Types Of Distributed Denial Of Service Attacks Research Articles

A Robust DDoS Intrusion Detection System Using Convolutional Neural Network

In today’s digital age, the proliferation of network-connected devices has triggered a surge in cyberattacks. Distributed Denial-of-Service (DDoS) attacks pose a particularly formidable challenge to network security by disrupting access to vital services. While numerous researchers have proposed DDoS detection methods utilizing machine learning and deep learning techniques, developing a robust and reliable DDoS intrusion detection system remains challenging. This challenge is exacerbated by issues such as highly imbalanced data, multi-classification, and computational complexity. This paper proposes an innovative feature selection approach to create a robust intrusion detection system capable of detecting and classifying recent common DDoS attack types. We evaluate the performance of our model on the CICDDoS2019 benchmark dataset. Our experimental results demonstrate that our proposed model outperforms existing methods, achieving a detection accuracy of 96.82%, a recall of 96.82%, a precision of 96.76%, and an F1 score of 96.50%. Additionally, our model exhibits faster prediction times, with the ability to predict an attack in just 0.189 ms. Notably, our approach, combined with preprocessing and feature selection techniques, outperforms previous works and baseline models in DDoS attack classification.

Distributed Denial of Service Attack Detection in IoT Networks using Deep Learning and Feature Fusion: A Review

The explosive growth of Internet of Things (IoT) devices has led to escalating threats from distributed denial of service (DDoS) attacks. Moreover, the scale and heterogeneity of IoT environments pose unique security challenges, and intelligent solutions tailored for the IoT are needed to defend critical infrastructure. The deep learning technique shows great promise because automatic feature learning capabilities are well suited for the complex and high-dimensional data of IoT systems. Additionally, feature fusion approaches have gained traction in enhancing the performance of deep learning models by combining complementary feature sets extracted from multiple data sources. This paper aims to provide a comprehensive literature review focused specifically on deep learning techniques and feature fusion for DDoS attack detection in IoT networks. Studies employing diverse deep learning models and feature fusion techniques are analysed, highlighting key trends and developments in this crucial domain. This review provides several significant contributions, including an overview of various types of DDoS attacks, a comparison of existing surveys, and a thorough examination of recent applications of deep learning and feature fusion for detecting DDoS attacks in IoT networks. Importantly, it highlights the current challenges and limitations of these deep learning techniques based on the literature surveyed. This review concludes by suggesting promising areas for further research to enhance deep learning security solutions, which are specifically tailored to safeguarding the fast-growing IoT infrastructure against DDoS attacks.

A comprehensive survey on DDoS attacks detection & mitigation in SDN-IoT network

The Internet of Things (IoT) has transformed our lives by introducing new services and enhancing productivity. However, the widespread adoption of IoT devices and communication units has posed challenges in network management. In response, there is a growing necessity to rethink and redesign IoT network control. Software-defined networking (SDN) has emerged as a promising solution, leveraging its programmability and centralized management capabilities. SDN can simplify network management, offer network abstraction, facilitate development, and efficiently handle the complexities of IoT networks. Despite these advantages, security concerns, particularly the threat of Distributed Denial of Service (DDoS) attacks, persist in the IoT landscape. This survey focuses on exploring the collaboration between SDN and IoT. It investigates various types of DDoS attacks and highlights different types of defense, detection, and mitigation methods employed to address DDoS threats in SDN-based IoT (SDN-IoT) networks.

Overview of Distributed Denial of Service (DDoS) attack types and mitigation methods

In the evolving landscape of cyber threats, Distributed Denial of Service (DDoS) attacks pose a significant challenge to internet security. This research provides a comprehensive overview of various DDoS attack types and explores the efficacy of current mitigation strategies and categorizes DDoS attacks based on their methods and targets, highlighting their unique characteristics and impacts. The study delves into a range of mitigation methods, from traditional network-based approaches to recent advancements in artificial intelligence, assessing their strengths and limitations. Key findings indicate a dynamic interplay between the evolving complexity of DDoS attacks and the advancement of mitigation techniques. The research identifies gaps in current strategies and suggests areas for further development, emphasizing the need for adaptive, multi-layered defense mechanisms. This scientific article aims to provide cybersecurity professionals with a nuanced understanding of DDoS threats and a critical evaluation of the mitigation methods, guiding effective strategies to combat these evolving cyber risks.

