulating defenses against sophisticated cyber attacks.

Cyber security Vulnerabilities and Remediation Through Cloud Security Tools

The proliferation of internet usage has surged dramatically, prompting individuals and businesses to conduct myriad transactions online rather than in physical spaces. The onset of the COVID-19 pandemic has further propelled this trend. Consequently, traditional forms of crime have migrated to the digital realm alongside the widespread adoption of digital technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and crypto currencies, amplifying security concerns in cyberspace. Notably, cybercriminals have begun offering cyber attacks as a service, automating attacks to magnify their impact. These attackers exploit vulnerabilities across hardware, software, and communication layers, perpetrating various forms of cyber attacks including distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware attacks. The sophistication of these attacks renders conventional protection systems, such as firewalls, intrusion detection systems, antivirus software, and access control lists, ineffective in detection. Consequently, there is an urgent imperative to devise innovative and pragmatic solutions to thwart cyber attacks. This paper elucidates the primary drivers behind cyber attacks, surveys recent attack instances, patterns, and detection methodologies, and explores contemporary technical and non-technical strategies for preemptively identifying and mitigating attacks. Leveraging cutting-edge technologies like machine learning, deep learning, cloud platforms, big data analytics, and blockchain holds promise in combating present and future cyber threats. These technological interventions can aid in malware detection, intrusion detection, spam filtering, DNS attack classification, fraud detection, identification of covert channels, and discernment of advanced persistent threats. Nonetheless, it's crucial to acknowledge that some promising solutions, notably machine learning and deep learning, are susceptible to evasion techniques, necessitating careful consideration when formulating defenses against sophisticated cyber attacks.

Building IPv6 addressing scheme using Hybrid Duplicate Address Detection to prevent Denial of Service Attack

Internet Protocol version 6 (IPv6) address configuration is needed to meet the needs of current portable devices and wearable applications, where each device needs its own unique identification number. High complexity in Wireless Sensor Network (WSN) and Internet of Things (IoT) environments has increased challenges, such as low energy consumption and high overhead in IPv6 address configuration. The proposed IPv6 generation is based on a hybrid mathematical approach that retains the IP address’s confidentiality and prevents Denial of Service (DoS) attacks from new and existing nodes in the network. In this paper, the proposed hybrid protocol for DoS attacks from new and existing nodes is analyzed. It is evident from the results that the rate of successful configuration, overhead, and energy consumption is found to be better than the existing approach, namely, Programming Protocol-independent Packet Processors Duplicate Address Detection (P4DAD), match prevention technique, etc.

A Lightweight, Efficient, and Physically Secure Key Agreement Authentication Protocol for Vehicular Networks

In the contemporary era, Vehicular Ad Hoc Networks (VANETs) have emerged as a vital technology in intelligent transportation systems, substantially enhancing the overall travel experience by providing advanced services to vehicles while ensuring driver safety. Despite the notable improvements, the inherent complexity of VANETs presents persistent security challenges, encompassing issues such as privacy preservation for vehicles, message authentication, and constraints in computational power and network bandwidth. Various authentication protocols have been designed for VANETs. However, many of these protocols exhibit significant vulnerabilities, rendering them insecure and unreliable in the face of diverse security threats, such as denial of service, replay, forgery, and impersonation attacks. Moreover, some existing schemes encounter limitations, including high computational complexity and the introduction of additional communication overhead and computational costs. To tackle these concerns, we designed a lightweight and secure identity authentication protocol based on elliptic curve cryptography with the objective of furnishing an effective and secure data transmission mechanism across a public communication channel for the Internet of Vehicles. In addition, we introduce Physically Unclonable Functions (PUFs) to ensure physical layer security during the communication process. A detailed security analysis demonstrates that the proposed protocol is resilient against various attacks. Through a comparative analysis with existing relevant protocols, in scenarios with a high density of vehicles, the algorithm demonstrates significantly lower computational costs and communication overhead than the related protocols, indicating that the proposed protocol is lightweight and efficient. Consequently, the empirical findings indicate that our protocol surpasses others in terms of reliability, user convenience, and practicality for ensuring secure data transmission within VANETs.

