Types Of Distributed Denial Of Service Attacks Research Articles

Strengthening network DDOS attack detection in heterogeneous IoT environment with federated XAI learning approach

Due to the rising use of the Internet of Things (IoT), the connectivity of networks increases the risk of Distributed Denial of Service (DDoS) attacks. Decentralized systems commonly used in centralized security systems fail to adequately prevent potential cyber threats in IoT because of the issues of privacy and scaling. The method proposed in this study seeks to remedy these facts by employing Explainable Artificial Intelligence (XAI) together with Federated Deep Neural Networks (FDNNs) to detect and prevent DDoS attacks. Our approach is thus to use federated learning models that are to be trained on distributed and dissimilar sources of data without compromising on the privacy aspect. FDNNs were trained over three rounds with information from three client gadgets incorporating pre-processed datasets of various types of DDoS attacks. Additionally, for feature selection, we integrated XGBoost with SHapley Additive exPlanations (SHAP) to improve model interpretability. The proposed solution can be considered to be quite robust, privacy-preserving, and highly scalable for the detection of DDoS attacks on the IoT network. The results shown on the server side indicate that this approach accurately detects 99.78% of DDoS attacks with a precision rate as high as 99.80%, recall rate (detection rate) going up to 99.74% and F1 score reaching 99.76%. They emphasize that FL-based IDSs are strong enough to cope with cybersecurity challenges in IoT, thus offering hope for securing modern network infrastructures against ever-growing cyber threats.

DDoS Attack Detection with Machine Learning

Nowadays, Distributed Denial of Service (DDoS) attacks are a major issue in internet security. These attacks target servers or network infrastructure. Similar to an unanticipated traffic jam on highway (lagging/crash) that prevent normal traffic reach to destination. DDoS may prevent users to access any system services. Researchers and scientists have developed numerous methods and algorithms to improve the performance of DDoS detection. In this paper, a DDoS detection method utilizing machine learning is proposed. There are three type of supervised machine learning classification methods which are K-Nearest Neighbor, Multilayer Perceptron and Random Forest, are applied in the proposed work to assess the accuracy of the model in training and testing processes. RF classification provides robustness and interpretability, MLP offers deep learning capabilities for complex patterns, and K-NN delivers simplicity and adaptability for instance-based learning. Together, these methods can contribute to a comprehensive DDoS attack detection system using machine learning. There are two types of classification setups: binary and multi-class classification. Binary classification involves identifying traffic as either a DDoS attack or normal using the NSL-KDD dataset. Multi-class classification, on the other hand, distinguishes between various types of DDoS attacks (such as DoS, Probe, U2R, and Sybil) and normal traffic using the NSL-KDD dataset. Feature engineering is also involved in this experiment to convert the categorical features into numerical values for detecting DDoS attack. Our model's performance was effective compared to other machine learning methods. RF achieved the highest accuracy rates: 99.35% in binary classification and 97.71% in multi-class classification. K-NN followed with 99.15% in binary and 97.35% in multi-class classification, while MLP achieved 90.63% in binary and 84.33% in multi-class classification.

Mitigating DDoS Attacks: A Machine Learning Approach for Enhanced Detection and Response

Distributed Denial of Service (DDoS) assaults continue to be among the most dangerous risks on the Internet. With the advances in equipment for spotting and mitigating these attacks, crackers have improved their skills in originating new DDoS attack types with the intent of cloning normal traffic behavior therefore becoming silently powerful. The so-called low-rate DoS assaults are a portion of these effective DDoS attack types that aim to archive limited network traffic. This paper proposes a machine learning algorithm for the mitigation of DDoS outbreaks in the application layer. Our scheme seeks to increase the exactness and efficacy of DDoS attack detection by employing the robustness of machine learning procedures which include neural networks and support vector machines, in combination with superior feature engineering and real-time monitoring. Our outcomes show that, of the four Machine Learning algorithms, Maximum Learning Performance (MLP) results in the best sorting marks. Particularly MLP leads to an F1-score of 98.04% for legitimate traffic, 99.30% for attack traffic on emulated movement, and an F1-score of 99.87% for target traffic and 99.95% for legitimate transportation on real traffic. When it concerned the procedure of distinguishing emulated traffic using FL, MLP, and EC, we were capable of gaining an F1-score of 98.80% for malware traffic and 99.60% for valid movement; but, when it related to real traffic, we were managed to obtain an F1-score of 100% for the assault traffic and 100% for normal traffic.

