Search

Software Defined Networking (SDN) is a paradigm shift in the network industry with decoupling of control and data plane. This helps network engineers to control and manage their network from centralized controller and troubleshoot the network at much better pace. With the benefits that SDN provides, it also has some vulnerable to attacks like Distributed Denial of Service (DDoS) that can disrupt the availability of the network. Most of the recent research work in DDoS detection and mitigation is done over Traditional network environments and packet limit strategy is used for mitigation by researchers with very less focus on redirection of illegitimate traffic which can result in less downtime and helpful in network analysis. The major contribution of this paper is detection and mitigation of DDoS in Software Defined Networks. We have created our own DDoS dataset with over 1.7 million entries. For Detection, we have used two different methods: (1) Snort (IDS) and (2) Machine Learning. In Machine Learning, we have used eight different Machine Learning algorithms that also include Ensemble Classifier and a Hybrid method of SVM-RF. We were able to get 99.1% accuracy which is a substantial growth as compared to recent works. For Mitigation, we have again used two methods: (1) Drop illegitimate traffic and (2) Redirect Illegitimate traffic. Results showed that hybrid SVM-RF algorithm works better as compared to individual Machine Learning algorithms and also as mitigation depends on Detection accuracy, so, the better the detection, the better the mitigation. In this paper detection and mitigation of DDoS has been performed over a SDN network. In which We have created our own dataset with over 1.7 million entries. For detection we have used two method: Snort (IDS), and Machine Learning and for Mitigation, Drop illegitimate traffic, and Redirect Illegitimate traffic. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) has emerged as an inevitable part of human life, that includes online learning, smart homes, smart cars, smart grids, smart cities, agriculture, and e-healthcare. It allows us to operate them 24/7 from anywhere. These smart IoT devices streamline our daily lives by automating everything around us. Several security issues have arisen with the continuous growth of non-secure IoT devices. Distributed Denial of Service (DDoS) attack is one of the most prominent security threats to Internet-based services and IoT platforms. It has the potential to break down the victim's server or network by transferring an immense amount of irrelevant traffic from the pool of compromised IoT devices. In this article, we present: (i) A comprehensive cyberattacks taxonomy for IoT platforms, (ii) Systematically demonstrate IoT technology: evolution, applications, and challenges, (iv) Systematic review of existing machine learning (ML) and deep learning (DL)-based detection approaches for large-scale IoT traffic-based DDoS attacks, (v) Characterize publicly available IoT-traffic-specific datasets, and (vi) Discuss various open research issues with possible solutions for detecting IoT traffic-based DDoS attacks, including future directions. [ABSTRACT FROM AUTHOR]

Software-defined networking will be a critical component of the networking domain as it transitions from a standard networking design to an automation network. To meet the needs of the current scenario, this architecture redesign becomes mandatory. Besides, machine learning (ML) and deep learning (DL) techniques provide a significant solution in network attack detection, traffic classification, etc. The DDoS attack is still wreaking havoc. Previous work for DDoS attack detection in SDN has not yielded significant results, so the author has used the most recent deep learning technique to detect the attacks. In this paper, we aim to classify the network traffic into normal and malicious classes based on features in the available dataset by using various deep learning techniques. TCP, UDP, and ICMP traffic are considered normal; however, malicious traffic includes TCP Syn Attack, UDP Flood, and ICMP Flood, all of which are DDoS attack traffic. The major contribution of this paper is the identification of novel features for DDoS attack detection. Novel features are logged into the CSV file to create the dataset, and machine learning algorithms are trained on the created SDN dataset. Various work which has already been done for DDoS attack detection either used a non-SDN dataset or the research data is not made public. A novel hybrid machine learning model is utilized to perform the classification. The dataset used by the ML/DL algorithms is a collection of public datasets on DDoS attacks as well as an experimental DDoS dataset generated by us and publicly available on the Mendeley Data repository. A Python application performs the classification of traffic into one of the classes. From the various classifiers used, the accuracy score of 99.75% is achieved with Stacked Auto-Encoder Multi-layer Perceptron (SAE-MLP). To measure the effectiveness of the SDN-DDoS dataset, the other publicly available datasets are also evaluated against the same deep learning algorithms, and traffic classification accuracy is found to be significantly higher with the SDN-DDoS dataset. The attack detection time of 216.39 s also serve as experimental evidence. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) has shown incredible adaptability in recent years and has become an integral part of human life. The proliferation of IoT technology has made IoT devices more prone to severe security threats, such as Distributed Denial of Service (DDoS) attacks, which are dangerous threats to public systems and networks. Further, the frequency and complexity of IoT traffic-based DDoS attacks are increasing year-by-year. This article proposes an IoT traffic-based DDoS attack detection approach for classifying incoming IoT network traffic into 11 classes using multiclass machine learning techniques. The proposed approach comprises two phases: (i) designing and (ii) detection. In the designing phase, we employ the embedded feature reduction technique to create cost-effective and efficient classification models with a high feature reduction rate. Further, we evaluate these models using the K-fold cross-validation technique. While in the detection phase, we evaluate the performance of an efficient model by executing four different IoT traffic-based scenarios. A publicly available Bot-IoT dataset is employed to design and validate the proposed multiclass classification approach. The results show that the proposed approach provides an 84.4% feature reduction rate and approximately 5.19% higher classification accuracy than the existing approaches. [ABSTRACT FROM AUTHOR]