A comprehensive survey on DDoS attacks detection & mitigation in SDN-IoT network

The Internet of Things (IoT) has transformed our lives by introducing new services and enhancing productivity. However, the widespread adoption of IoT devices and communication units has posed challenges in network management. In response, there is a growing necessity to rethink and redesign IoT network control. Software-defined networking (SDN) has emerged as a promising solution, leveraging its programmability and centralized management capabilities. SDN can simplify network management, offer network abstraction, facilitate development, and efficiently handle the complexities of IoT networks. Despite these advantages, security concerns, particularly the threat of Distributed Denial of Service (DDoS) attacks, persist in the IoT landscape. This survey focuses on exploring the collaboration between SDN and IoT. It investigates various types of DDoS attacks and highlights different types of defense, detection, and mitigation methods employed to address DDoS threats in SDN-based IoT (SDN-IoT) networks.

Secure adaptive event-triggered anti-synchronization for BAM neural networks with energy-limited DoS attacks

This article focuses on the problem of adaptive event-triggered anti-synchronization control for bidirectional associative memory neural networks subject to energy-limited denial of service attacks. First, a novel adaptive event-triggered scheme is developed by resorting to the acknowledgment character technique, which can help conserve valuable communication resources and has better performance in resisting malicious cyber attacks compared to traditional schemes. Second, a more general attack strategy for denial of service attacks is proposed with the consideration of energy constraints, and an anti-synchronization error system is established to analyze the anti-synchronization behavior. Then, sufficient conditions are provided to guarantee the anti-synchronization of drive and response bidirectional associative memory neural networks in H∞ sense. Next, a design approach is obtained based on the above conditions for the controller gains. Finally, a numerical example is employed to demonstrate the effectiveness of the proposed method and its superiority over the traditional event-triggered scheme.

A Blockchain-Assisted Security Protocol for Group Handover of MTC Devices in 5G Wireless Networks.

In the realm of the fifth-generation (5G) wireless cellular networks, renowned for their dense connectivity, there lies a substantial facilitation of a myriad of Internet of Things (IoT) applications, which can be supported by the massive machine-type communication (MTC) technique, a fundamental communication framework. In some scenarios, a large number of machine-type communication devices (MTCD) may simultaneously enter the communication coverage of a target base station. However, the current handover mechanism specified by the 3rd Generation Partnership Project (3GPP) Release 16 incurs high signaling overhead within the access and core networks, which may have negative impacts on network efficiency. Additionally, other existing solutions are vulnerable to malicious attacks such as Denial of Service (DoS), Distributed Denial of Service (DDoS) attacks, and the failure of Key Forward Secrecy (KFS). To address this challenge, this paper proposes an efficient and secure handover authentication protocol for a group of MTCDs supported by blockchain technology. This protocol leverages the decentralized nature of blockchain technology and combines it with certificateless aggregate signatures to mutually authenticate the identity of a base station and a group of MTCDs. This approach can reduce signaling overhead and avoid key escrow while significantly lowering the risk associated with single points of failure. Additionally, the protocol protects device anonymity by encrypting device identities with temporary anonymous identity markers with the Elliptic Curve Diffie-Hellman (ECDH) to abandon serial numbers to prevent linkage attacks. The resilience of the proposed protocol against predominant malicious attacks has been rigorously validated through the application of the BAN logic and Scyther tool, underscoring its robust security attributes. Furthermore, compared to the existing solutions, the proposed protocol significantly reduces the authentication cost for a group of MTCDs during handover, while ensuring security, demonstrating commendable efficiency.

