Search

In recent few years, flying ad hoc networks are utilized more for interconnectivity. In the topological scenario of FANETs, IoT nodes are available on ground where UAVs collect information. Due to high mobility patterns of UAVs cause disruption where intruders easily deploy cyberattacks like DoS/DDoS. Flying ad hoc networks use to have UAVs, satellite, and base station in the physical structure. IoT-based UAV networks are having many applications which include agriculture, rescue operations, tracking, and surveillance. However, DoS/DDoS attacks disturb the behaviour of entire FANET which lead to unbalance energy, end-to-end delay, and packet loss. This research study is focused about the detail study of machine learning-based IDS. Also, cognitive lightweight-LR approach is modeled using UNSW-NB 15 dataset. IoT-based UAV network is introduced using machine learning to detect possible security attacks. The queuing and data traffic model is utilized to implement DT, RF, XGBoost, AdaBoost, Bagging and logistic regression in the environment of IoT-based UAV network. Logistic regression is the proposed approach which is used to estimate statistical possibility. Overall, experimentation is based on binomial distribution. There exists linear association approach in logistic regression. In comparison with other techniques, logistic regression behaviour is lightweight and low cost. The simulation results presents logistic regression better results in contrast with other techniques. Also, high accuracy is balanced well in optimal way. [ABSTRACT FROM AUTHOR]

Today, botnets are the most common threat on the Internet and are used as the main attack vector against individuals and businesses. Cybercriminals have exploited botnets for many illegal activities, including click fraud, DDOS attacks, and spam production. In this article, we suggest a method for identifying the behavior of data traffic using machine learning classifiers including genetic algorithm to detect botnet activities. By categorizing behavior based on time slots, we investigate the viability of detecting botnet behavior without seeing a whole network data flow. We also evaluate the efficacy of two well-known classification methods with reference to this data. We demonstrate experimentally, using existing datasets, that it is possible to detect botnet activities with high precision. [ABSTRACT FROM AUTHOR]

Detecting the attacks in Vehicular Ad hoc Network (VANET) system is very important to provide more secure and reliable communication between all vehicles in the system. In this article, an effective Intelligent Intrusion Detection System (IDS) is proposed using machine learning and deep learning approaches such as Adaptive Neuro Fuzzy Inference System (ANFIS) and Convolutional Neural Networks (CNN), respectively. The existing methods focus on detecting only the known attacks in VANET environment. This limitation is overcome by proposing the Intelligent IDS system using soft computing techniques. The proposed method consists of Known IDS (KIDS) and Unknown IDS (UIDS) modules, which detect both known attacks and unknown attacks. The KIDS module uses ANFIS classification module to detect the known malicious attacks, whereas the UIDS module uses a deep learning algorithm to detect the unknown attacks in VANET. Modified LeeNET (MLNET) architecture is proposed in this article to identify the type of unknown attacks. In this work, DoS attacks, Botnet attacks, PortScan attacks, and Brute Force attacks are detected using this hybrid learning algorithm. The proposed system obtains 96.9% of Pr, 98.3% of Se, 98.7% of Sp, and 98.6% of Acc and consumed 1.75 s for detecting the DoS attack on i-VANET dataset. The proposed system obtains 98.1% of Pr, 98.9% of Se, 98.1% of Sp, and 98.1% of Acc and consumed 0.95 s for detecting the Botnet attack. The proposed system obtains 98.7% of Pr, 99.1% of Se, 98.9% of Sp, and 99.2% of Acc and consumed 1.38 s for detecting the PortScan attack. The proposed system obtains 99.1of Pr, 97.8% of Se, 98.7% of Sp, and 98.5% of Acc and consumed 1.29 s for detecting the Brute Force attack. The developed methodology is tested on the real-time CIC-IDS 2017 dataset, and the experimental results are compared with other state-of-the-art methods. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) ushers in a new era of communication that depends on a broad range of things and many types of communication technologies to share information. This new age of communication will be characterised by the following characteristics: Because all of the IoT's objects are connected to one another and because they function in environments that are not protected, it poses a significantly greater number of issues, constraints, and challenges than do traditional computing systems. This is due to the fact that traditional computing systems do not have as many interconnected components. Because of this, it is imperative that security be prioritised in a new approach, which is not something that is currently present in conventional computer systems. The Wireless Sensor Network, often known as WSN, and the Mobile Ad hoc Network are two technologies that play significant roles in the process of building an Internet of Things system. These technologies are used in a wide variety of activities, including sensing, environmental monitoring, data collecting, heterogeneous communication techniques, and data processing, amongst others. Because it incorporates characteristics of both MANET and WSN, IoT is susceptible to the same kinds of security issues that affect those other networks. An assault known as a Delegate Entity Attack (DEA) is a subclass of an attack known as a Denial of Service (DoS). The attacker sends an unacceptable number of control packets that have the appearance of being authentic. DoS assaults may take many different forms, and one of those kinds is an SD attack. Because of this, it is far more difficult to recognise this form of attack than a simple one that depletes the battery's capacity. One of the other key challenges that arise in a network during an SD attack is that there is the need to enhance energy management and prolong the lifespan of IoT nodes. This is one of the other significant issues that arise in a network when an SD attack is occurs. It is recommended that you make use of a Random Number Generator with Hierarchical Intrusion Detection System, abbreviated as RNGHID for short. The ecosystem of the Internet of Things is likely to be segmented into a great number of separate sectors and clusters. The HIPS system has been partitioned into two entities, which are referred to as the Delegate Entity (DE) and the Pivotal Entity, in order to identify any nodes in the network that are behaving in an abnormal manner. These entities are known, respectively, as the Delegate Entity and the Pivotal Entity (PE). Once the anomalies have been identified, it will be possible to pinpoint the area of the SD attack torture and the damaging activities that have been taken place. A warning message, generated by the Malicious Node Alert System (MNAS), is broadcast across the network in order to inform the other nodes that the network is under attack. This message classifies the various sorts of attacks based on the results of an algorithm that employs machine learning. The proposed protocol displays various desired properties, such as the capacity to conduct indivisible authentication, rapid authentication, and minimum overhead in both transmission and storage. These are only a few of the desirable attributes. [ABSTRACT FROM AUTHOR]

