Types Of Denial Of Service Attacks Research Articles

DDoS Attack Detection in Edge-IIoT Network Using Ensemble Learning

Abstract As the number of IoT devices increases daily due to the rapid growth in technology, every device and network is vulnerable to attacks because it is exposed to the internet. Denial of Service (DoS) is a prevalent type of intrusion on the Internet of Things (IoT) network in which the server becomes down due to flooding requests. Distributed Denial of Service (DDoS) is a special type of DoS attack where the network of malicious computers called botnet consumes the target’s system resources by flooding the requests. Edge computing is closely related to Industrial Internet of Things (IIoT), and industry 4.0. Both of them are relatively emerging technologies so security is a crucial part of them. By incorporating our contributions to the current and innovative dataset Edge-IIoT, the proposed study presents a novel approach to detect DDoS attacks in an IIoT network in the domain of edge computing, whether the traffic is normal or malicious (DDoS traffic). This study explores various Ensemble Learning (EL) techniques to predict normal and malicious DDoS traffic along with the type of DDoS attack. The study applies various preprocessing techniques like Synthetic Minority Over Sampling Technique (SMOTE), label encoding, etc. to enhance the model’s performance and reveals how EL techniques performs better in terms of accuracy than the individual classifiers. Further, the performance of all EL techniques has been investigated in terms of all evaluation measures, including the elapsed time. This important addition not only broadens the focus of study in this area but also offers insightful comparisons of the efficiency and precision of various ensemble approaches as well as individual classifiers. The study achieved a maximum of 99.99% in all evaluation measures.

DDoS Detection in Software-Defined Network (SDN) Using Machine Learning

In recent years, the concept of cloud computing and the software-defined network (SDN) have spread widely. The services provided by many sectors such as medicine, education, banking, and transportation are being replaced gradually with cloud-based applications. Consequently, the availability of these services is critical. However, the cloud infrastructure and services are vulnerable to attackers who aim to breach its availability. One of the major threats to any system availability is a Denial-of-Service (DoS) attack, which is intended to deny the legitimate user from accessing cloud resources. The Distributed Denial-of-Service attack (DDoS) is a type of DoS attack which is considerably more effective and dangerous. A lot of efforts have been made by the research community to detect DDoS attacks, however, there is still a need for further efforts in this germane field. In this paper, machine learning techniques are utilized to build a model that can detect DDoS attacks in Software-Defined Networks (SDN). The used ML algorithms have shown high performance in the earliest studies; hence they have been used in this study along with feature selection technique. Therefore, our model utilized these algorithms to detect DDoS attacks in network traffic. The outcome of this experiment shows the impact of feature selection in improving the model performance. Eventually, The Random Forest classifier has achieved the highest accuracy of 0.99 in detecting DDoS attack.

An Efficient DDoS Attack Detection Using Chaos Henry Gas Solubility Optimization Weight Initialization Based Rectified Linear Unit

The Denial of Service (DoS) attacks is one of the main issues faced by cloud service providers due to their intricate nature. The main aim of this attack is to disrupt the services of authorized users by forwarding massive malicious requests to the victim system. Even though the modern Artificial Intelligence-powered intrusion detection system offers improved benefits, it suffers from analyzing the traces of intrusion in the massive network flow. This article presents a novel Chaos-based Henry Gas Solubility Optimization—Weight initialization based-rectified linear Unit (HGSO-WIB-ReLU) framework to identify different types of DoS attacks like HTTP flood attacks, DNS flood attacks, and ICMP flood attacks. The main aim of this technique is to identify the low rate of DoS attacks which the state-of-art techniques often based on statistical analysis and machine learning are incapable of accomplishing. Convolutional neural network architecture incorporates the WIB-ReLU activation function primarily to prevent vanishing gradient issues and provide efficient training. The WIB-ReLU framework’s hyperparameters are primarily improved using the HGSO method by increasing the classifier’s accuracy rate for detecting DoS attacks. In this way, the proposed model minimized the high false positive rate in identifying low-rate DoS attacks in large datasets. Different benchmark datasets such as BUET- DDoS2020, CIC DoS Attacks, and Low Rate DDoS are used to conduct the experiments and the efficiency of the model is verified in terms of accuracy, F1-measure, and precision score. When evaluated using the BUET-DDoS, CIC-DoS, and Low rate DDoS datasets, the proposed model offers an accuracy of 97%, 96.67%, and 96%, respectively. The experimental analysis conducted demonstrates the effectiveness of the proposed HGSO-WIB-ReLU framework when compared to the different state-of-art methodologies.