Software-defined networking (SDN) provides programmability, manageability, flexibility and efficiency compared to traditional networks. These are owing to the SDN's mutual independence or separation of the control and data planes. Decoupling two planes and the centralised nature of SDN enhance DDoS attack protection by facilitating easy implementation of network device policies. The controller's ability to filter network traffic and detect malicious flows is attributed to its global network view. Control and data plane separation brought numerous benefits, but it also introduced a new challenge in terms of its susceptibility to DDoS attack. DDoS attacks are one of the most severe threats to SDN, where the perpetrator disrupts the services of regular users. Machine learning (ML) and deep learning (DL) have emerged as good solutions compared to statistical or policy-based solutions to detect DDoS attack. We have created a detailed taxonomy of DDoS defense solutions. We have surveyed 260 research articles, of which 132 articles are selected based on ML- and/or DL-based solutions to detect DDoS attack in SDN. We discuss the existing works which have applied feature selection algorithms on the dataset to select the best and optimal features for detecting DDoS attack. We present the features of various DDoS datasets available publicly. We also argue for the need to create SDN-specific datasets and then apply feature selection algorithms that may help in better detection of DDoS attack. Finally, we present the research challenges in SDN security that can help the researchers to carry out further research and develop new methods to secure SDN. [ABSTRACT FROM AUTHOR]

In recent years, the Internet of Things (IoT) has gained much popularity, increasing the flow of sensitive user data across the web. In addition, the adoption of fog and edge technologies for latency-sensitive applications aggravates the privacy issues in the scenario as the sensitive data are processed in the user vicinity. Furthermore, the presence of the processing layer near the user end increases the attack surface and thus attracts malicious or curious intruders. In this light, the authors present a stacked-ensemble privacy-preserving attack detection framework, P2ADF. The framework detects the popular man-in-the-middle (MiTM) and denial-of-service (DoS)/distributed DoS (DDoS) attacks in the fog-IoT setup with a maximum accuracy of about 99.98 percent. The proposed model is trained over benchmark datasets, say, IoTID20, TON_IoT, N-BaIoT, UNSW-NB15, and CICDDoS19. The performance of the proposed model is also compared to existing state-of-the-art approaches, and P2ADF outperforms them all. [ABSTRACT FROM AUTHOR]

Denial-of-service (DoS) attacks conducted on online systems cause the targeted resources to become inoperative. This is caused by the abnormal traffic intentionally directed toward the system resources by the attacker(s). Several techniques can be used to detect and mitigate such attacks, and machine learning (ML) is one of them. Herein, the literature on ML techniques used to address DDoS attacks is systematically reviewed. Five search engines are used to identify relevant studies, the results are filtered based on specific selection criteria, and 48 studies are shortlisted and analyzed. Considerable variations are observed in the literature with respect to the datasets used for training ML models, with more than 20 datasets being used. To conduct performance evaluations, most studies have employed the accuracy metric. More than 30 modeling algorithms have been used to build the ML models. The outcomes of this review reveal the state of the literature and the manner in which the problem of DDoS attacks has been dealt with. Our results can guide future studies toward more constructive methods than the existing ones to address this problem. [ABSTRACT FROM AUTHOR]