Now, the use of deep learning technology to solve the problems of the low multiclassification task detection accuracy and complex feature engineering existing in traditional intrusion detection technology has become a research hotspot. In all kinds of deep learning, recurrent neural networks (RNN) are very important. The RNN processes 41 feature attributes and maps them to a 122-dimensional high-dimensional feature space. To detect multiclassification tasks, this study proposes an intrusion detection method based on fully connected recurrent neural networks and compares its performance with previous machine learning methods on benchmark datasets. The research results show that the intrusion detection system (IDS) model based on fully connected recurrent neural network is very suitable for classification of intrusion detection. Classification methods, especially in multiclassification tasks, have high detection accuracy, significantly improve the detection performance of detection attacks and DoS attacks, and it provides a new research direction for the future attempts of intrusion detection methods for industrial control systems. [ABSTRACT FROM AUTHOR]

Summary.Aiming at the problems of insufficient scalability and slow response speed of the traditional three-layer control structure based on the time scale, this study proposes a distributed two-layer control structure. The primary control uses traditional power-frequency droop control, and the second-level control adopts a consensus protocol to simultaneously achieve the goals of frequency synchronization, frequency non-difference, and power optimization in a distributed manner, which can effectively improve the performance of microgrid frequency adjustment and power optimization. The cyber layer of the AC microgrid cyber-physical system (CPS) is extremely vulnerable to denial-of-service (DoS) attacks, resulting in the inability to achieve control objectives. For this reason, this paper designs a consensus algorithm based on event-triggered and a predictive compensation control link that combines empirical mode decomposition (EMD) and extreme learning machine (ELM) on the basis of the two-layer control structure. Finally, a 4-node islanded microgrid simulation example is used to verify the effectiveness of the proposed strategy. The simulation results show that the two-layer control strategy can achieve microgrid frequency recovery and power optimization while effectively responding to different degrees of DoS attacks. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) is a complicated security feature in which datagrams are protected by integrity, confidentiality, and authentication services. The network is protected from external interruptions and intrusions. Because IoT devices run with a range of heterogeneous technologies and process data over time, standard solutions may not be practical. It is necessary to develop intelligent procedures that can be used for multiple levels of data flow in the system. This study examines metainnovations using deep learning-based IDS. Per the findings of the earlier tests, BiLSTMs are better for binary (regular/attacker) classification; however, sequential models (LSTM or BiLSTM) are better for detecting some brutal attacks in multiclass classifiers. According to experts, deep learning-based intrusion detection systems can now recognize and select the best structure for each category. However, specific difficulties will need to be solved in the future. Two topics should be studied further in future attempts. One of the researchers' concerns is the impact of various data processing techniques, such as artificial intelligence or metamethods, on IDS. The BiLSTM approach has chosen the safest instances with the highest accuracy among the models. According to the findings, the most reliable and suitable solution for evaluating DDoS attacks in IoT is the BiLSTM design. [ABSTRACT FROM AUTHOR]