An intrusion detection method to detect denial of service attacks using error-correcting output codes and adaptive neuro-fuzzy inference

ContextA wide range of network technologies and equipment used in network infrastructure are vulnerable to Denial of Service (DoS) attacks. Therefore, the identification of these attacks is of particular importance in security systems. ProblemMost of the previously presented solutions use a single machine learning model to detect DoS attacks; but it seems that improving the detection accuracy and reliability in the intrusion detection system will be possible by using the combination of learning models. ObjectivesThis research, is an effort to improve the accuracy of DoS attacks detection, compared to previous methods. Also, overcoming the challenge of large number of classes in intrusion detection task using ECOC based hybrid classifiers is one of the main objectives of the research. MethodsIn this paper, a novel method to detect DoS attacks in computer networks is proposed. The proposed method performs the intrusion detection process in three phases named as pre-processing, feature extraction and classification. Principal Component Analysis (PCA) is used for extracting features, while a combination of Error Correcting Output Codes (ECOC) and Adaptive Neuro-Fuzzy Inference System (ANFIS) is used for classification. In this classification model, Particle Swarm Optimization (PSO) algorithm has been used to optimize the structure of ANFIS. ResultsThe performance of the proposed method has been evaluated using the NSLKDD database. Using a 10-fold cross validation experiment, the proposed IDS showed a sensitivity of 99.82%. The results also show that the proposed method can detect the types of DoS attacks with an average accuracy of 98.9%, which shows a significant improvement compared to the previous methods.

Intrusion Detection in Novel WSN-Leach Dos Attack Dataset using Machine Learning based Boosting Algorithms

Security poses a substantial challenge in the context of wireless sensor networks (WSNs). WSNs, which are frequently employed for real-time monitoring in various Internet of Things (IoT)-based applications, are particularly vulnerable to a range of Denial of Service (DoS) attacks. These attacks represent a significant security concern and are among the most prevalent issues confronting WSNs today.In our research, we have introduced a WSN DoS dataset using the Matrix Laboratory (MATLAB) tool. This dataset was developed through the utilization of the Leach Protocol and incorporates various types of DoS attacks, including Wormhole, Blackhole, Grayhole, Flooding, and Time Division Multiple Access (TDMA) attacks. In our study, we assessed the performance of several machine learning techniques using our dataset. We employed various performance evaluation metrics that gauge both the classification accuracy and the complexity of these machine learning models. These metrics included parameters such as the number of accurately classified and misclassified instances, along with the time required for constructing the model. This comprehensive evaluation aimed to demonstrate the effectiveness of our proposed approach.The results of our analysis revealed that the Light Gradient Boosting Machine (LightGBM), Extreme Gradient Boosting (XGBoost), and Bagging algorithms exhibited strong performance on our dataset. They achieved impressive accuracy levels of up to 99.16%, 99.16%, and 99.8%, respectively, when using 14 features. Additionally, these algorithms achieved accuracy rates of 99.16%, 98.75%, and 99.8%, respectively, with 5 features, and 95.41%, 95%, and 93.75%, respectively, when considering only 3 features such as node ID and Energy-Consumed, Attack_type. Notably, LightGBM outperformed the others in terms of speed, as it employs a leaf-wise growth strategy, consumes less memory, and requires less time for model construction. Consequently, LightGBM emerged as the most efficient choice for our WSN DoS dataset.

