Search

Summary: In this article, a memory event‐triggered mechanism (METM) based switching‐like control method is designed for a cyber‐physical system (CPS), maintain control performance and improve the communication efficiency under denial of service (DoS) attack. In order to obtain better control effect at small sampling periods, a sampler contains the explicit sampling period is designed by using delta operator approach. First of all, a METM based on an acknowledgement character (ACK) mechanism is proposed, which can reduce event triggered data calculations, increase the transmission instants at the crest or trough of the responses and reduce the negative impact of DoS attack. Next, a switching‐like control strategy for the delta operator system converted from the CPS is designed to prevent DoS attack resulting in open‐loop unstable operation of the system. Further, a switching law is designed to maintain the concealment of the secure channel. Then, sufficient conditions are derived for the CPS in terms of linear matrix inequalities (LMIs). Finally, the effectiveness of the designed method is verified by a simulation example. [ABSTRACT FROM AUTHOR]

This article investigates the leader‐follower consensus control problem of a feedforward nonlinear multiagent system under denial‐of‐service (DoS) attacks. Compared with the existing results on the consensus control of multiagent systems under DoS attacks, this article considers a class of feedforward multiagent systems with nonlinear functions that are less conservative, and takes into account asynchronous DoS attacks with attack detection delay. To address these problems, firstly, a new class of topological switching sequences and Laplacian matrices are designed based on the properties of the considered DoS attacks to convert the DoS attacks with attack detection delay problems into a class of topological switching problems. Then, a distributed dynamic gain compensator and an output feedback controller are constructed for each follower by using the output information of neighbor agents that are not intercepted by the attacks. Afterwards, by using piecewise Lyapunov functions, it is proven that if the DoS signal satisfies the condition of time‐varying average dwell time (ADT), then the followers can asymptotically track the state of the leader. Finally, a numerical example is provided to verify the effectiveness of the control algorithm. [ABSTRACT FROM AUTHOR]

This study develops an active security control strategy for Cyber-Physical Systems (CPSs) that are subject to attacks known as Denial-of-Service (DoS), which can target both channels from the controller to the actuator and from the controller to the sensor. Due to attack cost restrictions, the linked channels are subject to a limit on the number of continuous DoS attacks. A proactive security control method is then developed to combat two-channel DoS attacks, depending on a method for identifying IoT intrusions. Using the CICIDS dataset for attack detection, we examined the effectiveness of the Deep Convolutional Network Model (DCNM), a suggested deep learning model. The addressed CPS can be asymptotically stable against DoS assaults under the security controller's active security control technique without sacrificing control performance. Recent tests and simulations show how effective the security control strategy is active. The proposed model gives better trade-off compared to existing approaches like Deep Belief Networks (DBN), Recurrent Neural Networks (RNN), Support Vector Machines (SVM), Supervised Neural Networks (SNN) and Feed Forward Neural Networks (FNN). The proposed model gives 99.3%, 99.5%, 99.5%, 99.6%, 99%, 98.9%, 99% accuracy with normal attack detection, botnet attack detection, Brute force attack detection, DoS attack detection, Infiltration attack detection, Portscan attack detection and web attack detection respectively. [ABSTRACT FROM AUTHOR]

The article deals with the security control stabilization problem of uncertain Markov jump power systems with input dead zone under stochastic denial‐of‐service (DoS) attack. DoS attack is modeled as a discrete‐time Markov process. Dual hidden Markov models are respectively used to detect the modes of the original power systems and the one under DoS attack. Based on the detected modes and neural networks (NNs), adaptive NN‐based security asynchronous control strategies are proposed, where both state feedback and output feedback are studied simultaneously. With the developed control laws, all trajectories of the closed‐loop systems are bounded stable in the stochastic setting. Simulation results demonstrate the correctness and usefulness of the proposed techniques. [ABSTRACT FROM AUTHOR]

This article presents a new design approach for resilient fault‐tolerant event‐triggered (ET) based security control of Markovian jump nonlinear systems (MJNSs) in the presence of nonperiodic denial‐of‐service (DoS) attacks. The approach is developed based on interval type‐2 (IT‐2) fuzzy models of the plant. The state error produced by data packet loss is turned into a parameter in the proposed ET condition during nonperiodic DoS attacks. The uncertain triggering variable is considered in the resilient fault‐tolerant ET condition for the MJNSs. In contrast to the usual strategy, the fault‐tolerant ET strategy is designed to send the required data packets to the controller during nonperiodic DoS attacks, which significantly contributes to the minimization of performance loss. Dissipative, passive, and H∞$$ {\boldsymbol{H}}_{\infty } $$‐control schemes are all covered in a unifying framework by using a generalized performance index. Plant and controller modes are considered under mismatched membership functions to regulate asynchronous phenomena. Sufficient conditions depending on the membership functions that guarantee the stability of the closed‐loop system are derived. Finally, two numerical examples are provided to demonstrate the effectiveness of the proposed approach. [ABSTRACT FROM AUTHOR]

Software-Defined Networking (SDN) has revolutionized network management by providing unprecedented flexibility, control, and efficiency. However, its centralized architecture introduces critical security vulnerabilities. This paper introduces a novel approach to securing SDN environments using IOTA 2.0 smart contracts. The proposed system utilizes the IOTA Tangle, a directed acyclic graph (DAG) structure, to improve scalability and efficiency while eliminating transaction fees and reducing energy consumption. We introduce three smart contracts: Authority, Access Control, and DoS Detector, to ensure trusted and secure network operations, prevent unauthorized access, maintain the integrity of control data, and mitigate denial-of-service attacks. Through comprehensive simulations using Mininet and the ShimmerEVM IOTA Test Network, we demonstrate the efficacy of our approach in enhancing SDN security. Our findings highlight the potential of IOTA 2.0 smart contracts to provide a robust, decentralized solution for securing SDN environments, paving the way for the further integration of blockchain technologies in network management. [ABSTRACT FROM AUTHOR]