Distributed denial of service (DDoS) attacks are the most common means of cyberattacks against infrastructure, and detection is the first step in combating them. The current DDoS detection mainly uses the improvement or fusion of machine learning and deep learning methods to improve classification performance. However, most classifiers are trained with statistical flow features as input, ignoring topological connection changes. This one-sidedness affects the detection accuracy and cannot provide a basis for the distribution of attack sources for defense deployment. In this study, we propose a topological and flow feature-based deep learning method (GLD-Net), which simultaneously extracts flow and topological features from time-series flow data and exploits graph attention network (GAT) to mine correlations between non-Euclidean features to fuse flow and topological features. The long short-term memory (LSTM) network connected behind GAT obtains the node neighborhood relationship, and the fully connected layer is utilized to achieve feature dimension reduction and traffic type mapping. Experiments on the NSL-KDD2009 and CIC-IDS2017 datasets show that the detection accuracy of the GLD-Net method for two classifications (normal and DDoS flow) and three classifications (normal, fast DDoS flow, and slow DDoS flow) reaches 0.993 and 0.942, respectively. Compared with the existing DDoS attack detection methods, its average improvement is 0.11 and 0.081, respectively. In addition, the correlation coefficient between the detection accuracy of attack flow and the four source distribution indicators ranges from 0.7 to 0.83, which lays a foundation for the inference of attack source distribution. Notably, we are the first to fuse topology and flow features and achieve high-performance DDoS attack intrusion detection through graph-style neural networks. This study has important implications for related research and development of network security systems in other fields. [ABSTRACT FROM AUTHOR]

Cloud services are a popular concept used to describe how internet-based services are delivered and maintained. The computer technology environment is being restructured with respect to information preservation. Data protection is of critical importance when storing huge volumes of information. In today's cyber world, an intrusion is a significant security problem. Services, information, and services are all vulnerable to attack in the cloud due to its distributed structure of the cloud. Inappropriate behavior in the connection and in the host is detected using intrusion detection systems (IDS) in the cloud. DDoS attacks are difficult to protect against since they produce massive volumes of harmful information on the network. This assault forces the cloud services to become unavailable to target consumers, which depletes computer resources and leaves the provider exposed to massive financial and reputational losses. Cyber-analyst data mining techniques may assist in intrusion detection. Machine learning techniques are used to create many strategies. Attribute selection techniques are also vital in keeping the dataset's dimensionality low. In this study, one method is provided, and the dataset is taken from the NSL-KDD dataset. In the first strategy, a filtering method called learning vector quantization (LVQ) is used, and in the second strategy, a dimensionality-simplifying method called PCA. The selected attributes from each technique are used for categorization before being tested against a DoS attack. This recent study shows that an LVQ-based SVM performs better than the competition in detecting threats. [ABSTRACT FROM AUTHOR]

The minimal-degree distributed denial-of-service attack takes advantage of flaws in the adaptive mechanisms of network protocols, which could have a big impact on network service quality. It is very hard to find, has a low attack rate, and comes at a set time. Detection methods that have been used before have problems because they only use one type of detection and are not very good at identifying the object. In the end, a way to detect many sorts of minimal DDoS assaults that use deep hybrid learning is suggested. To construct multi-type limited DDoS threat data sets and mimic diverse sorts DDoS assaults and legitimate traffic in varying situations in the 5G setting, collect congestion at the networking entry and extract flow feature info are considered. From a statistical threshold and feature engineering point of view, these data sets show how many sorts of minimal DDoS assaults are there. This study aims to develop a deep hybrid learning-based multi-type low-rate DDoS attack detection solution for 5G networks which is the novel model that is recently deployed, and a hybrid deep learning algorithm was used to train the algorithm offline, and the algorithm's performance was compared to that of the LSTM-Light GBM and LSTM-RF algorithms. The CNN-RF revealing model was then used to detect minimal DDoS assaults at the gateway, so that multiple attacks could be detected at the same time. It can identify 4 sorts of low-rate DDoS assaults like Slow-Headers, Slow-Body, Slow-Read, and Shrew assaults, in a 120-second window. The false intercept rate is 11.03 percent. This means that 96.22 percent of traffic could be found. Using the strategy suggested can help cut down on the traffic concentration of minimal DDoS attacks at the net ingress. It can also be used in real-world situations. [ABSTRACT FROM AUTHOR]