Comparative Analysis of Several Anomaly Detection Algorithm with its Impact Towards the Security and its Performance

Anomaly detection in network traffic is a promising and effective technique to enhance network security. In addition to traditional statistical analysis and rule-based detection techniques, machine learning models are introduced for intelligent detection of abnormal traffic data. A Denial of Service (DoS) attack is a malicious effort to keep endorsed users of a website or web service from accessing it, or limiting their ability to do so. A Distributed Denial of Service (DDoS) attack is a type of DoS attack in which many computers are used to cripple a web page, website or web based service. Fault either in users’ implementation of a network or in the standard specification of protocols has resulted in gaps that allow various kinds of network attack to be launched of the type of network attacks, denial-of-service flood attacks have reason the most severe impact. This analysis study on flood attacks and Flash Crowd their improvement, classifying such attacks as either high-rate flood or low-rate flood. Finally, the attacks are appraised against principle related to their characteristics, technique and collision. This paper discusses a statistical approach to analysis the distribution of network traffic to recognize the normal network traffic behavior. This paper also discusses a various method to recognize anomalies in network traffic.

Evaluation of DoS attacks on Commercial Wi-Fi-Based UAVs

One of the biggest challenges for the use of Unmanned Aerial Vehicles (UAVs) in large-scale real-world applications is security. However, most of research projects related to robotics does not discuss security issues, moving on directly to studying classical problems (i.e., perception, control, planning). This paper evaluates the effects of availability issues (Denial of Service attacks) in two commonly used commercially available UAVs (AR.Drone 2.0 and 3DR SOLO). Denial of Service (DoS) attacks are made while the vehicles are navigating, simulating common conditions found both by the general public and in a research scenario. Experiments show how effective such attacks are and demonstrate actual security breaches that create specific vulnerabilities. The results indicate that both studied UAVs are susceptible to several types of DoS attacks which can critically influence the performance of UAVs during navigation, including a decrease in camera functionality, drops in telemetry feedback and lack of response to remote control commands. We also present a tool that can be used as a failsafe mechanism to alert the user when a drone is reaching out a determined flight limit range, avoiding availability issues.

Denial-of-Service Attacks Pre-Emptive and Detection Framework for Synchrophasor Based Wide Area Protection Applications

Synchrophasor technology has been very effective in addressing complex protection problems. Based on the experimental study of the impact of denial-of-service (DoS) cyberattacks on synchrophasor-assisted protection scheme, “adaptive dependability/security bias protection scheme,” a DoS pre-emptive and detection framework is presented in this article. The suggested structure helps in the identification of different types of DoS attacks (targeting data availability) and address resolution protocol (ARP) spoofing (compromising data confidentiality) via unique fingerprints developed using Wireshark network data. Redundant PDC datastream and random data path selector module (RDPS) in the framework help reduce the probability of a successful DoS attack. However, during a successful attack, the framework ensures that a healthy PDC datastream is used by the end application. The proposed methodology's efficacy has been verified using a western system coordinating council 9 bus, and IEEE 39 bus test systems on the real-time digital simulator (RTDS) based cyberphysical wide area measurement system testbed with industrial standard hardware phasor measurement units (PMUs). The results show that the proposed framework can effectively improve the performance of the synchrophasor-based adaptive dependability/security bias scheme during DoS attacks and avoid maloperation of the protective devices, which enhances the power system's stability.

A Deep Learning-Based Intrusion Detection and Preventation System for Detecting and Preventing Denial-of-Service Attacks

This document classifies, selects and trains a deep learning algorithm to create an IDS/IPS (Intrusion Prevention/Detection System) called Dique, which can detect and prevent denial of service (DoS) attacks. To mitigate DoS attacks, the IDS/IPS system, using the proposed deep learning model, classifies incoming packets to the web server into two classes: benign (which are normal traffic packets) and malicious (which the system considers to contain possible DoS attacks). Dique has a Graphical User Interface (GUI) where "in real time" you can display graphically and textually the information of captured and classified packets, and allows you to switch between the IDS mode and the IPS mode of the system operation. The proposed DoS attack classification model uses a multi-layered Deep Feed Forward neural network, the CICDDoS2019 Dataset was used for training and an accuracy of 0.994 was achieved. In addition, an offensive system called Diluvio was developed to verify the functioning of the Dique system. In Diluvio seven different types of DoS attacks were implemented (five contents in the training Datset and two that are not in said dataset) that users can selectively launch against a web server.