DTL-5G: Deep transfer learning-based DDoS attack detection in 5G and beyond networks

Network slicing is considered as a key enabler for 5G and beyond mobile networks for supporting a variety of new services, including enhanced mobile broadband, ultra-reliable and low-latency communication, and massive connectivity, on the same physical infrastructure. However, this technology increases the susceptibility of networks to cyber threats, particularly Distributed Denial-of-Service (DDoS) attacks. These attacks have the potential to cause service quality degradation by overloading network function(s) that are central to network slices to operate seamlessly. This calls for an Intrusion Detection System (IDS) as a shield against a wide array of DDoS attacks. In this regard, one promising solution would be the use of Deep Learning (DL) models for detecting possible DDoS attacks, an approach that has already made its way into the field given its manifest effectiveness. However, one particular challenge with DL models is that they require large volumes of labeled data for efficient training, which are not readily available in operational networks. A possible workaround is to resort to Transfer Learning (TL) approaches that can utilize the knowledge learned from prior training to a target domain with limited labeled data. This paper investigates how Deep Transfer Learning (DTL) based approaches can improve the detection of DDoS attacks in 5G networks by leveraging DL models, such as Bidirectional Long Short-Term Memory (BiLSTM), Convolutional Neural Network (CNN), Residual Network (ResNet), and Inception as base models. A comprehensive dataset generated in our 5G network slicing testbed serves as the source dataset for DTL, which includes both benign and different types of DDoS attack traffic. After learning features, patterns, and representations from the source dataset using initial training, we fine-tune base models using a variety of TL processes on a target DDoS attack dataset. The 5G-NIDD dataset, which has a sparse amount of annotated traffic pertaining to several DDoS attack generated in a real 5G network, is chosen as the target dataset. The results show that the proposed DTL models have performance improvements in detecting different types of DDoS attacks in 5G-NIDD dataset compared to the case when no TL is applied. According to the results, the BiLSTM and Inception models being identified as the top-performing models. BiLSTM indicates an improvement of 13.90%, 21.48%, and 12.22% in terms of accuracy, recall, and F1-score, respectively, whereas, Inception demonstrates an enhancement of 10.09% in terms of precision, compared to the models that do not adopt TL.

Eye-Net: A Low-Complexity Distributed Denial of Service Attack-Detection System Based on Multilayer Perceptron

Distributed Denial of Service (DDoS) attacks disrupt service availability, leading to significant financial setbacks for individuals and businesses. This paper introduces Eye-Net, a deep learning-based system optimized for DDoS attack detection that combines feature selection, balancing methods, Multilayer Perceptron (MLP), and quantization-aware training (QAT) techniques. An Analysis of Variance (ANOVA) algorithm is initially applied to the dataset to identify the most distinctive features. Subsequently, the Synthetic Minority Oversampling Technique (SMOTE) balances the dataset by augmenting samples for under-represented classes. Two distinct MLP models are developed: one for the binary classification of flow packets as regular or DDoS traffic and another for identifying six specific DDoS attack types. We store MLP model weights at 8-bit precision by incorporating the quantization-aware training technique. This adjustment slashes memory use by a factor of four and reduces computational cost similarly, making Eye-Net suitable for Internet of Things (IoT) devices. Both models are rigorously trained and assessed using the CICDDoS2019 dataset. Test results reveal that Eye-Net excels, surpassing contemporary DDoS detection techniques in accuracy, recall, precision, and F1 Score. The multiclass model achieves an impressive accuracy of 96.47% with an error rate of 8.78%, while the binary model showcases an outstanding 99.99% accuracy, maintaining a negligible error rate of 0.02%.