Machine Learning based anomaly detection ap- proaches have long training and validation cycles. With IoT devices rapidly proliferating, training anomaly models on a per device basis is impractical. This work explores the "transfer- ability" of a pre-trained autoencoder model across devices of similar and different nature. We hypothesized that devices of similar nature would have similar high level feature character- istics represented by the initial layers of the autoencoder, while the more distinct features are captured by the innermost layer of the neural network. In our experiments, the centre-most layers of autoencoder models were re-trained with limited new data belonging to a different device. Datasets of seven Mirai infected and nine Bashlite infected IoT devices were used; each dataset also included benign records representing un-infected behaviour. We observed that the model's detection accuracy improved by an average of 9.52% for Mirai and 44.59% for Bashlite. The highest performance improvement of 26.68% and 73.00% was observed when the anomaly model of Ecobee thermostat was tested on other devices before and after transfer learning for Mirai and Bashlite respectively. Additionally, transfer learning took 47.31% and 58.27% less time for Mirai and Bashlite respectively. We further trialed the efficacy of the autoencoder based anomaly model on flow based records of network traffic using the CIC- IDS2017 dataset. It was observed that the model performed best when distinct outliers in the dataset were present, whereas the model failed to perform decently in cases where the malicious activity did not cause significant deviation in network traffic's footprint. [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) refers to the interconnection via the Internet of computing devices embedded in everyday objects, enabling them to send and receive data. These devices can be controlled remotely, which makes them susceptible to exploitation or even takeover by an attacker. The lack of security features on many IoT devices makes them easy to access confidential information, issue commands from a distance, or even use the compromised device as part of a DDoS attack against another network. Feature selection is an important part of problem formulation in machine learning. To overcome the above problems, this paper proposes a novel feature selection framework RFS for IoT attack detection using machine learning (ML) techniques. The RFS is based on the concept of effective feature selection and consists of three main stages: feature selection, modeling, and attacks detection. For feature selection, three different models are proposed. Based on these approaches, three different algorithms are proposed. A set of 40 features was included in the model, derived from combinatorial optimization and statistical analysis methods. Our experimental study shows that the proposed frame work significantly improves over state-of-the-art cyberattacks techniques for time series data with outliers. [ABSTRACT FROM AUTHOR]