The pernicious impact of malicious Slow DoS (Denial of Service) attacks on the application layer and web-based Open Systems Interconnection model services like Hypertext Transfer Protocol (HTTP) has given impetus to a range of novel detection strategies, many of which use machine learning (ML) for computationally intensive full packet capture and post-event processing. In contrast, existing detection mechanisms, such as those found in various approaches including ML, artificial intelligence, and neural networks neither facilitate real-time detection nor consider the computational overhead within resource-constrained Internet of Things (IoT) networks. Slow DoS attacks are notoriously difficult to reliably identify, as they masquerade as legitimate application layer traffic, often resembling nodes with slow or intermittent connectivity. This means they often evade detection mechanisms because they appear as genuine node activity, which increases the likelihood of mistakenly being granted access by intrusion-detection systems. The original contribution of this paper is an innovative Guardian Node (GN) Slow DoS detection model, which analyses the two key network attributes of packet length and packet delta time in real time within a live IoT network. By designing the GN to operate within a narrow window of packet length and delta time values, accurate detection of all three main Slow DoS variants is achieved, even under the stealthiest malicious attack conditions. A unique feature of the GN model is its ability to reliably discriminate Slow DoS attack traffic from both genuine and slow nodes experiencing high latency or poor connectivity. A rigorous critical evaluation has consistently validated high, real-time detection accuracies of more than 98% for the GN model across a range of demanding traffic profiles. This performance is analogous to existing ML approaches, whilst being significantly more resource efficient, with computational and storage overheads being over 96% lower than full packet capture techniques, so it represents a very attractive alternative for deployment in resource-scarce IoT environments. [ABSTRACT FROM AUTHOR]

To address the issue of diminished LBS privacy protection capabilities in sparse user environments within vehicular networks, this paper proposed a hybrid privacy protection scheme based on homomorphic encryption. The scheme exploited the properties of homomorphic encryption to enable the on-demand generation and indistinguishable authentication of vehicle users' virtual identities. By obfuscating the virtual addresses with the vehicles' real locations, it further provided hybrid privacy protection based on vehicle identity and location. Security analysis demonstrates that, in addition to effectively preserving service privacy, the scheme is traceable against malicious vehicle identities, and it effectively defends against denial-of-service attacks and pseudonym forgery attacks. Performance analysis results indicate that, compared to traditional pseudonym generation methods and k-anonymity techniques, as the privacy factor k increases to 40, the scheme reduces computational overhead by 25% in dynamic pseudonym generation and achieves over 91% privacy protection, this compensates for the deficiencies of k-anonymity and pseudonym techniques in specific environments, making it more suitable for dynamic, low-latency vehicular network communication environments. [ABSTRACT FROM AUTHOR]

Software Defined Networks (SDNs) offer a comprehensive network view by separating the control plane from the data plane. However, SDNs are vulnerable to Distributed Denial of Service (DDoS), a dangerous attack that depletes resources, preventing service delivery. Among the DDoS attacks, the HTTP slow-rate DDoS attack is particularly critical, targeting web servers with slow or incomplete requests. Significant efforts have been made in the last few years to improve DDoS attack detection in SDNs, leading to the proposal of several detection techniques. In an effort to address these current constraints, scientists have concentrated on leveraging the computational capabilities of data plane devices. Notably, in this context, Programming Protocol-independent Packet Processors (P4) have become an important technology closely linked to the data plane components of SDN. The use of new detection techniques through the use of P4-equipped data planes for DDoS detection methods has the potential to reduce the computational load on the controller. This research paper analyzes detection system components and introduces P4httpGuard,a detection mechanism that employs machine learning (ML) techniques in conjunction with P4 switches to identify slow-rate DDoS attacks within SDNs. The model uses P4 switches programmable capabilities to enhance detection while reducing controller computational overhead. The model has been evaluated for performance metrics like detection time, bandwidth consumption, and CPU usage. The results from the implementation of our mechanism demonstrate a notable 60-second improvement in detection time, an 81.89% reduction in bandwidth consumption, and a 25.96% decrease in controller CPU overhead, in compare to the Openflow method. These findings underscore the significant impact of integrating the P4 data plane and programmable targets in substantially enhancing the efficiency of slow-rate DDoS attack detection within SDN. [ABSTRACT FROM AUTHOR]

The exponential growth of IoT devices and their interdependency makes the technology more vulnerable to network attacks like Distributed Denial of Service (DDoS) that interrupt network resources. The prevalence of these attacks necessitates the development of robust and effective defense mechanisms. In recent years, many machine learning defense methodologies have been developed to address the ubiquitous growth of DDoS attacks on IoT, and the majority of them suffer from detection time delay issues. Thus, the paper presents an approach focusing on dimensionality reduction and feature selection techniques to minimize long-time detection without compromising accuracy. The proposed approach uses Principal Component Analysis (PCA), Linear Discriminant Analysis (LDA), Factor Analysis and Recursive Feature Elimination with Cross Validation (RFECV) as the dimensionality reduction and feature selection techniques and Gaussian Naïve Bayes (GNB), Decision Tree (DT), Random Forest (RF), AdaBoost, and Logistic Regression (LR) as machine learning models to classify the malicious traffic. The approach provides a reliable DDoS detection model that effectively enhances the detection time delay with the combination of GNB with LDA and achieves 99.98% accuracy in 0.582 s of detection time. [ABSTRACT FROM AUTHOR]

The increasing number of sensors and Internet of Things (IoT) devices have made the Denial of Service (DoS) attacks in IoT networks a significant security threat. The inherent characteristics of IoT networks such as the large number of end nodes, the heterogeneous nature of IoT networks, resource limitations in routers, and the multiplicity of application areas in daily life, make the investigation of attacks in these networks a major and important research problem. This paper presents a new approach for detecting and mitigating DoS attacks in IoT networks. The proposed approach is implemented on an Field Programmable Gate Array (FPGA)-based platform and tested for performance against different types of DoS attacks. The approach can respond quickly to attacks specific to IoT networks and can be easily implemented on hardware with low resource requirements. [ABSTRACT FROM AUTHOR]

In fifth-generation (5G)-based vehicular networks, vehicles share information about the road's condition to make driving safer and alleviate traffic congestion. Given the public nature of the medium, addressing issues of confidentiality and security is of paramount importance. Existing systems are vulnerable to a distributed denial-of-service (DDoS) attack from an attacker or high traffic in a dense area because of the time-consuming and complex operations based on bilinear pair and elliptic curve cryptographies used. In order to protect vehicle-to-vehicle communication in 5G-based vehicular networks from DDoS attacks, a strategy based on the Chebyshev polynomial is proposed in this study. The semi-group and chaotic features of the Chebyshev polynomial are utilised in our proposal. Our solutions also meet all applicable standards for security and privacy, such as node authentication, message integrity, preserving identity privacy, traceability, unlinkability, and resistance to attacks. Finally, our innovation decreases the computational burden to produce a message signature by 66.67% and the burden to verify a signature by 33.33%. However, the size of the message-signature tuple is affected by the communication expenses of our work by 5.00%. [ABSTRACT FROM AUTHOR]