Observer-based event-triggered control for linear MASs under a directed graph and DoS attacks

In this paper, we investigate the observer-based event-triggered consensus problem for linear multi-agent systems (MASs) under a directed graph and denial-of-service (DoS) attacks. A type of DoS attacks launched by malicious attackers at irregular intervals is considered, which can cause communication channel disruption. A novel event-triggered secure control scheme based on a closed-loop observer is proposed to determine the scheduling of the controller update, and a separation method with less conservativeness is employed to design the controller and observer gains. Then, the frequency and duration of DoS attacks that can be tolerated are analysed for the observer-based secure consensus problem. In addition, a strictly positive minimal event-triggered time interval for each agent is designed with the help of the proposed event-triggered condition to eliminate the Zeno behaviour. Finally, a numerical simulation is given to verify the theoretical analysis.

Physical cyber-security algorithm for wireless sensor networks

Today, the wireless sensor network (WSN) plays an important role in our daily life. In addition, it is used in many applications such as military, medical, greenhouse, and transport. Due to the sending data between its nodes or to the base station requires a connection link, the sensor nodes can be exposed to the many attacks that exploit the weaknesses of the network. One of the most important types of these attacks is the denial of service (DoS). DoS attack exhausts the system's resources that lead the system to be out of service. In this paper, a cyber-security algorithm is proposed for physical level of WSN that adopts message queuing telemetry transport (MQTT) protocol for data transmission and networking. This algorithm predicts the DoS attacks at the first time of happening to be isolated from the WSN. It includes three stages of detecting the attack, predicting the effects of this attack and preventing the attacks by excluding the predicted nodes from the WSN. We applied a type of DoS attack that is a DoS injection attack (DoSIA) on the network protocol. The proposed algorithm is tested by adopting three case studies to cover the most common cases of attacks. The experiment results show the superior of the proposed algorithm in detecting and solving the cyber-attacks.

Deep Learning and Entity Embedding-Based Intrusion Detection Model for Wireless Sensor Networks

Wireless sensor networks (WSNs) are considered promising for applications such as military surveillance and healthcare. The security of these networks must be ensured in order to have reliable applications. Securing such networks requires more attention, as they typically implement no dedicated security appliance. In addition, the sensors have limited computing resources and power and storage, which makes WSNs vulnerable to various attacks, especially denial of service (DoS). The main types of DoS attacks against WSNs are blackhole, grayhole, flooding, and scheduling. There are two primary techniques to build an intrusion detection system (IDS): signature-based and data-driven-based. This study uses the data-driven approach since the signature-based method fails to detect a zero-day attack. Several publications have proposed data-driven approaches to protect WSNs against such attacks. These approaches are based on either the traditional machine learning (ML) method or a deep learning model. The fundamental limitations of these methods include the use of raw features to build an intrusion detection model, which can result in low detection accuracy. This study implements entity embedding to transform the raw features to a more robust representation that can enable more precise detection and demonstrates how the proposed method can outperform state-of-the-art solutions in terms of recognition accuracy.

Observer-Based Fixed-Time Secure Tracking Consensus for Networked High-Order Multiagent Systems Against DoS Attacks.