MRFM: A timely detection method for DDoS attacks in IoT with multidimensional reconstruction and function mapping

To address the slow response time of existing detection modules to the Internet of Things (IoT) Distributed Denial of Service (DDoS) attacks, along with their low feature differentiation and poor detection performance, we propose MRFM, a timely detection method with multidimensional reconstruction and function mapping. Firstly, we employ a queue mechanism to capture and store incoming network traffic data within a predefined time frame. Subsequently, we introduce a multidimensional reconstruction neural network model, specifically designed to reconstruct quantitative features based on their respective indices by adjusting the loss function. This process is followed by the computation of multidimensional reconstruction errors and the transformation of vectors into mapping features, thereby augmenting the disparities among various types of traffic data and promoting the similarity within the same category of traffic data. Lastly, we extract frequency information from the qualitative feature matrix using information entropy calculations, enriching the feature profile of individual traffic instances. The experimental results on two benchmark datasets show that MRFM can effectively detect different types of DDoS attacks. Notably, MRFM consistently outperforms other existing methods, exhibiting an average metric improvement of up to 9.61 %.

DDoS family: A novel perspective for massive types of DDoS attacks

Distributed Denial of Service (DDoS) defense is a profound research problem. In recent years, adversaries tend to complicate their attack strategies by crafting vast DDoS variants. On the one hand, this trend exacerbates both extremes of classification granularity (i.e., binary and attack level) in existing machine learning methods. On the other hand, massive attack categories make the filter rule table bulky, as well as cause problems of slow reaction presented in the recent state-of-the-art DDoS mitigation system. Therefore, we propose the concept of a DDoS family to reconcile/cope with these issues. The specific technical roadmap includes traffic pattern characterization, attack fingerprint production, and cross-executed family partition by community detection. Through extensive evaluations, we demonstrate the benefits of the proposal in terms of portraying similarities, guiding model classification/unknown attack detection, optimizing defense strategies, and speeding filtering reactions. For instance, our results show that using only one rule can defend 15 types of attacks due to their homogeneous behavioral representation. Particularly, we find the interesting observation that counting the backward packet is more efficient and robust against some attacks (e.g., Tor's Hammer Attack), which is very different from previous solutions.

AF-FDS: An Accurate, Fast, and Fine-Grained Detection Scheme for DDoS Attacks in High-Speed Networks With Asymmetric Routing

Distributed Denial of Service (DDoS) attacks have posed severe threats to the Internet. Although researchers have proposed many DDoS detection schemes, there are still some challenging issues. Traditional per-flow-based DDoS methods are impractical for massive amounts of high-speed network traffic due to the huge resource consumption. In addition, existing methods are not designed to take into account the widespread asymmetric routing in high-speed networks, resulting in false positives when these methods are deployed on the Internet. Furthermore, existing methods can not achieve a good trade-off between detection accuracy and granularity when detecting hybrid DDoS attacks. This paper proposes an Accurate, Fast, and Fine-grained Detection Scheme (AF-FDS) for DDoS attacks in high-speed networks with asymmetric routing. We select features based on the characteristics of DDoS attacks and design a data structure Double Composite Structure Sketch (DCSS). DCSS can achieve fast recording and extraction of the selected features from the sampled traffic. Experimental results using real-world traces in a 10Gbps network with asymmetric routing show that AF-FDS can detect nine types of DDoS attacks at a fine-grained level within 15 seconds with over 98.0% precision and recall, even at a sampling rate of 1/1024. Furthermore, the comparison with several state-of-the-art methods illustrates that AF-FDS can detect DDoS attacks with a lower false positive rate (FPR) and shorter alarm time in asymmetric routing scenarios.