In this paper, the adaptive lateral control problem is considered for autonomous electric vehicles under denial-of-service (DoS) attacks. Autonomous electric vehicles require high-precision position and pose information for the lateral control, which can be obtained from the global positioning system (GPS). However, this kind of sensors is easily susceptible to malicious DoS attacks. To mitigate the performance degradation caused by DoS attacks on GPS, a state observer is designed based on the measurements of inertial measurement units (IMUs), such that the position and pose information of vehicles can be estimated. Then, by adopting the observer states and backstepping technique, a novel adaptive secure switching control scheme is proposed. Subsequently, a stability condition is derived, which guarantees that the tracking errors converge to a compact set, and the attack effects on system dynamic performance are weakened. The stability condition also reveals the relationships among the attack durations, design parameters, and tracking errors, which can be used to guide the selection of design parameters. Simulation results are provided to validate the effectiveness and robustness of the proposed control scheme. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attacks constitute a formidable threat, obstructing access to legitimate internet services and disrupting the seamless provision of services by organizations. Despite extensive research dedicated to developing defense mechanisms against DDoS attacks, their persistence remains a challenge. The majority of research in DDoS defense can be categorized into attack detection, mitigation, and prevention. Notably, defense strategies falling within the purview of attack detection and mitigation are reactive in nature, often activated after some level of damage has already occurred. In addition, the terms "detection" and "mitigation," maintain consistent meanings in the literature. However, the term "prevention" in the context of DDoS attacks has been associated with varying interpretations in the literature. This paper undertakes a comprehensive review of techniques labeled as "prevention" in the realm of DDoS attacks. In addition, because prevention techniques do not have a standard meaning in the literature, we further classify these techniques into Ideal Prevention, True Prevention, and Partial Prevention. By scrutinizing these techniques and their implications, we shed light on the complexity of mitigating DDoS threats effectively. In particular, we advocate for increased focus on True Prevention techniques, emphasizing the need for dynamism, computational efficiency, scalability, and practical deployability. [ABSTRACT FROM AUTHOR]

In today's world, the banking sector, government organizations, and various users in the finance and insurance sectors have grown exponentially. In such situations, they become primary targets for attackers. The main focus of these attackers is to disrupt services for legitimate users. Recently, attackers have targeted banks in Ukraine during the Russia-Ukraine war, causing a shortage of money in banks and making it difficult for people to withdraw funds. These types of attacks fall under the category of Distributed Denial of Service (DDoS) attacks. The primary objectives of these DDoS attacks are to gain financial control and damage the reputation of the affected organization or country. The purpose of this paper is to detect DDoS attacks using various Decision Tree Classifiers in Machine Learning algorithms. We utilized the 'caret' package in R, which is well-known for its Classification and Regression Techniques. We split the KDD'99 dataset based on the outcome variable. We employed the 'rpart' method to classify the dataset using CART and C4.5 algorithms. Experimental results indicate that our classification methods achieve a better accuracy rate compared to other decision tree methods. [ABSTRACT FROM AUTHOR]

This article addresses adaptive event‐triggered discrete‐time nonlinear Markov jump systems (MJs) with DoS attacks, where the introduced DoS attacks are considered as more general stochastic models with fixed trigger frequency and duration. To solve the optimal control problem, we use an adaptive dynamic programming (ADP) algorithm based on policy iteration (PI). The approximate process is as follows: the performance index function (PIF) is first updated by the iteration policy in advance, and the control policy is obtained from the PIF. Subsequently, an approximate estimation of the optimal PIF and the optimal control policy is made using the actor‐critic structure obtained through neural network techniques. In order to reduce the occupied communication resources required for control policy iteration, we introduce an adaptive event triggering mechanism with an adaptive triggering threshold, which reduces the conservatism of resource occupation by the PIF compared to the fixed‐threshold ETM. In addition, an observer identifying the unknown dynamics part of the system is designed. Finally, using the Lyapunov function, it is shown that the designed control policy ensures the stability and convergence of the MJS, and the designed observer is effective. Simulation examples are given to verify the feasibility of the controller and the observer. [ABSTRACT FROM AUTHOR]

This study introduces an innovative approach for detecting Distributed Denial-of-Service (DDoS) attacks in Software-Defined Networks (SDNs) with a multi-controller setup, specifically tailored to secure Internet of Things (IoT) devices. Traditional DDoS detection techniques struggle with the dynamic and sophisticated nature of modern network threats, particularly in complex and scalable environments like SDNs. To address these challenges, our objective is to develop a methodology that integrates adaptive learning and feedback mechanisms to continuously evolve and improve detection accuracy. Our approach utilizes adaptive learning models that dynamically adjust to new data and emerging attack patterns, learning continuously from network behaviour to detect subtle and novel attack strategies effectively. By implementing a system of feedback loops, our detection algorithms receive real-time insights from the operational environment, allowing immediate adaptation to changing network conditions and attack techniques. Advanced feature selection methods are employed to identify the most relevant data points from network traffic. Through ROC curve analysis of various machine learning models--RNN, LSTM, GAN, and Auto Encoder--using Chi-Square, Decision Tree, and PCA feature selection methods, PCA consistently demonstrated superior performance. It achieved higher true positive rates across various false positive rates, indicating better classification accuracy. The Auto Encoder model, combined with PCA, exhibited the best results, highlighting its efficacy in balancing sensitivity and specificity for anomaly detection. Experimental evaluations conducted using the CICDDoS2019 dataset highlight the effectiveness of our approach. The proposed Auto Encoder model with PCA feature selection achieved the highest accuracy at 99.56%, surpassing other models such as LSTM with feature selection, which achieved 99.42%, and RNN LSTM, which had the lowest accuracy at 89.63%. These results demonstrate the effectiveness of our approach in enhancing the accuracy and reliability of network traffic anomaly detection, particularly for DDoS attacks involving IoT devices. Overall, our research combines adaptive learning and feedback loops to create a dynamic, intelligent DDoS detection system for SDNs, advancing network security in handling evolving threats. [ABSTRACT FROM AUTHOR]

Named Data Networking (NDN) is a next-generation internet architecture that routes data packets based on content identity rather than IP addresses, shifting focus from location to identity. However, because NDN routers are decentralized and have a limited capacity for data packet authentication, the networks are exposed to a variety of security risks like cache poisoning. Identifying and blocking malicious sources in NDN networks is challenging. To overcome these issues, a novel Secure Named Data networking using Deep Learning (SEND-DL) technique has been proposed to address security concerns in NDN by focusing on mitigating threats such as cache poisoning attacks and identifying malicious sources. The proposed method introduces a Feedback packet type and utilizes the Boneh-Lynn-Shacham (BLS) signature scheme for authentication, alongside Convolutional Neural Network (CNN) and Deep Belief Network (DBN) based techniques for content store cleanup and malicious source identification. The method dynamically adjusts forwarding paths, prioritizing legitimate content retrieval while blocking malicious sources. Experimental outcomes validate the efficiency of the proposed SEND-DL approach using evaluation metrics like content retrieval latency, communication overhead, cache hit rate, deployment complexity, security effectiveness, and fault tolerance which are compared to existing techniques like Q-learning based cache pollution attack mitigation approach for named data networking (Q-ICAN), Dynamic FOrest of Random Subsets based Capability enhancing Security Architecture (DFORS-CSA), and Mitigation of Sophisticated Interest flooding-based DDoS attacks in Named data networking (MISDN). The security effectiveness of the proposed SEND-DL is 6.18%, 20.06%, and 9.62% higher than the existing Q-ICAN, DFORS-CSA, and MISDN methods respectively. [ABSTRACT FROM AUTHOR]