SDN Network DDOS Detection Using ML

This paper describes a technique that uses the Ryu Controller and Mininet to identify and mitigate Distributed Denial of Service (DDoS) threats in Software Defined Networks (SDN). Using Mininet, the suggested method entails building a virtual network topology with connected switches and hosts. The Ryu Controller gathers traffic data while Mininet simulates several DDoS attack types, such as ICMP flood, land assault, TCP SYN flood, and UDP attacks. The Ryu Controller collects both benign and DDoS traffic into a dataset that is used to build a machine learning (ML) model that can detect DDoS attacks in real time.

DDoS Attack Detection in Edge-IIoT Network Using Ensemble Learning

Abstract As the number of IoT devices increases daily due to the rapid growth in technology, every device and network is vulnerable to attacks because it is exposed to the internet. Denial of Service (DoS) is a prevalent type of intrusion on the Internet of Things (IoT) network in which the server becomes down due to flooding requests. Distributed Denial of Service (DDoS) is a special type of DoS attack where the network of malicious computers called botnet consumes the target’s system resources by flooding the requests. Edge computing is closely related to Industrial Internet of Things (IIoT), and industry 4.0. Both of them are relatively emerging technologies so security is a crucial part of them. By incorporating our contributions to the current and innovative dataset Edge-IIoT, the proposed study presents a novel approach to detect DDoS attacks in an IIoT network in the domain of edge computing, whether the traffic is normal or malicious (DDoS traffic). This study explores various Ensemble Learning (EL) techniques to predict normal and malicious DDoS traffic along with the type of DDoS attack. The study applies various preprocessing techniques like Synthetic Minority Over Sampling Technique (SMOTE), label encoding, etc. to enhance the model’s performance and reveals how EL techniques performs better in terms of accuracy than the individual classifiers. Further, the performance of all EL techniques has been investigated in terms of all evaluation measures, including the elapsed time. This important addition not only broadens the focus of study in this area but also offers insightful comparisons of the efficiency and precision of various ensemble approaches as well as individual classifiers. The study achieved a maximum of 99.99% in all evaluation measures.

A Robust DDoS Intrusion Detection System Using Convolutional Neural Network

In today’s digital age, the proliferation of network-connected devices has triggered a surge in cyberattacks. Distributed Denial-of-Service (DDoS) attacks pose a particularly formidable challenge to network security by disrupting access to vital services. While numerous researchers have proposed DDoS detection methods utilizing machine learning and deep learning techniques, developing a robust and reliable DDoS intrusion detection system remains challenging. This challenge is exacerbated by issues such as highly imbalanced data, multi-classification, and computational complexity. This paper proposes an innovative feature selection approach to create a robust intrusion detection system capable of detecting and classifying recent common DDoS attack types. We evaluate the performance of our model on the CICDDoS2019 benchmark dataset. Our experimental results demonstrate that our proposed model outperforms existing methods, achieving a detection accuracy of 96.82%, a recall of 96.82%, a precision of 96.76%, and an F1 score of 96.50%. Additionally, our model exhibits faster prediction times, with the ability to predict an attack in just 0.189 ms. Notably, our approach, combined with preprocessing and feature selection techniques, outperforms previous works and baseline models in DDoS attack classification.

Distributed Denial of Service Attack Detection in IoT Networks using Deep Learning and Feature Fusion: A Review

The explosive growth of Internet of Things (IoT) devices has led to escalating threats from distributed denial of service (DDoS) attacks. Moreover, the scale and heterogeneity of IoT environments pose unique security challenges, and intelligent solutions tailored for the IoT are needed to defend critical infrastructure. The deep learning technique shows great promise because automatic feature learning capabilities are well suited for the complex and high-dimensional data of IoT systems. Additionally, feature fusion approaches have gained traction in enhancing the performance of deep learning models by combining complementary feature sets extracted from multiple data sources. This paper aims to provide a comprehensive literature review focused specifically on deep learning techniques and feature fusion for DDoS attack detection in IoT networks. Studies employing diverse deep learning models and feature fusion techniques are analysed, highlighting key trends and developments in this crucial domain. This review provides several significant contributions, including an overview of various types of DDoS attacks, a comparison of existing surveys, and a thorough examination of recent applications of deep learning and feature fusion for detecting DDoS attacks in IoT networks. Importantly, it highlights the current challenges and limitations of these deep learning techniques based on the literature surveyed. This review concludes by suggesting promising areas for further research to enhance deep learning security solutions, which are specifically tailored to safeguarding the fast-growing IoT infrastructure against DDoS attacks.