This article studies the secure tracking consensus problem of nonlinear multiagent systems (MASs) against denial-of-service (DoS) attacks. Two types of DoS attacks, i.e., connectivity-maintained attacks and connectivity-broken attacks, are considered. The resulting topologies caused by DoS attacks may destabilize the consensus performance of MASs. Especially under connectivity-broken attacks, the connectivity between agents is destroyed. To deal with these difficulties, a novel defense strategy consisting of distributed observation and decentralized control is proposed. First, a distributed fixed-time observer (DFTO) is prepared for the case of connectivity-maintained attacks, which can quickly and accurately estimate the leader's information for each follower. Besides, the adverse impact of DoS attacks is completely eliminated. Furthermore, to cope with the problem arising from connectivity-broken attacks, by using an online algorithm of updating label information, an improved resilient DFTO (RDFTO) is further developed, which can preserve those followers having directed paths from the leader to quickly and accurately estimate the leader's information, without being affected by DoS attacks. The developed DFTO and RDFTO have successfully eliminated or weakened the adverse effects caused by DoS attacks. Subsequently, based on the proposed DFTO/RDFTO with the power integrator technique, a fixed-time controller is finally constructed, which realizes the desired transient performance of consensus tracking in the finite-time interval. The effectiveness of the proposed defense strategy is verified by stability analysis and simulation examples.

On hardware-trojan-assisted power budgeting system attack targeting many core systems

Abstract In a modern many-core chip, as all the cores are constantly competing for their shares of power out of the maximum power available to the chip, a sound power budgeting scheme is needed to efficiently allocate power to achieve the highest possible overall system performance. When a core is poised to run some applications, it has to request its power budget by sending a series of data packets, routed typically through an on-chip communication network infrastructure, to a specific core designated as the global manager that makes its power allocation decision based on all the budget requests it receives and its assessment of each core’s potential contribution to the overall system performance. This power budgeting scheme is shown, in this paper, to be highly vulnerable to stealthy false-data attacks, which can cause catastrophic denial of service (DoS) effects. Essentially, when a power budget request packet is routed through a Trojan-infected network-on-chip node, such as a router, the power budget request can be secretly modified by the Trojan. The global manager then tends to make really bad power budget allocation decisions with all the tampered power requests it received. That is, legitimate applications will be victimized with lower power budgets than what they initially asked for, and thus, could suffer serious performance degradation; malicious applications, on the other hand, may be entitled to high power budgets and thus see performance boost that they do not deserve. Our study has revealed that this new type of DoS attack can be initiated and sustained by a simple hardware Trojan (HT) circuit that is extremely hard to be detected due to its low silicon footprint and short activation time. The effects of this new DoS attack are simulated following a network model, and all the major parameters and factors that impact the attack effects are identified and quantified. The HTs are intelligently turned ON/OFF following a scheme based on Q-learning, we further demonstrate that the attacks can undermine the best countermeasures against power budgeting system attack as suggested in this paper, which gives rise to a need for further research in this regard.

Assessment of deterministic delay bounds for a DoS-attack prevention device with a static window flow control

This article focuses on the justification of the timing characteristics of devices using a static window flow control mechanism for protection against denial of service (DoS) attacks. The main focus is on a particular type of DoS attack, like flood and hit-and-run attacks. An attack of that kind can be performed using the black-box approach with a minimal piece of knowledge about the internals of the attacked system. The methods of tropical algebra (min-plus algebra) are used to compute the timing characteristics of the device with static window flow control.

Detecting DoS Attacks Based on Multi-Features in SDN

Denial of Service (DoS) attack is a serious threat to Software Defined Network (SDN). Although many research efforts have been devoted to identify new features for DoS attack detection, the existing approaches are not able to detect various types of DoS attacks. In SDN, DoS attacks against data plane are mainly organized in two ways: 1) DoS attack with multiple flow entries (M-DoS) to exhaust the Ternary Content-Addressable Memory (TCAM) resource of the switch. 2) DoS attack with a single well-designed entry (S-DoS) to overwhelm the target link and further impact the controller. To detect these two attacks, we propose a new approach by extracting six features of flow table, and using the back propagation (BP) neural network to construct the classifier. Test results of test-bed experiments indicate that the accurate detection probability of proposed approach is 98.9%, which can effectively distinguish M-DoS flows and S-DoS flows without being affected by Flash crowd scene.