SCD: A Detection System for DDoS Attacks based on SAE-CNN Networks

The pervasive application of network technology has given rise to a numerous of network attacks, including Distributed Denial of Service (DDoS) attacks. DDoS attacks can lead to the collapse of network resources, making the target server unable to support legitimate users, which is a critical issue in cyberspace security. In complex real-world network environments, differentiating DDoS attack traffic from normal traffic is a challenging task, making it significant to effectively distinguish between attack types in order to resist DDoS attacks. However, traditional DDoS attack detection methods have certain limitations in terms of data preprocessing and detection efficiency. In this paper, we propose a lightweight framework based on deep learning called SAE-CNN-Detection (SCD), which combines stacked autoencoder network (SAE) and convolutional neural network (CNN) for DDoS attacks detection. The CIC-DDoS2019 dataset is used to simulate network traffic that has suffered from DDoS attacks, and this system employs adaptive preprocessing techniques for the dataset. The results demonstrate that multi-classification experiment achieves an accuracy of 97.2% for DDoS attack types, while the binary classification experiment achieves an accuracy of 99.1%.

A Review on Distributed Denial of Service Attack

Today’s world, technology has become an inevitable part of human life. In fact, during the Covid-19 pandemic, everything from the corporate world to educational institutions has shifted from offline to online. It leads to exponential increase in intrusions and attacks over the internet-based technologies. Distributed denial of service (DDOS) attack is one of the most dangerous attack that could cause devastating effects on the internet. These attacks are becoming more complex and expected to expand in number day after day, rendering detecting and combating these threats challenging. In network security this attack is very dangerous. The main aim of DDOS attack is to collapse the network or server with abnormal traffic to make server unavailable for the legitimate users. In this paper reviews various type of DDOS attacks, Symptoms of DDOS attack, role of botnet on DDOS attack and give some mitigation and prevention technique for DDOS attack.

DDoS Attacks Detection with Half Autoencoder-Stacked Deep Neural Network

With the growth in services supplied over the internet, network infrastructure has become more exposed to cyber-attacks, particularly Distributed Denial of Service (DDoS) attacks, which can easily cause the disruption of services. The key factor for fighting against these attacks is the earlier separation and detection of the traffic in networks. In this paper, a novel approach, named Half Autoencoder-Stacked DNNs (HAE-SDNN) model, is proposed. We suggest using a Stacked Deep Neural Networks (SDNN) model. as a deep learning model, in order to detect DDoS attacks. Our approach allows feature selection from a preprocessed dataset using a Half AutoEncoder (HAE), resulting in a final set of important features. These features are subsequently used to train the DNNs that are stacked together by applying Softmax layer to combine their outputs. Experiments were performed on a benchmark cybersecurity dataset, named CICDDoS2017, containing various DDoS attack types. The experimental results demonstrate that the introduced model attained an overall accuracy rate of 99.95%. Moreover, the HAE-SDNN model outperformed existing models, highlighting its superiority in accurately classifying attacks.

ERPCA-GFCM: An Enhanced DDoS Detection Model on Internet of Things

This research paper introduced an Enhanced Distributed Denial-of-Service (DDoS) Detection model specifically designed for IoT devices. Given the prevalence of DDoS attacks targeting IoT devices, which involve overwhelming a system with malicious traffic to disrupt its normal functioning, the proposed model aimed to enhance the security and resilience of IoT networks. To address this, the proposed model integrated multiple techniques to improve detection and classification accuracy. The first technique, ER-Relief algorithm, is a feature selection method made to address the presence of noise and outliers in the dataset by minimizing a loss function based on the empirical sum of margins. To further enhance the model's performance, Principal Component Analysis (PCA) was utilized for dimensionality reduction. PCA transforms the original high-dimensional feature space into a lower-dimensional space while preserving the most critical information. To achieve better clustering results, the model incorporates the Global Fuzzy C-means algorithm. This algorithm addressed the issue of sensitivity to initial conditions, which lead to suboptimal clustering results. By incorporating fuzzy logic principles, Global Fuzzy C-means assigning data points to multiple clusters with varying degrees of membership, providing a more nuanced representation of the underlying data structure. Lastly, the Random Forest algorithm was employed for training and testing the model. The model was then tested on the CICDDoS2019 dataset, which contains three (3) types of DDoS attacks, namely DNS, UDP, and MSSQL attacks. Based on the evaluation results, the proposed model achieved an impressive accuracy of 97.92%, recall of 97.92%, F1-score of 97.90%, and precision of 97.93%. These metrics highlighted the model's effectiveness, showcasing its ability to accurately detect and classify various types of DDoS attacks with high precision and recall. This research contributes to the advancement of network security by providing a robust and reliable solution for combating DDoS attacks.