A comprehensive survey on DDoS attacks detection & mitigation in SDN-IoT network

The Internet of Things (IoT) has transformed our lives by introducing new services and enhancing productivity. However, the widespread adoption of IoT devices and communication units has posed challenges in network management. In response, there is a growing necessity to rethink and redesign IoT network control. Software-defined networking (SDN) has emerged as a promising solution, leveraging its programmability and centralized management capabilities. SDN can simplify network management, offer network abstraction, facilitate development, and efficiently handle the complexities of IoT networks. Despite these advantages, security concerns, particularly the threat of Distributed Denial of Service (DDoS) attacks, persist in the IoT landscape. This survey focuses on exploring the collaboration between SDN and IoT. It investigates various types of DDoS attacks and highlights different types of defense, detection, and mitigation methods employed to address DDoS threats in SDN-based IoT (SDN-IoT) networks.

Overview of Distributed Denial of Service (DDoS) attack types and mitigation methods

In the evolving landscape of cyber threats, Distributed Denial of Service (DDoS) attacks pose a significant challenge to internet security. This research provides a comprehensive overview of various DDoS attack types and explores the efficacy of current mitigation strategies and categorizes DDoS attacks based on their methods and targets, highlighting their unique characteristics and impacts. The study delves into a range of mitigation methods, from traditional network-based approaches to recent advancements in artificial intelligence, assessing their strengths and limitations. Key findings indicate a dynamic interplay between the evolving complexity of DDoS attacks and the advancement of mitigation techniques. The research identifies gaps in current strategies and suggests areas for further development, emphasizing the need for adaptive, multi-layered defense mechanisms. This scientific article aims to provide cybersecurity professionals with a nuanced understanding of DDoS threats and a critical evaluation of the mitigation methods, guiding effective strategies to combat these evolving cyber risks.

Exploring current solutions against DDoS attacks in SDN environment

Software Defined Networking (SDN) offers a novel approach to network management, with the potential to simplify administration and enhance security. However, as with any emerging technology, it comes with vulnerabilities that may impact its availability and functionality. A prevalent attack on SDN controllers is Distributed Denial of Service (DDoS), which, while not entirely preventable, can have its effects mitigated. This study explores the factors influencing the performance of industry solutions in defending SDN against DDoS attacks and evaluates their efficiency. It investigates various security challenges associated with DDoS attacks in both Information Technology (IT) and Operational Technology (OT) environments and contrasts the effects of distinct DDoS attack types on multiple levels of SDN communication, such as Northbound-Southbound and East-West. Lastly, the applicable solution’s effectiveness was assessed based on the controller’s hardware utilization and response time.

A MACHINE LEARNING BASED CLASSIFICATION AND PREDICTION TECHNIQUE FOR DDOS ATTACKS

Distributed network attacks are referred to, usually, as Distributed Denial of Service (DDoS) attacks. These attacks take advantage of specific limitations that apply to any arrangement asset, such as the framework of the authorized organization's site. In the existing research study, the author worked on an old KDD dataset. It is necessary to work with the latest dataset to identify the current state of DDoS attacks. This paper, used a machine learning approach for DDoS attack types classification and prediction. For this purpose, used Random Forest and XGBoost classication algorithms. To access the research proposed a complete framework for DDoS attacks prediction. For the proposed work, the UNWS-np-15 dataset was extracted from the GitHub repository and Python was used as a simulator. After applying the machine learning models, we generated a confusion matrix for identification of the model performance. In the first classification, the results showed that both Precision (PR) and Recall (RE) are 89% for the Random Forest algorithm. The average Accuracy (AC) of our proposed model is 89% which is superb and enough good. In the second classification, the results showed that both Precision (PR) and Recall (RE) are approximately 90% for the XGBoost algorithm. The average Accuracy (AC) of our suggested model is 90%. By comparing our work to the existing research works, the accuracy of the defect determination was significantly improved which is approximately 85% and 79%, respectively.