With the growth in services supplied over the internet, network infrastructure has become more exposed to cyber-attacks, particularly Distributed Denial of Service (DDoS) attacks, which can easily cause the disruption of services. The key factor for fighting against these attacks is the earlier separation and detection of the traffic in networks. In this paper, a novel approach, named Half Autoencoder-Stacked DNNs (HAE-SDNN) model, is proposed. We suggest using a Stacked Deep Neural Networks (SDNN) model. as a deep learning model, in order to detect DDoS attacks. Our approach allows feature selection from a preprocessed dataset using a Half AutoEncoder (HAE), resulting in a final set of important features. These features are subsequently used to train the DNNs that are stacked together by applying Softmax layer to combine their outputs. Experiments were performed on a benchmark cybersecurity dataset, named CICDDoS2017, containing various DDoS attack types. The experimental results demonstrate that the introduced model attained an overall accuracy rate of 99.95%. Moreover, the HAE-SDNN model outperformed existing models, highlighting its superiority in accurately classifying attacks. [ABSTRACT FROM AUTHOR]

Wireless sensor networks (WSNs) are widely acknowledged for their potential as a robust infrastructure for collecting, processing, and transmitting information. Rezaeipour & Barati proposed a hierarchical key management scheme that manages key creation, distribution, and maintenance to provide services like message confidentiality, integrity, and authenticity to wireless sensor networks. As per the assertions posited by the authors, their scheme purportedly exhibits resilience against a spectrum of potential threats. Nevertheless, upon subjecting their scheme to meticulous scrutiny, our analysis revealed vulnerabilities to manifold adversarial strategies, notably including man-in-the-middle attacks, replay attacks, impersonation attacks, and node capture attacks. This scheme fails to establish a secure session key agreement also. In response to these identified shortcomings, this research devised an "Improved Hierarchical Key Management" (IHKM) Scheme aimed at rectifying the deficiencies of Rezaeipour and Barati's scheme (RB scheme). This work proposed an enhanced key management scheme that utilizes a blend of symmetric and asymmetric key cryptography to enhance the security parameters of Hierarchical WSNs. A comprehensive security analysis of the proposed work shows that the IHKM scheme is secure against impersonation attacks, man-in-the-middle attacks, replay attacks node capture attacks, Denial-of-Service attacks, and base station bypassing attacks while establishing the mutual key agreement between the area managers and sensor nodes. Moreover, a comparative analysis of the IHKM scheme exhibits notable reductions in energy consumption (62.27% and 49.15%) and memory utilization (39.28%, 23.36%) when compared with the RB scheme and HISCOM schemes respectively. Simultaneously, IHKM contributes to the extension of the network's overall lifespan by 48.78% as compared to HISCOM scheme and 32.63% as compared to compared with the RB scheme, thereby enhancing the efficiency and longevity of the WSN infrastructure. [ABSTRACT FROM AUTHOR]

Accelerated growth in networking and semiconductor devices led to the increase of Internet-connected devices over recent years. The applications of IoT provide pervasive admittance, scalability, and distribution of data using the cloud for the storage and processing of data. All the actors involved in the grid affect the trust. Managing security and deploying it throughout the IoT environment is required to audit and protect sensitive data. Security management involves authentication to avoid unauthorized entry and encryption at transmission. Though there are standard methodologies employed in data protection in the cloud and network layers, there is a requirement for solutions with low foot-prints suitable for constrained IoT devices. While there are existing lightweight cipher designs performing well with less memory footprint, the performance in the cloud is less compared to traditional cipher techniques. So, a balanced solution with less memory footprint and resistance against various attacks in the cloud environment is required. A lightweight cipher design is proposed to enable secure communication among devices through the cloud, which is combined with Elliptic Light (ELLI) and an Authentication Function (AF) is proposed using RC4 to ensure integrity and authentication and exchange secret key. The cipher design proposed provides increased efficiency and fixes the weakness in standard lightweight algorithms. This algorithm is simple and efficient, with 60% less memory utilization and 53% less execution time than other lightweight solutions. The stability is high in linear and differential cryptanalysis and resistive against DDoS attacks. [ABSTRACT FROM AUTHOR]

Summary: Among the recent network security issues, Distributed Denial of Service (DDoS) attack is one of the most dangerous threats in today's cyberspace that can disrupt essential services. These attacks compromise network security by flooding the target with malicious traffic. Several researchers have designed effective DDoS detection mechanisms using machine learning (ML) and deep learning (DL)‐based techniques. However, existing detection approaches paid less attention to issues such as class imbalance, multi‐classification, or computational cost of the models, especially time. In this study, we propose a novel framework for detecting and classifying DDoS attacks with high accuracy and low computational cost. To address the class imbalance, we employ random sampling, while feature selection techniques such as low information gain, quasi‐constant elimination, and principal component analysis are utilized for optimal feature selection and reduction. Our proposed CNN‐based model achieves outstanding performance, boasting an accuracy of 99.99% for binary classification and 98.44% for multi‐classification. The proposed model is compared to existing works and baseline line models and found to be effective in binary and multi‐classification. [ABSTRACT FROM AUTHOR]

In this article, the consensus problem for disturbed multi‐agent systems (MASs) under independent denial‐of‐service (DoS) attacks is investigated. The concerned attacks can jam different channels independently, resulting in a time‐varying and unknown network topology. In this situation, a dynamic event‐triggered control scheme with a hybrid communication strategy is presented to schedule information interaction over the network, and a distributed prediction‐based control algorithm is proposed to ameliorate the resilience. The system stability is proved in present of DoS attacks by introducing the decay rates of Lyapunov functions associated with different connectivity modes. In comparison with the most existing MASs studies under DoS attacks, the triggering mechanism that possibly subject to the malicious attacks executed at the triggering times is protected by the proposed randomized transmission protocol, and the tolerable attack intensities are quantified. Finally, simulations are presented to substantiate that the proposed strategy is effective. [ABSTRACT FROM AUTHOR]