Normal and Malicious Sliding Windows Similarity Analysis Method for Fast and Accurate IDS Against DoS Attacks on In-Vehicle Networks

Controller Area Network (CAN) is a de facto standard of in-vehicle networks. Since CAN employs broadcast communication and a slower network than other general networks (e.g. Ethernet, IEEE802.11), it is inherently vulnerable to Denial-of-Service (DoS) attacks. As a countermeasure against DoS attacks on CAN, a method for detecting a DoS attack using the entropy in a sliding window has been proposed. This method has a good advantage in terms of effectiveness and the small computational overhead. However, this method may only be effective against DoS attacks under naive conditions such as some higher priority messages. In addition, if an adversary can adjust the entropy of the DoS attack to its normal value, the conventional method cannot detect a DoS attack in which the adversary manipulates the entropy. We found this type of DoS attack, which is called an entropy-manipulated attack. In this paper, we propose a method that can detect an entropy-manipulated attack by using the similarity of two sliding windows. We confirmed that the proposed method detected the DoS attack in 100% of the cases in our experiment, and we showed that the detection time is up to 93% (14 μs) shorter than the conventional method.

A Bayesian game model and network availability model for small cells under denial of service (DoS) attack in 5G wireless communication network

Nowadays small cells have become the integral part of 5G wireless communication network (WCN). However, the incorporation of small cells in 5G WCN creates chances for attackers to intrude into the network and this makes the network highly susceptible to attacks. Among various possible attacks, denial of service (DoS) attack is one of the most common network security attacks, and hence in this paper we consider a bandwidth spoofing attack which is a type of DoS attack that is carried out by an attacker during the communication between a macro base station and a small cell base station in a 5G WCN. We then propose a Bayesian game model to capture the interactions between the attacker and the network defender under the bandwidth spoofing attack and obtain the best strategies for defending the DoS attack. Further, since the DoS attack entails unavailability of the network, we address this issue by developing an availability model of the 5G WCN based on a stochastic reward net. Numerical results are presented which give insights into how the availability is affected by the DoS attack. The proposed model is also validated via simulation.

Evaluation of DoS attacks on Commercial Wi-Fi-Based UAVs

One of the biggest challenges for the use of Unmanned Aerial Vehicles (UAVs) in large-scale real-world applications is security. However, most of research projects related to robotics does not discuss security issues, moving on directly to studying classical problems (i.e., perception, control, planning). This paper evaluates the effects of availability issues (Denial of Service attacks) in two commonly used commercially available UAVs (AR.Drone 2.0 and 3DR SOLO). Denial of Service (DoS) attacks are made while the vehicles are navigating, simulating common conditions found both by the general public and in a research scenario. Experiments show how effective such attacks are and demonstrate actual security breaches that create specific vulnerabilities. The results indicate that both studied UAVs are susceptible to several types of DoS attacks which can critically influence the performance of UAVs during navigation, including a decrease in camera functionality, drops in telemetry feedback and lack of response to remote control commands. We also present a tool that can be used as a failsafe mechanism to alert the user when a drone is reaching out a determined flight limit range, avoiding availability issues.

An Efficient Scheme for Detection and Prevention of Black Hole Attacks in AODV-Based MANETs

Mobile ad hoc network (MANET) is a set of independent mobile nodes, which connect to each other over a wireless channel without any centralized infrastructure, nor integrated security. MANET is a weak target to many Denial of Service (DOS) attacks, which seriously harms its functionality and connectivity. A black hole attack is a type of DOS attack, where the malevolent node tries to get all the data packets from a source node by sending fabricated fake route reply (RREP) packet, falsely pretending that it possesses the shortest path towards the destination node, and then drops all the packets it receives. In this paper, the AODV (Ad-hoc on-demand distance vector) routing protocol is improved by incorporating an efficient and simple mechanism to mitigate black hole attacks. Mechanism to detect black hole attacks from MANET (MDBM) uses fake route request (RREQ) packets with an unreal destination address in order to detect black hole nodes prior to the actual routing process. Simulation experiment conducted has verified the performance of the proposed detection and prevention scheme. The results demonstrated that the proposed mechanism performed well in terms of Packet Delivery Ratio, End-to-End Delay and Throughput under black hole attack.