A number of disadvantages of traditional networks may be attributed to the close relationship that exists between the control plane and the data plane inside proprietary hardware designs, as described above. The problem of security is one of the most difficult to deal with. There are a plethora of network hazards and attacks that might be encountered these days. DDoS attacks are one of the most popular and disruptive attacks on the internet today, and they affect a wide range of organisations. Despite a large number of traditional mitigation solutions now available, the frequency, volume, and intensity of distributed denial-of-service (DDoS) attacks continue to rise. According to the findings of this paper, a new network paradigm is necessary to satisfy the requirements of today's complex security concerns. It was necessary to develop a software-defined network (SDN) in order to meet the real-time needs of the massive network that was expanding at an exponential rate. Many advantages of SDN exist, including simplicity of administration, scalability, and agility, but one of the most critical is security, which is one of the most important considerations when implementing SDN. SDS may be seen as a paradigm in which the implementation of new security regulations in the computer environment is performed via the use of protected software, which is described further below. The goal is to provide a flexible and extensible architecture for DDoS detection and prevention that is both flexible and extendable; the suggested clustering approach, which is based on the Open Day Light (ODL) Controller, is employed to carry out the experimental findings. In this section, we emphasise DDoS penetration techniques from a range of tools, and we evaluate the vulnerability against various tactics. It is necessary to use a Mininet emulation tool to construct a detection and prevention system against distributed denial of service (DDoS) attacks in order to achieve success. There is a range of other simulation tools that are utilised in conjunction with this research in order to bring it to a conclusion. Integration of industry standards such as SNORT and Flow has been accomplished in a variety of situations and parameter settings. During the creation of a framework capable of detecting and mitigating DDoS attacks at an early stage in both the control and application levels, the implementation of this framework has been shown to be crucial in the development of a framework. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attacks pose the greatest threat to the continued and efficient operation of the Internet. It can lead to website downtime, lost time and money, disconnection and hosting issues, and website vulnerability. Conventional machine learning methodologies are being harmed by reduced recognition rates and greater false-positive rates due to the emergence of new threats. As a result, high-performance machine learning classifiers with low false-positive rates and high prediction accuracy are required for the DDoS detection system. Here, a deep belief neural network is preferred, upgraded to the modified deep neural network (M-DBNN) to accurately detect DDoS attacks from the network. Enable the database to change a specific format and range, which helps the M-DBNN classifier easily predict the class. An advanced Chimp Optimization Algorithm (ChOA) is used to minimize the error to find the best weight of the M-DBNN classifier; this leads to accurate DDOS attack detection and predict the classes effectively. The proposed method is evaluated for CAIDA "DDoS Attack 2007" dataset. The accuracy of the proposed method is 0.87%, and the outcome is compared with those of other existing methods of deep neural network (DNN), support vector machine (SVM), artificial neural network (ANN), and neural network (NN). The proposed method demonstrates great detection accuracy with a low error. [ABSTRACT FROM AUTHOR]

With the increasing number of Internet users, cybersecurity is becoming more and more critical. Denial of service (DoS) and distributed denial of service (DDoS) attacks are two of the most common types of attacks that can severely affect a website or a server and make them unavailable to other users. The number of DDoS attacks increased by 55% between the period January 2020 and March 2021. Some approaches for detecting the DoS and DDoS attacks employing different machine learning and deep learning techniques are reported in the literature. Recently, it is also observed that the attackers have started leveraging state-of-the-art AI tools such as generative models for generating synthetic attacks which fool the standard detectors. No concrete approach is reported for developing and training the models which are not only robust in the detection of standard DDoS attacks but which can also detect adversarial attacks which are created synthetically by the attackers with harmful intentions. To that end, in this work, we employ a generative adversarial network (GAN) to develop such a robust detector. The proposed framework can generate and classify the synthetic benign (normal) and malignant (DDoS) instances which are very similar to the corresponding real instances as evaluated by similarity scores. The GAN-based model also demonstrates how effectively the malicious actors can generate adversarial DDoS network traffic instances which look like normal instances using feature modification which are very difficult for the classifier to detect. An approach on how to make the classifiers robust enough to detect such kinds of deliberate adversarial attacks via modifying some specific attack features manually is also proposed. This work provides the first step towards developing a generic and robust detector for DDoS attacks originating from various sources. [ABSTRACT FROM AUTHOR]

Network available and accessible is of great importance to the Internet of things (IoT) devices. In this study, a novel machine learning method is presented to predict the occurrence of distributed denial-of-service (DDoS) attacks. Firstly, a structure of edges and vertices within graph theory is created to simultaneously extract traffic data characteristics. Eight characteristics of traffic data are selected as input variables. Secondly, the principal component analysis (PCA) model is adopted to extract DDoS and normal communication features further. Then, DDoSs are detected by fuzzy C-means (FCM) clustering with these features. In the case study, 2000 traffic data in dataset CICIDS-2017 are used to verify the practicability of this method. The results of recall, false positive, true positive, true negative, and false negative are 100.00%, 1.05%, 68.95%, 0.00%, and 30.00%. Compared with other methods, the results demonstrate that the detecting reliability is improved, and the method has a good effect on the detection of DDoS attacks. [ABSTRACT FROM AUTHOR]