A Comprehensive Architectural Framework of Moving Target Defenses Against DDoS Attacks

Distributed Denial-of-Service (DDoS) attacks are among the top toughest security threats in today’s cyberspace. The multitude, diversity, and variety of both the attacks and their countermeasures have the consequence that no optimal solutions exist. However, many mitigation techniques and strategies have been proposed among which is Moving Target Defense (MTD). MTD strategy keeps changing the system states and attack surface dynamically by continually applying various systems reconfigurations aiming at increasing the uncertainty and complexity for attackers. Current proposals of MTD fall into one of three strategies: shuffling, diversity, and redundancy, based on what to move? how to move? and when to move? Despite the existence of such strategies, a comprehensive Framework for MTD techniques against DDoS attacks that can be used for all types of DDoS attacks has not been proposed yet. In this paper, we propose a novel and comprehensive Framework of MTD techniques considering all stages, mechanisms, data sources, and criteria adopted by the research community, the Framework will apply to all DDoS attacks on different systems. To efficiently use our proposed model, a comprehensive taxonomy of MTD mitigation techniques and strategies is also provided and can be used as a reference guide for the best selection of the model’s parameters.

An Adversarial DBN-LSTM Method for Detecting and Defending against DDoS Attacks in SDN Environments

As an essential piece of infrastructure supporting cyberspace security technology verification, network weapons and equipment testing, attack defense confrontation drills, and network risk assessment, Cyber Range is exceptionally vulnerable to distributed denial of service (DDoS) attacks from three malicious parties. Moreover, some attackers try to fool the classification/prediction mechanism by crafting the input data to create adversarial attacks, which is hard to defend for ML-based Network Intrusion Detection Systems (NIDSs). This paper proposes an adversarial DBN-LSTM method for detecting and defending against DDoS attacks in SDN environments, which applies generative adversarial networks (GAN) as well as deep belief networks and long short-term memory (DBN-LSTM) to make the system less sensitive to adversarial attacks and faster feature extraction. We conducted the experiments using the public dataset CICDDoS 2019. The experimental results demonstrated that our method efficiently detected up-to-date common types of DDoS attacks compared to other approaches.

Explainable AI-Based DDOS Attack Identification Method for IoT Networks

The modern digitized world is mainly dependent on online services. The availability of online systems continues to be seriously challenged by distributed denial of service (DDoS) attacks. The challenge in mitigating attacks is not limited to identifying DDoS attacks when they happen, but also identifying the streams of attacks. However, existing attack detection methods cannot accurately and efficiently detect DDoS attacks. To this end, we propose an explainable artificial intelligence (XAI)-based novel method to identify DDoS attacks. This method detects abnormal behaviours of network traffic flows by analysing the traffic at the network layer. Moreover, it chooses the most influential features for each anomalous instance with influence weight and then sets a threshold value for each feature. Hence, this DDoS attack detection method defines security policies based on each feature threshold value for application-layer-based, volumetric-based, and transport control protocol (TCP) state-exhaustion-based features. Since the proposed method is based on layer three traffic, it can identify DDoS attacks on both Internet of Things (IoT) and traditional networks. Extensive experiments were performed on the University of Sannio, Benevento Instrution Detection System (USB-IDS) dataset, which consists of different types of DDoS attacks to test the performance of the proposed solution. The results of the comparison show that the proposed method provides greater detection accuracy and attack certainty than the state-of-the-art methods.