MRFM: A timely detection method for DDoS attacks in IoT with multidimensional reconstruction and function mapping

To address the slow response time of existing detection modules to the Internet of Things (IoT) Distributed Denial of Service (DDoS) attacks, along with their low feature differentiation and poor detection performance, we propose MRFM, a timely detection method with multidimensional reconstruction and function mapping. Firstly, we employ a queue mechanism to capture and store incoming network traffic data within a predefined time frame. Subsequently, we introduce a multidimensional reconstruction neural network model, specifically designed to reconstruct quantitative features based on their respective indices by adjusting the loss function. This process is followed by the computation of multidimensional reconstruction errors and the transformation of vectors into mapping features, thereby augmenting the disparities among various types of traffic data and promoting the similarity within the same category of traffic data. Lastly, we extract frequency information from the qualitative feature matrix using information entropy calculations, enriching the feature profile of individual traffic instances. The experimental results on two benchmark datasets show that MRFM can effectively detect different types of DDoS attacks. Notably, MRFM consistently outperforms other existing methods, exhibiting an average metric improvement of up to 9.61 %.

DDoS family: A novel perspective for massive types of DDoS attacks

Distributed Denial of Service (DDoS) defense is a profound research problem. In recent years, adversaries tend to complicate their attack strategies by crafting vast DDoS variants. On the one hand, this trend exacerbates both extremes of classification granularity (i.e., binary and attack level) in existing machine learning methods. On the other hand, massive attack categories make the filter rule table bulky, as well as cause problems of slow reaction presented in the recent state-of-the-art DDoS mitigation system. Therefore, we propose the concept of a DDoS family to reconcile/cope with these issues. The specific technical roadmap includes traffic pattern characterization, attack fingerprint production, and cross-executed family partition by community detection. Through extensive evaluations, we demonstrate the benefits of the proposal in terms of portraying similarities, guiding model classification/unknown attack detection, optimizing defense strategies, and speeding filtering reactions. For instance, our results show that using only one rule can defend 15 types of attacks due to their homogeneous behavioral representation. Particularly, we find the interesting observation that counting the backward packet is more efficient and robust against some attacks (e.g., Tor's Hammer Attack), which is very different from previous solutions.

AF-FDS: An Accurate, Fast, and Fine-Grained Detection Scheme for DDoS Attacks in High-Speed Networks With Asymmetric Routing

Distributed Denial of Service (DDoS) attacks have posed severe threats to the Internet. Although researchers have proposed many DDoS detection schemes, there are still some challenging issues. Traditional per-flow-based DDoS methods are impractical for massive amounts of high-speed network traffic due to the huge resource consumption. In addition, existing methods are not designed to take into account the widespread asymmetric routing in high-speed networks, resulting in false positives when these methods are deployed on the Internet. Furthermore, existing methods can not achieve a good trade-off between detection accuracy and granularity when detecting hybrid DDoS attacks. This paper proposes an Accurate, Fast, and Fine-grained Detection Scheme (AF-FDS) for DDoS attacks in high-speed networks with asymmetric routing. We select features based on the characteristics of DDoS attacks and design a data structure Double Composite Structure Sketch (DCSS). DCSS can achieve fast recording and extraction of the selected features from the sampled traffic. Experimental results using real-world traces in a 10Gbps network with asymmetric routing show that AF-FDS can detect nine types of DDoS attacks at a fine-grained level within 15 seconds with over 98.0% precision and recall, even at a sampling rate of 1/1024. Furthermore, the comparison with several state-of-the-art methods illustrates that AF-FDS can detect DDoS attacks with a lower false positive rate (FPR) and shorter alarm time in asymmetric routing scenarios.

SCD: A Detection System for DDoS Attacks based on SAE-CNN Networks

The pervasive application of network technology has given rise to a numerous of network attacks, including Distributed Denial of Service (DDoS) attacks. DDoS attacks can lead to the collapse of network resources, making the target server unable to support legitimate users, which is a critical issue in cyberspace security. In complex real-world network environments, differentiating DDoS attack traffic from normal traffic is a challenging task, making it significant to effectively distinguish between attack types in order to resist DDoS attacks. However, traditional DDoS attack detection methods have certain limitations in terms of data preprocessing and detection efficiency. In this paper, we propose a lightweight framework based on deep learning called SAE-CNN-Detection (SCD), which combines stacked autoencoder network (SAE) and convolutional neural network (CNN) for DDoS attacks detection. The CIC-DDoS2019 dataset is used to simulate network traffic that has suffered from DDoS attacks, and this system employs adaptive preprocessing techniques for the dataset. The results demonstrate that multi-classification experiment achieves an accuracy of 97.2% for DDoS attack types, while the binary classification experiment achieves an accuracy of 99.1%.