Microgrids (MGs) are the new paradigm of decentralized networks of renewable energy sources, loads, and storage devices that can operate independently or in coordination with the primary grid, incorporating significant flexibility and supply reliability. To increase reliability, traditional individual MGs can be replaced by networked microgrids (NMGs), which are more dependable. However, when it comes to operation and control, they also pose challenges for cyber security and communication reliability. Denial of service (DoS) is a common danger to DC microgrids with advanced controllers that rely on active information exchanges and has been recorded as the most frequent cause of cyber incidents. It can disrupt data transmission, leading to ineffective control and system instability. This paper proposes digital twin (DT) technology as an integrated solution, with new, advanced analytics technology using machine learning and artificial intelligence to provide simulation capabilities to predict and estimate future states. By twinning the cyber-physical dynamics of NMGs using data-driven models, DoS attacks targeting cyber-layer agents will be detected and mitigated. A long short-term memory (LSTM) model data-driven digital twin approach for DoS attack detection and mitigation is implemented, tested, and evaluated. [ABSTRACT FROM AUTHOR]

Summary In this paper, a prescribed performance model‐free adaptive platooning sliding mode control (PP‐MFAP‐SMC) problem for the nonlinear vehicular platooning systems (VPSs) under denial‐of‐service (DoS) attacks is studied. Firstly, the partial form dynamic linearization (PFDL) technique is employed to convert the nonlinear VPSs into an equivalent linear data model, in which the nonlinear features of the VPSs are compressed into an unknown time‐varying pseudo gradient (PG) vector. Then, an observer is devised to acquire the estimation value of the unknown time‐varying PG vector. To lower the complication of the design, the constrained tracking error is converted into the unconstrained one. Based on which, the sliding mode control (SMC) strategy is proposed to enhance the robustness of the VPSs. Further, a PP‐MFAP‐SMC algorithm with an attack compensation mechanism is developed to ensure that the vehicular tracking errors of the position and velocity can converge to the predefined regions, respectively. Eventually, the effectiveness of the developed algorithm is demonstrated by an actual VPS with the comparisons. [ABSTRACT FROM AUTHOR]

Cloud computing has gained immense popularity for delivering computing resources over the internet, enabling organizations to efficiently and cost-effectively store, process, and access data from any location worldwide. However, the security of data stored and processed outside of the organization's premises has raised concerns. In order to address the changing threat landscape and guarantee the integrity and confidentiality of data in the cloud environment, we address the latest developments and best practices in cloud security in this article, which delves into the complex world of security threats and related countermeasures for cloud computing in the contemporary era of digital transformation. Offered a thorough examination of cloud computing security risks and solutions in the age of digital transformation. The paper defines cloud computing, explores its advantages and disadvantages, identifies major security threats in cloud computing, including data breaches, insider threats, and denial-of-service attacks, and discusses the countermeasures that can be implemented to mitigate these threats. The most popular cryptographic algorithms in cloud computing environments as part of their defense are presented. Special emphasis is given on the mode of operation of these algorithms is presented so that we can choose the appropriate one in each situation. Finally, access control and monitoring are presented in order to have a thorough understanding of protection methods in cloud computing environments. [ABSTRACT FROM AUTHOR]

With advancements in communication systems and measurement technologies, smart grids have become more observable and controllable, evolving into cyberphysical-power systems (CPPS). The impact of network security and secondary equipment on power system stability has become more evident. To support the existing grid toward a smart grid scenario, smart metering plays a vital role at the customer end side. Cyber-Physical systems are vulnerable to cyber-attacks and various techniques have been evolved to detect a cyber attack in the smart grid. Weighted trust-based models are suggested as one of the most effective security mechanisms. A hardware-in-loop CPPS co-simulation platform is established to facilitate the theoretical study of CPPS and the formulation of grid operation strategies. This paper examines current co-simulation platform schemes and highlights the necessity for a real-time hard-ware-in-the-loop platform to accurately simulate cyber-attack processes. This consideration takes into account the fundamental differences in modeling between power and communication systems. The architecture of the co-simulation platform based on RT-LAB and OPNET is described, including detailed modeling of the power system, communication system, and security and stability control devices. Additionally, an analysis of the latency of the co-simulation is provided. The paper focuses on modeling and implementing methods for addressing DDOS attacks and man-in-the-middle at-tacks in the communication network. The results from simulating a 7-bus system show the effectiveness and rationality of the co-simulation platform that has been designed. [ABSTRACT FROM AUTHOR]

This paper explores the group consensus problem of second-order multi-agent systems (MAS) under asynchronous denial-of-service (DoS) attacks. Asynchronous DoS attacks involve the interruption of certain communication links, allowing the MAS to be reimagined as a switching system with a persistent dwell time (PDT). The agents in each group can be divided into three types, which are inter-act agents, intra-act agents with zero in-degree, and other agents. Then, according to the properties of the different agents, suitable agents are pinned. By leveraging the concepts of switching topology and the PDT, a suitable event-triggered control protocol is designed, along with the establishment of conditions to ensure the group consensus of the MAS. Moreover, through the construction of topology-dependent Lyapunov functions, the achievement of group consensus within the MAS under asynchronous DoS attacks is demonstrated. Subsequently, a numerical example is presented to validate the effectiveness of the proposed results. [ABSTRACT FROM AUTHOR]

Software-defined networks (SDNs) have been growing rapidly due to their ability to provide an efficient network management approach compared to traditional methods. However, one of the major challenges facing SDNs is the threat of Distributed Denial of Service (DDoS) attacks, which can severely impact network availability. Detecting and mitigating such attacks is challenging, given the constantly evolving range of attack techniques. In this paper, a novel hybrid approach is proposed that combines statistical methods with machine-learning capabilities to address the detection and mitigation of DDoS attacks in SDN environments. The statistical phase of the approach utilizes an entropy-based detection mechanism, while the machine-learning phase employs a clustering mechanism to analyze the impact of active users on the entropy of the system. The k-means algorithm is used for clustering. The proposed approach was experimentally evaluated using three modern datasets, namely, CIC-IDS2017, CSE-CIC-2018, and CICIDS2019. The results demonstrate the effectiveness of the system in detecting and blocking sudden and rapid attacks, highlighting the potential of the proposed approach to significantly enhance security against DDoS attacks in SDN environments. [ABSTRACT FROM AUTHOR]