A Modified PointNet-Based DDoS Attack Classification and Segmentation in Blockchain

With the rapid development of blockchain technology, the number of distributed applications continues to increase, so ensuring the security of the network has become particularly important. However, due to its decentralized, decentralized nature, blockchain networks are vulnerable to distributed denial-of-service (DDoS) attacks, which can lead to service stops, causing serious economic losses and social impacts. The research questions in this paper mainly include two aspects: first, the classification of DDoS, which refers to detecting whether blockchain nodes are suffering DDoS attacks, that is, detecting the data of nodes in parallel; The second is the problem of DDoS segmentation, that is, multiple pieces of data that appear at the same time are determined which type of DDoS attack they belong to. In order to solve these problems, this paper proposes a modified PointNet (M-PointNet) for the classification and type segmentation of DDoS attacks. A dataset containing multiple DDoS attack types was constructed using the CIC-DDoS2019 dataset, and trained, validated, and tested accordingly. The results show that the proposed DDoS attack classification method has high performance and can be used for the actual blockchain security maintenance process. The accuracy rate of classification tasks reached 99.65%, and the accuracy of type segmentation tasks reached 85.47%. Therefore, the method proposed in this paper has high application value in detecting the classification and segmentation of DDoS attacks.

A Novel Framework for DDoS Attacks Detection Using Hybrid LSTM Techniques

The recent development of cloud computing offers various services on demand for organization and individual users, such as storage, shared computing space, networking, etc. Although Cloud Computing provides various advantages for users, it remains vulnerable to many types of attacks that attract cyber criminals. Distributed Denial of Service (DDoS) is the most common type of attack on cloud computing. Consequently, Cloud computing professionals and security experts have focused on the growth of preventive processes towards DDoS attacks. Since DDoS attacks have become increasingly widespread, it becomes difficult for some DDoS attack methods based on individual network flow features to distinguish various types of DDoS attacks. Further, the monitoring pattern of traffic changes and accurate detection of DDoS attacks are most important and urgent. In this research work, DDoS attack detection methods based on deep belief network feature extraction and Hybrid Long Short-Term Memory (LSTM) model have been proposed with NSL-KDD dataset. In Hybrid LSTM method, the Particle Swarm Optimization (PSO) technique, which is combined to optimize the weights of the LSTM neural network, reduces the prediction error. This deep belief network method is used to extract the features of IP packets, and it identifies DDoS attacks based on PSO-LSTM model. Moreover, it accurately predicts normal network traffic and detects anomalies resulting from DDoS attacks. The proposed PSO-LSTM architecture outperforms the classification techniques including standard Support Vector Machine (SVM) and LSTM in terms of attack detection performance along with the results of the measurement of accuracy, recall, f-measure, precision.

RAPT: A Robust Attack Path Tracing Algorithm to Mitigate SYN-Flood DDoS Cyberattacks

In the recent past, Distributed Denial of Service (DDoS) attacks have become more abundant and present one of the most serious security threats. In a DDoS attack, the attacker controls a botnet of daemons residing in vulnerable hosts that send a significant amount of traffic to flood the victim or the network infrastructure. In this paper, a common type of DDoS attacks known as "TCP SYN-Flood" is studied. This type of attack uses spoofed Internet Protocol (IP) addresses for SYN packets by exploiting the weakness in Transmission Control Protocol (TCP) 3-Way handshake used by the TCP/IP suite of protocols, which make the web servers unreachable for legitimate users or even worse, it might lead to server crash. In this paper, a resilient, efficient, lightweight, and robust IP traceback algorithm is proposed using an IP tracing packet for each attack path. The proposed algorithm suggests that edge routers-where the attack starts from-observe the traffic pattern passing through, and if the observed traffic carries the signature of TCP SYN-Flood DDoS attack and a high percentage of it is destined to a particular web server(s), it starts the tracing process by generating an IP trace packet, which accompanies the attack path recording the routers' IP addresses on the path between the attacker/daemon and the victim, which can extract the path and react properly upon receiving it by discarding any SYN packets originating from that attacker/daemon. To our knowledge, this is the first research that efficiently traces these kinds of attacks while they are running. The proposed solution has low computation and message overhead, efficient detection and tracing time, and converges in near optimal time. The results are validated using extensive simulation runs.