A Review on Distributed Denial of Service Attack

Today’s world, technology has become an inevitable part of human life. In fact, during the Covid-19 pandemic, everything from the corporate world to educational institutions has shifted from offline to online. It leads to exponential increase in intrusions and attacks over the internet-based technologies. Distributed denial of service (DDOS) attack is one of the most dangerous attack that could cause devastating effects on the internet. These attacks are becoming more complex and expected to expand in number day after day, rendering detecting and combating these threats challenging. In network security this attack is very dangerous. The main aim of DDOS attack is to collapse the network or server with abnormal traffic to make server unavailable for the legitimate users. In this paper reviews various type of DDOS attacks, Symptoms of DDOS attack, role of botnet on DDOS attack and give some mitigation and prevention technique for DDOS attack.

DDoS Attacks Detection with Half Autoencoder-Stacked Deep Neural Network

With the growth in services supplied over the internet, network infrastructure has become more exposed to cyber-attacks, particularly Distributed Denial of Service (DDoS) attacks, which can easily cause the disruption of services. The key factor for fighting against these attacks is the earlier separation and detection of the traffic in networks. In this paper, a novel approach, named Half Autoencoder-Stacked DNNs (HAE-SDNN) model, is proposed. We suggest using a Stacked Deep Neural Networks (SDNN) model. as a deep learning model, in order to detect DDoS attacks. Our approach allows feature selection from a preprocessed dataset using a Half AutoEncoder (HAE), resulting in a final set of important features. These features are subsequently used to train the DNNs that are stacked together by applying Softmax layer to combine their outputs. Experiments were performed on a benchmark cybersecurity dataset, named CICDDoS2017, containing various DDoS attack types. The experimental results demonstrate that the introduced model attained an overall accuracy rate of 99.95%. Moreover, the HAE-SDNN model outperformed existing models, highlighting its superiority in accurately classifying attacks.

ERPCA-GFCM: An Enhanced DDoS Detection Model on Internet of Things

This research paper introduced an Enhanced Distributed Denial-of-Service (DDoS) Detection model specifically designed for IoT devices. Given the prevalence of DDoS attacks targeting IoT devices, which involve overwhelming a system with malicious traffic to disrupt its normal functioning, the proposed model aimed to enhance the security and resilience of IoT networks. To address this, the proposed model integrated multiple techniques to improve detection and classification accuracy. The first technique, ER-Relief algorithm, is a feature selection method made to address the presence of noise and outliers in the dataset by minimizing a loss function based on the empirical sum of margins. To further enhance the model's performance, Principal Component Analysis (PCA) was utilized for dimensionality reduction. PCA transforms the original high-dimensional feature space into a lower-dimensional space while preserving the most critical information. To achieve better clustering results, the model incorporates the Global Fuzzy C-means algorithm. This algorithm addressed the issue of sensitivity to initial conditions, which lead to suboptimal clustering results. By incorporating fuzzy logic principles, Global Fuzzy C-means assigning data points to multiple clusters with varying degrees of membership, providing a more nuanced representation of the underlying data structure. Lastly, the Random Forest algorithm was employed for training and testing the model. The model was then tested on the CICDDoS2019 dataset, which contains three (3) types of DDoS attacks, namely DNS, UDP, and MSSQL attacks. Based on the evaluation results, the proposed model achieved an impressive accuracy of 97.92%, recall of 97.92%, F1-score of 97.90%, and precision of 97.93%. These metrics highlighted the model's effectiveness, showcasing its ability to accurately detect and classify various types of DDoS attacks with high precision and recall. This research contributes to the advancement of network security by providing a robust and reliable solution for combating DDoS attacks.