Nowadays, the number of Distributed Denial of Service (DDoS) attacks is growing rapidly. The aim of these type of attacks is to make the prominent and critical services unavailable for legitimate users. HTTP flooding is one of the most common DDoS attacks and because of its implementation in application layer, it is difficult to detect and prevent by the current defense mechanisms. This attack not only makes the web servers unavailable, but consumes the computational resources of the network equipment and congests communication links. Recently, the advent of Software Defined Networking (SDN) paradigm has enabled the network providers to detect and mitigate application layer DDoS attacks such as HTTP flooding. In this paper, we propose a defense mechanism named HTTPScout which leverages the benefits of SDN together with Machine Learning (ML) techniques to detect and mitigate HTTP flooding attack. HTTPScout is implemented as a security module in RYU controller and monitors the behavior of HTTP traffic flows. Upon detecting a malicious flow, it blocks the source of the attack at the edge switch and preserves the network resources from the adversarial effects of the attack. Simulation results confirm that HTTPScout brings a significant improvement of 64% in bandwidth consumption and 80% in the number of forwarding rules compared to normal SDN. [ABSTRACT FROM AUTHOR]

Software-defined networks (SDN) offer a centralized administration programming interface to govern the network infrastructure. It overtook conventional networks by creating a configurable link between the control and data planes. As the logic of the SDN environment completely depends on the control plane, the controller is vulnerable to many security attacks. To degrade the network's performance, attackers will saturate the control plane resources. TCP flooding is a serious threat in which attackers restrict legitimate users from accessing the network resources. To handle this problem, we propose a TCP Flooding Attack Detection (TFAD) technique using proxy-based and Machine-Learning-based mechanisms (ML-TFAD). The TFAD technique contains two proxies, SYN and ACK: the former defends against TCP SYN flood attacks and the latter against TCP ACK flood attacks. The ML-TFAD module uses the C4.5 decision tree algorithm, which detects SYN flood attacks before reaching the targeted server. The CAIDA 2007 DDoS dataset is involved in training the proposed model. The proposed mechanisms help remove half-opened connections from the server queue at the earliest to accommodate TCP connection requests from legitimate users. [ABSTRACT FROM AUTHOR]

Nowadays, attackers are constantly targeting the modern aspects of technology and attempting to abuse these technologies using different attacks types such as the distributed denial of service attack (DDoS). Therefore, protecting web services is not an easy task. There is a critical demand to detect and prevent DDoS attacks. This paper introduces a fuzzy inference-based anomaly-based intrusion detection (IDS) system to detect DDoS attacks. The aim of using the fuzzy inference system is to avoid binary decisions and, meanwhile, to avoid the issues associated with the deficiencies of IDS alert system awareness. This benefit could improve the IDS alert system's robustness and effectively produce more readable and understandable IDS alerts. The proposed detection model was applied to a recent open-source DDoS dataset. At the early stage of designing the proposed detection model, the DDoS dataset was preprocessed using the Info-gain features selection algorithm to deal with the relevant features only and reduce the complexity of the fuzzy inference system. The proposed detection model was tested, evaluated, and obtained a 96.25% accuracy rate and a false-positive rate of 0.006%. Moreover, it effectively smoothes the boundaries between normal and DDoS traffic. In addition, the results obtained from the proposed detection model were compared with other literature results. The results indicated that the detection accuracy of this work is competitive with other methods. In addition to this, this work offers more elements of trust in DDoS attack detection by following the strategy to avoid the binary decision and offering the required extension of the binary decision to the continuous space; hence, the attack level could be easily measured. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attacks are among the most severe threats in cyberspace. The existing methods are only designed to decide whether certain types of DDoS attacks are ongoing. As a result, they cannot detect other types of attacks, not to mention the even more challenging mixed DDoS attacks. In this paper, we comprehensively analyzed the characteristics of various types of DDoS attacks and innovatively proposed five new features from heterogeneous packets including entropy rate of IP source flow, entropy rate of flow, entropy of packet size, entropy rate of packet size, and number of ICMP destination unreachable packet to detect not only various types of DDoS attacks, but also the mixture of them. The experimental results show that the proposed fives features ranked at the top compared with other common features in terms of effectiveness. Besides, by using these features, our proposed framework outperforms the existing methods when detecting various DDoS attacks and mixed DDoS attacks. The detection accuracy improvements over the existing methods are between 21% and 53%. [ABSTRACT FROM AUTHOR]