This article investigates the bipartite secure consensus of the second‐order leader‐follower multi‐agent systems (MASs) against aperiodic denial of service (DoS) attacks. First, a new dynamic event‐triggered strategy is proposed for the consensus control. Compared with the static event‐triggered strategy, the dynamic event‐triggered protocol can reduce the trigger times and save resources by introducing an internal dynamic variable. Different from the secure consensus results which only discussed the cooperative links, based on the theory of the structurally balanced graph, this article considers cooperative and antagonistic interactions among agents simultaneously for complex behaviors of them. Besides, the characteristics of the DoS attacks are analyzed in detail and the secure consensus is achieved by utilizing the Lyapunov theory and inductive methods. Finally, the Zeno behavior is excluded and the availability of the designed algorithms is demonstrated by numerical simulations. [ABSTRACT FROM AUTHOR]

Advances in connectivity, communication, computation, and algorithms are driving a revolution that will bring economic and social benefits through smart technologies of the Industry 4.0 era. At the same time, attackers are targeting this expanded cyberspace to exploit it. Therefore, many cyberattacks are reported each year at an increasing rate. Traditional security devices such as firewalls, intrusion detection systems (IDSs), intrusion prevention systems (IPSs), anti-viruses, and the like, often cannot detect sophisticated cyberattacks. The security information and event management (SIEM) system has proven to be a very effective security tool for detecting and mitigating such cyberattacks. A SIEM system provides a holistic view of the security status of a corporate network by analyzing log data from various network devices. The correlation engine is the most important module of the SIEM system. In this study, we propose the optimized correlator (OC), a novel correlation engine that replaces the traditional regex matching sub-module with a novel high-performance multiple regex matching library called "Hyperscan" for parallel log data scanning to improve the performance of the SIEM system. Log files of 102 MB, 256 MB, 512 MB, and 1024 MB, generated from log data received from various devices in the network, are input into the OC and simple event correlator (SEC) for applying correlation rules. The results indicate that OC is 21 times faster than SEC in real-time response and 2.5 times more efficient in execution time. Furthermore, OC can detect multi-layered attacks successfully. [ABSTRACT FROM AUTHOR]

In this article, the asynchronous control problem of switched linear systems with all unstable modes under denial‐of‐service (DoS) attacks is studied. First, the upper bound of the sampling period, which can be easily calculated based on the scenario where all modes are unstable, is obtained under a periodic sampling control strategy. Second, by constructing an appropriate discrete multiple linear quadratic Lyapunov function, an asynchronous control scheme in the form of linear matrix inequalities is devised. To ensure the stability of switched systems under DoS attacks, a sufficient condition for the total duration and frequency of DoS attacks is established. It is shown that the switched system can tolerate DoS attacks up to a certain limit while maintaining exponential stability, and this result is applicable even when all subsystems are unstable. Finally, numerical examples and a comparative study are presented to demonstrate the effectiveness of the proposed method. [ABSTRACT FROM AUTHOR]

In order to facilitate communication, wireless networks are built from a collection of nodes that may be either static or dynamic. They are acquiring a lot of popularity in the area of research due to the fact that they are ad hoc in nature, and the number of users of mobile devices is rising day by day. Because of the ease with which these networks may be deployed in challenging and unsupervised rural places, the exchange of information has been a reality since the invention of these networks. Mobile ad hoc networks are simple to set up because of the properties that allow for self-organization and the fact that the medium is wireless. A lack of centralized fixed infrastructure, flexibility to frequent change in topologies, and other features like these are some of the other things that draw people's attention to wireless networks. Wireless networks are vulnerable to a wide range of assaults since their nodes are able to move around and their topologies are constantly changing. In addition, MANET operates in an environment that is both open and dynamic, which leaves it subject to a variety of threats from other types of network assaults. Routing protocols are almost always the target of one form or another of the same general category of attacks. Eavesdropping, causing damage, changing routing information, deleting routing information, manipulating information, advertising phoney routes, and misrouting information are all potential components of these assaults. The circumstances may make it difficult to maintain confidentiality in any communications. There are many different kinds of assaults, and each one may damage wireless networks on a different tier of the communication stack and bring the performance of the network down. Eavesdropping, jamming, traffic analysis and monitoring, denial of service attacks, grey hole attacks, black hole attacks, and wormhole assaults are a few examples of the many sorts of attacks that fall under this category. Ad-hoc networks are more susceptible to security breaches than traditional wired and wireless networks due to the usage of open wireless medium, dynamic topology, and dispersed and cooperative channel sharing. The wormhole attack on dispersed wireless networks is being described here by the person who conducted this study. Because this assault is so potent, it is very difficult to identify it before it has ever been launched. The invader may simply initiate it without having knowledge of the network or compromising any authorized nodes, which is a need for launching it. During a wormhole attack, a malicious node in one part of the network takes control of the packets and tunnels them to another hostile node in a different part of the network, which then repeats the packets locally. The thesis aims to do two things at the same time: (a) To simulate a variety of possible wormhole assaults on the MANET network (b) To investigate the functionality and efficiency of the proposed secure routing protocol within the context of these simulated attacks on the network. [ABSTRACT FROM AUTHOR]

Anomaly detection in industrial control and cyber-physical systems has gained much attention over the past years due to the increasing modernisation and exposure of industrial environments. Current dangers to the connected industry include the theft of industrial intellectual property, denial of service, or the compromise of cloud components; all of which might result in a cyber-attack across the operational network. However, most scientific work employs device logs, which necessitate substantial understanding and preprocessing before they can be used in anomaly detection. In this paper, we propose a network intrusion detection system (NIDS) architecture based on a deep autoencoder trained on network flow data, which has the advantage of not requiring prior knowledge of the network topology or its underlying architecture. Experimental results show that the proposed model can detect anomalies, caused by distributed denial of service attacks, providing a high detection rate and low false alarms, outperforming the state-of-the-art and a baseline model in an unsupervised learning environment. Furthermore, the deep autoencoder model can detect abnormal behaviour in legitimate devices after an attack. We also demonstrate the suitability of the proposed NIDS in a real industrial plant from the alimentary sector, analysing the false positive rate and the viability of the data generation, filtering and preprocessing procedure for a near real time scenario. The suggested NIDS architecture is a low-cost solution that uses only fifteen network-based features, requires minimal processing, operates in unsupervised mode, and is straightforward to deploy in real-world scenarios. [ABSTRACT FROM AUTHOR]