With successful machine learning applications in many fields, researchers tried to introduce machine learning into intrusion detection systems for building classification models. Although experimental results showed that these classification models could produce higher accuracy in predicting network attacks on the offline datasets, compared with the operational intrusion detection systems, machine learning is rarely deployed in the real intrusion detection environment. This is what we call the last mile problem with the machine learning approach to network intrusion detection, the discrepancy between the strength and requirements of machine learning and network operational semantics. In this paper, we aim to bridge the aforementioned gap. In particular, an LCC-RF-RFEX feature selection approach is proposed to select optimal features of the specific type of attacks from dataset, and then, an intrusion-specific approach is introduced to convert them into detection patterns that can be used by the nonmachine-learning detector for the corresponding specific attack detection in the real-world network environment. To substantiate our approach, we take Snort, KDDCup'99 dataset, and Dos attacks as the experimental subjects to demonstrate how to close the last-mile gap. For the specific type of Dos attacks in the KDDCup'99 dataset, we use the LCC-RF-RFEX method to select optimal feature subset and utilize our intrusion-specific approach to generate new rules in Snort by using them. Comparing performance differences between the existing Snort rule set and our augmented Snort rule set with regard to Dos attacks, the experimental results showed that our approach expanded Snort's detection capability of Dos attacks, on average, reduced up to 25.28% false-positive alerts for Teardrop attacks and Synflood attacks, and decreased up to 98.87% excessive alerts for Mail bomb attacks. [ABSTRACT FROM AUTHOR]

With the rapid increase and complexity of IPv6 network traffic, the traditional intrusion detection system Snort detects DoS attacks based on specific rules, which reduces the detection performance of IDS. To solve the DoS intrusion detection problem in the IPv6 network environment, the lightweight KNN optimization algorithm in machine learning is adopted. First, the double dimensionality reduction of features is achieved through the information gain rate, and discrete features with more subfeatures are selected and aggregated to further dimensionality reduction and feature dimension of the actual operation. Secondly, the information gain rate is used as the weight to optimize the sample Euclidean distance measurement. Based on the proposed measure of the reverse distance influence, the classification decision algorithm of the KNN algorithm is optimized to make the detection technology better. The effect is further improved. The experimental results show that the traditional TAD-KNN algorithm based on average distance and the GR-KNN algorithm that only optimizes the distance definition, the GR-AD-KNN algorithm can not only improve the overall detection performance in the detection of IPv6 network traffic characteristics but also for small groups of samples. As a result, classification has better detection results. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) is a predominant threat to the availability of online services due to their size and frequency. However, developing an effective security mechanism to protect a network from this threat is a big challenge because DDoS uses various attack approaches coupled with several possible combinations. Furthermore, most of the existing deep learning- (DL-) based models pose a high processing overhead or may not perform well to detect the recently reported DDoS attacks as these models use outdated datasets for training and evaluation. To address the issues mentioned earlier, we propose CyDDoS, an integrated intrusion detection system (IDS) framework, which combines an ensemble of feature engineering algorithms with the deep neural network. The ensemble feature selection is based on five machine learning classifiers used to identify and extract the most relevant features used by the predictive model. This approach improves the model performance by processing only a subset of relevant features while reducing the computation requirement. We evaluate the model performance based on CICDDoS2019, a modern and realistic dataset consisting of normal and DDoS attack traffic. The evaluation considers different validation metrics such as accuracy, precision, F1-Score, and recall to argue the effectiveness of the proposed framework against state-of-the-art IDSs. [ABSTRACT FROM AUTHOR]

Since the services on the Internet are becoming increasingly abundant, all walks of life are inextricably linked with the Internet. Simultaneously, the Internet's WEB attacks have never stopped. Relative to other common WEB attacks, WEB DDoS (distributed denial of service) will cause serious damage to the availability of the target network or system resources in a short period of time. At present, most researches are centered around machine learning-related DDoS attack detection algorithms. According to previous studies, unsupervised methods generally have a high false positive rate, while supervisory methods cannot handle large amount of network traffic data, and the performance is often limited by noise and irrelevant data. Therefore, this paper proposes a semisupervised learning detection model combining spectral clustering and random forest to detect the DDoS attack of the WEB application layer and compares it with other existing detection schemes to verify the semisupervised learning model proposed in this paper. While ensuring a low false positive rate, there is a certain improvement in the detection rate, which is more suitable for the WEB application layer DDoS attack detection. [ABSTRACT FROM AUTHOR]