TIMELY DETECTION AND MITIGATION OF STEALTHY DDOS ATTACKS VIA IOT NETWORKS

Internet of Things (IoT) networks consist of sensors, actuators, mobile and wearable devices that can connect to the Internet. With billions of such devices already in the market which have significant vulnerabilities, there is a dangerous threat to the Internet services and also some cyber-physical systems that are also connected to the Internet. Specifically, due to their existing vulnerabilities IoT devices are susceptible to being compromised and being part of a new type of stealthy Distributed Denial of Service (DDoS) attack, called Mongolian DDoS, which is characterized by its widely distributed nature and small attack size from each source. This study proposes a novel anomaly-based Intrusion Detection System (IDS) that is capable of timely detecting and mitigating this emerging type of DDoS attacks. The proposed IDS's capability of detecting and mitigating stealthy DDoS attacks with even very low attack size per source is demonstrated through numerical and testbed experiments.

Trusted Multi-Domain DDoS Detection Based on Federated Learning.

Aiming at the problems of single detection target of existing distributed denial of service (DDoS) attacks, incomplete detection datasets and privacy caused by shared datasets, we propose a trusted multi-domain DDoS detection method based on federated learning. Firstly, we divide the types of DDoS attacks into different sub-attacks, design the federated learning dataset for DDoS detection in each domain, and use them to realize a more comprehensive detection method of DDoS attacks on the premise of protecting the data privacy of each domain. Secondly, in order to improve the robustness of federated learning and alleviate poisoning attack, we propose a reputation evaluation method based on blockchain, which estimates interaction reputation, data reputation and resource reputation of each participant comprehensively, so as to obtain the trusted federated learning participants and identify the malicious participants. In addition, we also propose a combination scheme of multi-domain detection and distributed knowledge base and design a feature graph of malicious behavior based on a knowledge graph to realize the memory of multi-domain feature knowledge. The experimental results show that the accuracy of most categories of the multi-domain DDoS detection method can reach more than 95% with the protection of datasets, and the reputation evaluation method proposed in this paper has a higher ability to identify malicious participants against the data poisoning attack when the threshold is set to 0.6.

A Cloud Based Machine Intelligent Framework to Identify DDoS Botnet Attack in Internet of Things

First few Botnet attack is a major issue in security of Internet of Things (IoT) devices and it needs to be identified to secure the system from the attackers. In this paper, a cloud-based machine intelligent framework is proposed to identify DDoS (distributed denial of service) Botnet attack in IoT systems. In this framework, the IoT devices communicating with the cloud are categorized based on their communication record to check the DDoS Botnet attack. In this work, three DDoS botnet attacks are considered such as HTTP, UDP, and TCP. The cloud is installed with a supervised machine intelligent model to classify the type of DDoS attack. The model is selected by considering 4 models such as Tree, stacking classifier, Neural Network (NN), and Support Vector Machine (SVM) and performance is evaluated based on classification accuracy (CA). Here, the stacking classifier is a hybrid model designed using the aggregation of Logistic Regression (LR), NN, and SVM. The performance is evaluated using Python tool. From the results it was found that except Tree all three models show an CA of 1.0. The computation time is also analyzed for four models and it was found that Tree shows less time than other models however, if considered with respect to CA (1.0) then SVM can be preferred as it shows lesser time then other two models. The detection time of the IoT devices is also simulated and result show that if SVM is installed in cloud then the detection time is lesser.