Vehicular ad hoc network (VANET) is one of the challenging research areas in recent times with applications to intelligent traffic systems. In VANET, the link between vehicles going in opposite directions only lasts for a very short time when they are within range of each other, otherwise lost, hindering the complete exchange of meaningful information. Most valuable applications on VANET are related to safety-related applications that require real-time response. If the safety and the real-time requirements are not met, serious consequences may result in the form of traffic accidents or failed rescue operations. Flooding attacks on route request packet (RREQ) disrupt the communication between parties, reduce the successful packet delivery rate, and introduce excessive packet transmission delays. This type of attacks, when executed over VANET, may result in disastrous consequences for critical applications such as collision warning or autonomous vehicle assistance. Many security solutions have been proposed; however, they all have several limitations: either they fail to recognise malicious nodes when they attack with low frequency rates, or they suffer performance degradation because of the burden of add-on security measures by the solutions even when malicious nodes are not present in the environment. This paper proposes a Median Filter based flooding attacks detection algorithm (MFFDA) that enables efficient and reliable operation on VANET. The MFFDA solution is novel in three aspects: (1) it uses a route discovery frequency vector (V) to capture a node's behavioral history; (2) it uses a nonlinear mapping to transform the representational space V into a new space VMF through the use of a Median Filter; (3) it utilises a robust statistic-the median value (mv)—of the data sample V and a suitable separating hyperplane to detect malicious nodes. The paper also proposes the Flooding Attacks Prevention and Detection Routing Protocol (FAPDRP), that incorporates the proposed MFFDA for routing protection. Using NS2, the paper simulated the FAPDRP and related protocols in both attacked and normal network scenarios. The results show that the proposed solution has an accuracy over 98.5% under the minimal flooding attacks 10 pkt/s, outperforms those of previous studies. In addition, the performance of FAPDRP approaches that of the AODV in both attacked and normal network scenarios. This confirms that the proposed MFFDA satisfies the delay, efficiency, and reliability constraints for VANET environment. [ABSTRACT FROM AUTHOR]

In the world of connected devices, there is huge growth of less secure Internet of Things (IoT) devices, and the ease of performing sophisticated cyberattacks using these devices has posed a serious threat to the security of Internet-based services or networks. Distributed Denial of Service (DDoS) attack is one of the most significant cyberattacks. It aims to damage or exhaust victims' resources, services, or networks and make them unavailable to legitimate users. Several solutions are available in the literature to detect DDoS attacks. However, it is difficult to detect them in real-time due to today's high speed or high volume of attack traffic. Therefore, this paper proposes an Apache Storm-based distributed detection approach for IoT network traffic-based DDoS attacks, namely SDDA-IoT. SDDA-IoT is composed of two primary modules: model development and model deployment. In the case of model development, we created five distributed detection models by utilizing a Hadoop cluster and the extremely scalable H2O.ai machine learning platform. In the case of model deployment, we deploy an efficient distributed detection model on the Apache Storm stream processing framework for analyzing ingress streaming data and classifying it into seven classes in near-real-time. To create new models or update existing ones, this module also saves the highly discriminating input features of each network flow along with the predicted outcome in the Hadoop Distributed File System (HDFS). The effectiveness of the SDDA-IoT approach has been examined using a variety of configured scenarios. The experimental results show that the SDDA-IoT approach detects DDoS attacks faster than recent state-of-the-art methods and more accurately with 99%+ accuracy. [ABSTRACT FROM AUTHOR]

This study's main goal is to provide a novel assault detection model with two phases. The features such node, distribution, pattern, frequency, and run time are extracted in the first phase. The Deep Convolutional Neural Network (CNN) is then used to detect cache pollution attacks (also known as content poisoning attacks), which include interest flooding for existing data, interest flooding for non-existing data, hijacking incoming interest packets, and signing data with the incorrect key. Similar to the first phase, the second phase involves extracting the aforementioned attributes and feeding them into a fuzzy decision tree (FDT) in order to identify an interest flooding attack. For accurate attack detection, this paper aims to optimise both DCNN and FDT classifiers. This work provided a fresh Decision Oriented Rider Optimisation Algorithm (DO-ROA), an enhancement of the traditional ROA, to address the optimisation problem. With regard to specific Type I and Type II performance measures, the suggested DO-ROA algorithm's performance is compared to that of other traditional models, demonstrating the superiority of the presented work. [ABSTRACT FROM AUTHOR]

This article proposes a novel approach for designing a mode‐dependent H∞$\mathcal {H}_\infty$ full‐order dynamic filter for a cyber‐physical system (CPS) that is subject to polytopic uncertainties. The CPS operates on an unreliable network that is susceptible to transmission failures and Denial of Service (DoS) attacks. The attackers have limited energy resources, and the duration of the DoS attack is limited to a maximum number of consecutive time instants. The network is modeled after a proposed non‐homogeneous Markov chain whose transition probability matrix may feature uncertain and unknown probabilities, which are dependent on time‐varying parameters. The design conditions for the filter are obtained using parameter‐dependent linear matrix inequalities. The proposed filter is shown to be effective in reducing the impact of DoS attacks and transmission failures on the CPS. Numerical experiments are presented to illustrate the efficacy of the proposed filter design method, demonstrating its ability to mitigate the effects of uncertainties and attacks on the CPS. [ABSTRACT FROM AUTHOR]

The induced attack on the formation control of multiagent systems is investigated from the perspective of the attacker, where a new induced attack strategy is proposed to drive the whole formation of multiagent systems to the prescribed reference trajectory. Compared with denial‐of‐service attacks and deception attacks, a desired formation reference trajectory with the stable formation structure is reached by the induced attack instead of disrupting the whole formation. First, the induced attack signal is produced by designing an attack generation exosystem, whose dynamics can be described by the regulated attack matrix and can be adjusted to generate the prescribed reference trajectory. Then, based on the local state information, the formation vector, and the induced attack signal among partial agents, a new distributed induced attack formation protocol is proposed, which is composed of the nominal formation term and the induced attack term. Meanwhile, the induced attack design criterion is proposed by utilizing a robust H∞$$ {H}_{\infty } $$ scheme, where the robust H∞$$ {H}_{\infty } $$ performance bound can be configured by two performance regulating parameters and can be used to design the appropriate regulated attack matrix. Furthermore, by establishing the projection of the induced attack signal onto the formation agreement subspace, an explicit expression of the prescribed reference trajectory is determined, which depicts the movement trajectory of the entire formation of the multiagent system under the induced attack. Finally, a simulation is provided to vindicate the effectiveness of theoretical results. [ABSTRACT FROM AUTHOR]

This article focuses on fixed‐time consensus of networked Euler–Lagrange systems (NELSs) over event‐based communication under denial‐of‐service (DoS) attacks. First of all, a basic fixed‐time consensus algorithm is developed for NELSs, where a general fixed‐time communication triggering scheme through error decomposition method is designed for decreasing communication frequencies while avoiding singularity. Then, to fulfil the consensus problem of NELSs in the presence of DoS attacks, a novel fixed‐time resilient algorithm is further presented by the basic algorithm, where the effective attack interval is redefined for carrying out the algorithm design. Furthermore, a hierarchical fixed‐time control framework with privacy preservation is introduced for the consensus problem of NELSs under DoS attacks. Meanwhile, a self‐triggered scheme is employed for the above algorithms to lower the update frequencies of control inputs. The stated algorithms possess a uniformly constrained upper bound on the convergence time, and are resilient as well as responsive to DOS attacks while saving control resources significantly. Finally, numerous illustrative examples are given for demonstrating the efficacy of the derived schemes. [ABSTRACT FROM AUTHOR]