Vehicular Ad hoc NETwork is a promising technology providing important facilities for modern transportation systems. It has garnered much interest from researchers studying the mitigation of attacks including distributed denial of service attacks. Machine learning techniques, which mainly rely on the quality of the datasets used, play a role in detecting many attacks with a high level of accuracy. We conducted a comprehensive literature review and found many limitations on the datasets available for distributed denial of service attacks on Vehicular Ad hoc NETwork including the following: unavailability of online versions, an absence of distributed denial of service traffic, unrepresentative of Vehicular Ad hoc NETwork, and no information regarding the network configurations. Therefore, in this article, we proposed a novel simulation technique to generate a valid dataset called Vehicular Ad hoc NETwork distributed denial of service dataset, which is dedicated to Vehicular Ad hoc NETworks. Vehicular Ad hoc NETwork distributed denial of service dataset holds information on distributed denial of service attack traffic considering Vehicular Ad hoc NETwork architecture, traffic density, attack intensity, and nodes mobility. Well-known simulation tools such as SUMO, OMNeT++, Veins, and INET were used to ensure that all the properties of Vehicular Ad hoc NETwork have been captured. We then compared Vehicular Ad hoc NETwork distributed denial of service dataset with several studies to prove its novelty and evaluated the dataset using several machine learning models. We confirmed that studied models using this dataset achieved high accuracy above 99.5% except support-vector machine that achieved 97.3%. [ABSTRACT FROM AUTHOR]

Users and Internet service providers (ISPs) are constantly affected by denial-of-service (DoS) attacks. This cyber threat continues to grow even with the development of new protection technologies. Developing mechanisms to detect this threat is a current challenge in network security. This article presents a machine learning- (ML-) based DoS detection system. The proposed approach makes inferences based on signatures previously extracted from samples of network traffic. The experiments were performed using four modern benchmark datasets. The results show an online detection rate (DR) of attacks above 96%, with high precision (PREC) and low false alarm rate (FAR) using a sampling rate (SR) of 20% of network traffic. [ABSTRACT FROM AUTHOR]

Request route flooding attack is one of the main challenges in the security of Mobile Ad Hoc Networks (MANETs) as it is easy to initiate and difficult to prevent. A malicious node can launch an attack simply by sending an excessively high number of route request (RREQ) packets or useless data packets to nonexistent destinations. As a result, the network is rendered useless as all its resources are used up to serve this storm of RREQ packets and hence unable to perform its normal routing duty. Most existing research efforts on detecting such a flooding attack use the number of RREQs originated by a node per unit time as the threshold to classify an attacker. These algorithms work to some extent; however, they suffer high misdetection rate and reduce network performance. This paper proposes a new flooding attacks detection algorithm (FADA) for MANETs based on a machine learning approach. The algorithm relies on the route discovery history information of each node to capture similar characteristics and behaviors of nodes belonging to the same class to decide if a node is malicious. The paper also proposes a new flooding attacks prevention routing protocol (FAPRP) by extending the original AODV protocol and integrating FADA algorithm. The performance of the proposed solution is evaluated in terms of successful attack detection ratio, packet delivery ratio, and routing load both in normal and under RREQ attack scenarios using NS2 simulation. The simulation results show that the proposed FAPRP can detect over 99% of RREQ flooding attacks for all scenarios using route discovery frequency vector of sizes larger than 35 and performs better in terms of packet delivery ratio and routing load compared to existing solutions for RREQ flooding attacks. [ABSTRACT FROM AUTHOR]

The KDD CUP 1999 intrusion detection dataset was introduced at the third international knowledge discovery and data mining tools competition, and it has been widely used for many studies. The attack types of KDD CUP 1999 dataset are divided into four categories: user to root (U2R), remote to local (R2L), denial of service (DoS), and Probe. We use five classes by adding the normal class. We define the U2R, R2L, and Probe classes, which are each less than 1% of the total dataset, as rare classes. In this study, we attempt to mitigate the class imbalance of the dataset. Using the synthetic minority oversampling technique (SMOTE), we attempted to optimize the SMOTE ratios for the rare classes (U2R, R2L, and Probe). After randomly generating a number of tuples of SMOTE ratios, these tuples were used to create a numerical model for optimizing the SMOTE ratios of the rare classes. The support vector regression was used to create the model. We assigned each instance in the test dataset to the model and chose the best SMOTE ratios. The experiments using machine-learning techniques were conducted using the best ratios. The results using the proposed method were significantly better than those of previous approach and other related work. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attacks are one of the biggest concerns for security professionals. Traditional middle-box based DDoS attack defense is lack of network-wide monitoring flexibility. With the development of software-defined networking (SDN), it becomes prevalent to exploit centralized controllers to defend against DDoS attacks. However, current solutions suffer with serious southbound communication overhead and detection delay. In this paper, we propose a cross-plane DDoS attack defense framework in SDN, called OverWatch, which exploits collaborative intelligence between data plane and control plane with high defense efficiency. Attack detection and reaction are two key procedures of the proposed framework. We develop a collaborative DDoS attack detection mechanism, which consists of a coarse-grained flow monitoring algorithm on the data plane and a fine-grained machine learning based attack classification algorithm on the control plane. We propose a novel defense strategy offloading mechanism to dynamically deploy defense applications across the controller and switches, by which rapid attack reaction and accurate botnet location can be achieved. We conduct extensive experiments on a real-world SDN network. Experimental results validate the efficiency of our proposed OverWatch framework with high detection accuracy and real-time DDoS attack reaction, as well as reduced communication overhead on SDN southbound interface. [ABSTRACT FROM AUTHOR]