Adversarially robust and real-time DDoS detection and classification framework using AutoML

ABSTRACT Denial of Service (DoS) attacks target the availability part of the CIA triad (Confidentiality, Availability, and Integrity). A special category of these attacks is the Distributed DoS (DDoS) attack, where the attacker uses a network of compromised systems called a botnet to flood a target server with requests and refuses to serve legitimate users. DDoS attacks can cost an organization millions of dollars in terms of lost revenue, remediation costs, and damage to brand reputation. Hence, all organizations need speedy real-time detection of DDoS attacks. This work presents a DDoS detection and classification framework using the flow-based approach for feature engineering and the AutoML technique. Our detection system is trained on the latest DDoS datasets – CIC-DDoS 2019 and CIC-IDS 2017, which contain various categories of DDoS attacks. We use various tools to perform adversarial attacks on our trained model. We retrain our models using adversarially crafted network packet captures and then test our models for robustness against practical adversarial attacks that an attacker might use to evade detection. Finally, we deploy our model in real-time using a GUI-based tool. Our model achieves a validation accuracy of 99.9% and a low false positive rate of 0.05%.

Optimizing Performance Random Forest Algorithm Using Correlation-Based Feature Selection (CFS) Method to Improve Distributed Denial of Service (DDoS) Attack Detection Accuracy

In the ever-evolving digital era, Distributed Denial of Service (DDoS) attacks have become a major threat to the security of networks and online services, making it important to develop effective strategies to detect and overcome such attacks.This research aims to improve the performance of Random Forest algorithm in dealing with DDoS attacks by using Correlation-Based Feature Selection method. This method can identify and select the most relevant features from the dataset used, in this case the CIC-DDoS2019 dataset, with respect to accuracy, precision, recall, and F1-score as evaluation metrics, so that this research achieves the best results in effectively detecting and preventing DDoS attacks, making an important contribution in strengthening the security of networks and online services.The results show that the application of the Correlation-Based Feature Selection method is able to improve DDoS attack detection in a complex network context using the Random Forest algorithm, increasing the detection accuracy rate to 99.89%. These findings highlight the potential of using the Random Forest algorithm with the CFS method in improving DDoS attack detection in complex network environments.This study recorded a significant improvement compared to the previous study, which only achieved an accuracy rate of 99.7% using the feature importance method.

Localization and Detection of Sinkhole Attacks in Wireless Sensor Networks Based on Denial of Service (DoS) Attacks

A wireless sensor network (WSN) uses uniformly deployed and positioned sensors to regularly send sensed data to a centralized station. Sinkhole attacks, in which a malicious node draws packets from other legitimate sensor devices and drops them, are the main danger to the WSN network layer and continue to be a difficult problem on wireless sensor networks. Security becomes a major issue since these networks have limited assets including less memory, less energy, and less transmission capacity. Additionally, given the dynamic context in which they are deployed, they are vulnerable to a variety of Denial of Service (DoS) assaults, including wormhole, sinkhole, and black hole attacks. The most dangerous routing attack at the network layer is known as a "sinkhole assault," which directs all network traffic onto a fake path by sending false information under the impression that it is the quickest one to the server. We explore sinkhole attacks to prevent them, and this work proposes a method of detection based on the redundancy process. Messages are transmitted across multiple paths to the suspicious nodes. Upon a thorough evaluation of the response, the attacked nodes are ultimately verified. Finally, a simulation is run to evaluate the method's efficacy. Furthermore, the simulation indicates that the strategy might be somewhat successful. Finally, it draws attention to difficulties and offers a prospective viewpoint for identifying sinkhole attacks.