This paper is concerned with the secure output consensus problem for the heterogeneous multi-agent systems under the event-triggered scheme in the presence of the denial-of-service attack. Without detecting the attack, the hold-input controller update strategy is adopted when some transmission data may be lost due to the effect of the attack. Based on the tolerable duration of the attack, a novel edge-based event-triggered scheme is developed. The scheme can avoid continuous communication and exclude Zeno behavior. With the aid of the switched system theory, output consensus is preserved. An example shows the effectiveness. • Secure problem for the heterogeneous multi-agent systems is solved in the presence of the denial-of-service attack. • A novel edge-based event-triggered scheme is developed based on the tolerable duration of the attack. • Without detecting the attack, the hold-input controller update strategy is adopted. • Output consensus is preserved with the aid of the switched system theory. [ABSTRACT FROM AUTHOR]

In the contemporary environment, mobile ad hoc networks (MANETs) have become necessary. They are absolutely vital in a variety of situations, where setting up a network quickly is required; however, this is infeasible due to low resources. Ad hoc networks have many applications: education, on the front lines of battle, rescue missions, etc. These networks are distinguished by high mobility and constrained computing, storage, and energy capabilities. The main aim of this research is to create a method for identifying blackhole attacks through anomaly detection techniques utilizing Support Vector Machines (SVM). Our detection system looks at node activity to scan network traffic for irregularities. In blackhole scenarios, the attackers exhibit distinct behavioral characteristics that distinguish them from other nodes. This can be efficiently detected by the proposed SVM-based detection system. The proposed detection system is designed to analyze network traffic and identify anomalies by examining node behaviors. Specifically, in the context of blackhole threats, it distinguishes the attackers from normal nodes based on behavioral characteristics. Using this approach, the system effectively detects blackhole attacks. The results demonstrate a very high level of accuracy in detecting blackhole attacks, confirming its efficacy in ensuring the security of mobile ad hoc networks (MANETs) by identifying and isolating malicious nodes. This solution is particularly valuable in scenarios like military operations and disaster management where a reliable communication system is crucial. Furthermore, the proposed detection method, ADS-SVM, was compared to two other methods (J48 classifier and NB classifier) from different researchers. The results indicate that ADS-SVM outperforms the other methods with a detection accuracy of 99.96%, surpassing the 99.2% achieved by J48 classifier and the 96.5% achieved by NB classifier. The results indicate that ADS-SVM is a highly efficient approach for identifying blackhole attacks in MANETs, potentially offering superior accuracy compared to other related methods. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) represents the backbone of current and future technologies. The main objective of IoT is to make human life easier by automating most daily jobs. The endless web of connections entices opponents to utilize the IoT's weaknesses. For that reason, this technological innovation faces a few serious safety and confidentiality problems. These problems are the actual motivation of this research. This paper reviews the latest research and possible types of attacks that can affect IoT systems including the exploration of IoT infrastructure. Various cybersecurity threats, including network, application, and physical attacks, that aim to compromise the IoT are discussed. Moreover, regarding attack types, we performed a statistical analysis using Excel for the percentage of most attacks and found that DDoS is the most common with 21%. In addition, by comparing Deep Learning (DL) accuracy measures with traditional methods, DL methods achieved an accuracy of more than 98%, so they are better and more effective in detecting and classifying the attack types due to their high accuracy. However, rarely do researchers focus on computational complexity. Finally, the paper highlights some statistics using Python language on the negative impact of attacks on network traffic. [ABSTRACT FROM AUTHOR]

The development of new technologies has significantly enhanced the monitoring and analysis of network traffic. Modern solutions like the Extended Berkeley Packet Filter (eBPF) demonstrate a clear advancement over traditional techniques, allowing for more customized and efficient filtering. These technologies are crucial for influencing system performance as they operate at the lowest layer of the operating system, such as the kernel. Network-based Intrusion Detection/Prevention Systems (IDPS), including Snort, Suricata, and Bro, passively monitor network traffic from terminal access points. However, most IDPS are signature-based and face challenges on large networks, where the drop rate increases due to limitations in capturing and processing packets. High throughput leads to overheads, causing IDPS buffers to drop packets, which can pose serious threats to network security. Typically, IDPS are targeted by volumetric and multi-vector attacks that overload the network beyond the reception and processing capacity of IDPS, resulting in packet loss due to buffer overflows. To address this issue, the proposed solution, iKern, utilizes eBPF and Virtual Network Functions (VNF) to examine and filter packets at the kernel level before forwarding them to user space. Packet stream inspection is performed within the iKern Engine at the kernel level to detect and mitigate volumetric floods and multi-vector attacks. The iKern detection engine, operating within the Linux kernel, is powered by eBPF bytecode injected from user space. This system effectively handles volumetric Distributed Denial of Service (DDoS) attacks. Real-time implementation of this scheme has been tested on a 1Gbps network and shows significant detection and reduction capabilities against volumetric and multi-vector floods. [ABSTRACT FROM AUTHOR]

Computer network security represents a major challenge in the digital age, where intrusions threaten data confidentiality, accuracy and accessibility. To safeguard data and online services, Intrusion Detection Systems (IDS) controls the network traffic for any signs of malicious activity. The integration of artificial intelligence into IDSs offers new perspectives, but poses challenges, particularly in terms of feature selection and data imbalance management. Our research focused on identifying DDoS attacks, a major threat to the accessibility of online services. We evaluated the effectiveness of IDS against these attacks by testing the RF, XGB, SGD, LGB and MLP machine learning models on the CICIDS2018 DDOS attacks dataset. To optimize data quality, we adopted a strategic feature selection approach based on correlation matrix, mutual information and feature importance, reducing data dimensionality and improving model performance. Then, by balancing our dataset using oversampling techniques such as SMOTE, BorderlineSMOTE and ADASYN, we achieved better model generalization and reduced false positives. Our results showed that the ADASYN+SMOTE+XGB configuration was the most optimal for DDoS attack detection regarding effectiveness, false positives and execution duration. Our approach, combining judicious feature selection and resampling, has enabled us to create more performing intrusion detection systems, strengthening network security against increasingly sophisticated threats. [ABSTRACT FROM AUTHOR]