The explosive growth of network traffic and its multitype on Internet have brought new and severe challenges to DDoS attack detection. To get the higher True Negative Rate (TNR), accuracy, and precision and to guarantee the robustness, stability, and universality of detection system, in this paper, we propose a DDoS attack detection method based on hybrid heterogeneous multiclassifier ensemble learning and design a heuristic detection algorithm based on Singular Value Decomposition (SVD) to construct our detection system. Experimental results show that our detection method is excellent in TNR, accuracy, and precision. Therefore, our algorithm has good detective performance for DDoS attack. Through the comparisons with Random Forest, k-Nearest Neighbor (k-NN), and Bagging comprising the component classifiers when the three algorithms are used alone by SVD and by un-SVD, it is shown that our model is superior to the state-of-the-art attack detection techniques in system generalization ability, detection stability, and overall detection performance. [ABSTRACT FROM AUTHOR]

Due to the scattered nature of DDoS attacks and advancement of new technologies such as cloud-assisted WBAN, it becomes challenging to detect malicious activities by relying on conventional security mechanisms. The detection of such attacks demands an adaptive and incremental learning classifier capable of accurate decision making with less computation. Hence, the DDoS attack detection using existing machine learning techniques requires full data set to be stored in the memory and are not appropriate for real-time network traffic. To overcome these shortcomings, Very Fast Decision Tree (VFDT) algorithm has been proposed in the past that can handle high speed streaming data efficiently. Whilst considering the data generated by WBAN sensors, noise is an obvious aspect that severely affects the accuracy and increases false alarms. In this paper, an enhanced VFDT (EVFDT) is proposed to efficiently detect the occurrence of DDoS attack in cloud-assisted WBAN. EVFDT uses an adaptive tie-breaking threshold for node splitting. To resolve the tree size expansion under extreme noise, a lightweight iterative pruning technique is proposed. To analyze the performance of EVFDT, four metrics are evaluated: classification accuracy, tree size, time, and memory. Simulation results show that EVFDT attains significantly high detection accuracy with fewer false alarms. [ABSTRACT FROM AUTHOR]

ABSTRACT From traditional networking to cloud computing, one of the essential but formidable tasks is to detect cyber attacks and their types. A cloud provider's unwillingness to share security-related data with its clients adds to the difficulty of detection by a cloud customer. The research contributions in this paper are twofold. First, an investigative survey on cloud computing is conducted with the main focus on gaps that is hindering cloud adoption, accompanied by a review of the threat remediation challenges. Second, some thoughts are constructed on novel approaches to address some of the widely discussed denial-of-service (DoS) attack types by using machine learning techniques. We evaluate the techniques' performances by using statistical ranking-based methods, and find the rule-based learning technique C4.5, from a set of popular learning algorithms, as an efficient tool to classify various DoS attacks in the cloud platform. The novelty of our rather rigorous analysis is in its ability to identify insider's activities and other DoS attacks by using performance data. The reason for using performance data rather than traditional logs and security-related data is that the performance data can be collected by the customers themselves without any help from cloud providers. To the best of our knowledge, no one has made such attempts before. Our findings and thoughts captured through a series of experiments in our constructed cloud server are expected to give researchers, cloud providers and customers additional insight and tools to proactively protect themselves from known or perhaps even unknown security issues that have similar patterns. Copyright © 2012 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]