Fine-tuning a pre-trained ResNet50 model to detect distributed denial of service attack

Distributed denial-of-service (DDoS) attacks pose a significant risk to the dependability and consistency of network services. The utilization of deep learning (DL) models has displayed encouraging outcomes in the identification of DDoS attacks. Nevertheless, crafting a precise DL model necessitates an extensive volume of labeled data and substantial computational capabilities. Within this piece, we introduce a technique to enhance a pre-trained DL model for the identification of DDoS attacks. Our strategy’s efficacy is showcased on an openly accessible dataset, revealing that the fine-tuned model we propose surpasses both the initial pre-trained model and other cutting-edge approaches in performance. The suggested fine-tuned model attained 95.1% accuracy, surpassing the initial pre-trained model as well as other leading-edge techniques. Please note that the specific evaluation metrics and their values may vary depending on the implementation, hyperparameter settings, number of datasets, or dataset characteristics. The proposed approach has several advantages, including reducing the amount of labeled data required and accelerating the training process. Initiating with a pre-existing ResNet50 model can also enhance the eventual model’s accuracy, given that the pre-trained model has already acquired the ability to extract significant features from unprocessed data.

Analysis and Comparison of Machine Learning Techniques for DDoS Attack Classification in Network Environments

This research presents a comparative analysis of machine learning techniques for classifying Distributed Denial of Service (DDoS) attacks within network traffic. We evaluated the performance of three algorithms: Logistic Regression, Decision Tree, and Random Forest, including their scaled-feature counterparts. The study utilized a robust methodology incorporating advanced data preprocessing, feature engineering, and Synthetic Minority Over-sampling Technique (SMOTE) to address class imbalance. The models were rigorously tested using a cross-validation framework, assessing their accuracy, precision, recall, and F1 score. Results indicated that the Random Forest algorithm outperformed the others, demonstrating superior predictive accuracy and consistency, albeit with higher computational costs. Logistic Regression, when feature-scaled, showed significant improvement in performance, highlighting the importance of data normalization in models sensitive to feature scaling. Decision Trees provided a quick and interpretable model, though slightly less accurate than the Random Forest. The research findings highlight the trade-offs between predictive performance and computational efficiency in selecting machine learning models for cybersecurity applications. The study contributes to the cybersecurity domain by elucidating the efficacy of ensemble techniques in DDoS attack classification and underscores the potential for model improvement through scaling and data balancing.

Securing the Cloud: Understanding Threats and Countermeasures

Abstract: Cloud computing has completely transformed how businesses and individuals store, manage, and retrieve data. Nevertheless, despite its many benefits, there are inherent security challenges. This research investigates the different risks encountered by cloud computing, which consist of data breaches, insider threats, and denial of service attacks. It also covers successful prevention methods like encryption, multi-factor authentication, routine security checks, and staff education. By comprehending these dangers and putting in place strong security measures, organizations can improve the security of their cloud environments and guarantee the confidentiality, integrity, and availability of their data. Cloud computing is now being extensively researched and utilized in both academic and industrial sectors. Both cloud service providers (CSPs) and consumers benefit from cloud computing. The security issues related to cloud computing have been extensively researched in various studies.

Toward Generating a New Cloud-Based Distributed Denial of Service (DDoS) Dataset and Cloud Intrusion Traffic Characterization

The distributed denial of service attack poses a significant threat to network security. Despite the availability of various methods for detecting DDoS attacks, the challenge remains in creating real-time detectors with minimal computational overhead. Additionally, the effectiveness of new detection methods depends heavily on well-constructed datasets. This paper addresses the critical DDoS dataset creation and evaluation domain, focusing on the cloud network. After conducting an in-depth analysis of 16 publicly available datasets, this research identifies 15 shortcomings across various dimensions, emphasizing the need for a new approach to dataset creation. Building upon this understanding, this paper introduces a new public DDoS dataset named BCCC-cPacket-Cloud-DDoS-2024. This dataset is meticulously crafted, addressing challenges identified in previous datasets through a cloud infrastructure featuring over eight benign user activities and 17 DDoS attack scenarios. Also, a Benign User Profiler (BUP) tool has been designed and developed to generate benign user network traffic based on a normal user behavior profile. We manually label the dataset and extract over 300 features from the network and transport layers of the traffic flows using NTLFlowLyzer. The experimental phase involves identifying an optimal feature set using three distinct algorithms: ANOVA, information gain, and extra tree. Finally, this paper proposes a multi-layered DDoS detection model and evaluates its performance using the generated dataset to cover the main issues of the traditional approaches.

Threats and Legal Protection of Personal Data Combined in E-Commerce Transactions Based on Personal Data Protection Law in Indonesia

The dynamics of Indonesian trade are becoming more complex as time goes on, and one form of this development is digitalization. Although it has a positive impact, trade digitization also has a negative impact on different points of view, one of which is the threat in terms of combined personal data. Combined personal data is one type of personal data that is protected by the state through legal protection, so that the state guarantees people’s personal data. This scientific research uses one part of the grand method, namely Library Research which is based on literature or literature. The results of the research show that there are three forms of threats to people’s personal data combined in e-commerce transactions, especially in the use of IP Address, namely threats to geographic location tracking, unauthorized use and opening of personal data, and Distributed Denial of Service (DDoS) attacks. In the legal space in Indonesia, the three threats themselves do not yet have further rules related to the form and mechanism of protection and have different arrangements as a form of protection. Law Number 27 of 2023 concerning Personal Data Protection, Law Number 19 of 2016 amending Law Number 11 of 2008 concerning Electronic Information and Transactions, and Government Regulation of the Republic of Indonesia Number 71 of 2019 concerning the Implementation of Electronic Systems and Transactions. Based on this research, it is necessary to provide legal rules related to the form and mechanism of protecting a person’s IP Address as one type of personal data in Indonesia.

TCP/IP stack transport layer performance, privacy, and security issues

Transmission Control Protocol/ Internet Protocol (TCP/IP) is the backbone of Internet transmission. The Transport Layer of the TCP/IP stack, which includes TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) protocols, plays a crucial role in ensuring reliable communication between devices over a network. To come up with measures that make networks more secure, it is important to learn about the vulnerabilities that exist in the transport TCP/IP stack and then have an understanding of the typical attacks carried out in such layer. This paper explores how the TCP Protocol works, the TCP/IP 3 Way Handshake, TCP Header Structure, the typical vulnerabilities and the classical attacks of transport layer TCP/IP, tools, and solutions adopted to prevent and reduce the chances of some of these attacks. The findings indicated that the major TCP/ IP stack transport layer threats include Finger printing, SYN Flood, TCP reassembly and sequencing, IP Spoofing, TCP session hijacking, RST and FIN denial of service attack, Ping of Death, Low Rate/ Shrew Attacks. Their preventive measures and mechanisms are discussed.

DDoS Attack Detection in SDN-Based Instrumented Ad Hoc Networks

The physical characteristics of today's urban intersection structures and the traffic flows caused by unplanned road intersections lead to many negative effects such as time/cash loss, stress, increased fuel consumption, and more. For this reason, many studies are being conducted on traffic management systems, an application of smart cities, in both academic and commercial circles. In recent years, it has been observed that the VANET (Vehicular Ad Hoc Networks) architecture, which easily enables communication between vehicles or with devices on the side of the field, thus transporting relevant traffic data to the center, is frequently used in these studies. When Software Defined Networking emerged as a new technology, it brought many advantages such as high availability, scalability, and performance, but also introduced new security vulnerabilities targeted by attackers. This research primarily focuses on a resource-based detection approach by combining the powers of Software Defined Networking and s-Flow-RT technology against Distributed Denial of Service Attacks. In the simulation study conducted within the scope of this work, an SDN (Software Defined Networking)-based DDoS (Distributed Denial of Service) attack was carried out, and changes in data before and after the attack were examined. Traffic for the DDoS attack was generated with the Hping3 application. The RYU controller (a component-based software-defined networking framework) was selected as the software-defined network controller to create software-defined networks, and the Mininet emulator was used. A traditional computer network's Ubuntu virtual machine was used to carry out the attack in the scope of the work.