Health monitoring using Body Area Wireless Sensor Network (BA-WSN) has gained immense popularity due to usability, ubiquitous support, and real-time performance. It is a special kind of Wireless Sensor Network (WSN) that spans over the human body. Although BA-WSN is very useful but it may suffer from security and privacy issues due to compromised sensor nodes by intruders. To design a secure BA-WSN based health monitoring system, it is required to filter out malicious data packets generated by the compromised nodes. An intrusion Detection System (IDS) can be utilized for this purpose. This paper presents a Machine Learning based Intrusion Detection System (MLIDS) for BA-WSN based health monitoring framework. Specialized dataset WSN-DS has been used to train the intrusion detection model. Dataset contains four security attacks such as Blackhole attack, Grayhole attack, Scheduling attack, Flooding attack data as well as normal data packets which are simulated using Network Simulator-2. Five well-known classification algorithms such as Random Forest, kNN, SVM, J48, and Naive Bayes have been applied for the selection and generation of the best model in terms of detection accuracy. Experimental results prove that Random Forest based Intrusion Detection Model has the highest classification accuracy of 99.67%, 98.7%, 92.7%, 98.9%, 99.9% for Blackhole attack, Flooding attack, Scheduling attack, Grayhole attack as well normal packet respectively. Experimental results also show that our achieved results outperform relevant work in terms of accuracy. [ABSTRACT FROM AUTHOR]

Communication in the wireless sensor networks could be disturbed by the jammer and this jamming attacks could be identified as a distinctive type of Denial of Service attacks. This might result in the degradation of the network which could be recognized. Due to the jamming signals, the packet transmission might not be proper. These kinds of attacks are destructive in low power and lossy wireless network due to the attributes such as disruption in communication and rapid trench in the batteries. To detect the attack and to perform the secure data transmission, the illegitimate nodes have to be eradicated. Machine learning and deep learning methods are used for network analysis of intrusion detection and security. Hence, the deep learning model is proposed to identify the attacks which result in secured data transmission. Also, the logistic regression is applied to classify the behaviour of the node so that the deviation could be determined. Deep learning is applied so it can adaptively learn the attacks and classify with higher accuracy. It is efficient as it is adaptive in learning and has improved precision. The performance of the model could be proved with simulations by varying the nodes. The secured data transmission could be proved by analysing several metrics such as packet drop rate, normalized routing overhead, and jitter. The packet drop is decreased to 50%, jitter is decreased to 6% and throughput shows a significant increase by 6% when compared with the Dodge-Jam, a lightweight Mitigating Stealthy Jamming Attacks (MJSA) technique. [ABSTRACT FROM AUTHOR]

Despite significant development in distributed denial of service (DDoS) defense systems, the downtime caused by DDoS damages reputation, crushes end-user experience, and leads to considerable revenue loss. Volumetric DDoS attacks are the most common form of DDoS attack and are carried out by an army of infected IoT devices or by reflector servers, which increase attacks at massive scales. In this work, we propose a voting-based multimode framework to combat volumetric DDoS (VMFCVD) attacks. VMFCVD is based on a triad of fast detection mode (FDM), defensive fast detection mode (DFDM), and high accuracy mode (HAM) methods. FDM is designed to classify network traffic when the server is under attack. The highly dimensionally reduced dataset helps FDM accelerate detection speed. During our experiment, the dimension reduction for FDM was more than 97% while maintaining an accuracy of 99.9% in most cases. DFDM is an extended version of FDM that enhances malicious network traffic detection accuracy by tightening the detection technique. HAM focuses on detection accuracy, showing substantial improvement over FDM and DFDM. HAM activates when the server is stable. VMFCVD is extensively experimented on the latest benchmark DDoS and botnet datasets, namely the CICIDS2017 (BoT & DDoS), CSE-CIC-IDS2018 (BoT & DDoS), CICDDoS2019 (DNS, LDAP, SSDP & SYN), DoHBrw2020, NBaIoT2018 (Mirai), UNSW2018 BoTIoT, and UNSW NB15 datasets. The VMFCVD results show that it outperforms recent studies. VMFCVD performs exceptionally well when the server is under DDoS attack. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) has achieved exponential growth worldwide. Although the IoT is used by millions of users, these networks are handicapped by attacks such as denial of service, man in the middle, and spoofing. These attacks threaten the entire IoT ecosystem and affect the integrity and security of the user. Hence, the prediction and identification of novel network attacks in an IoT network remains a challenge for researchers. Recently, machine learning and deep learning have played a pivotal role in predicting and classifying different attacks in an IoT network. However, these algorithms suffer from computational complexity as the number of attacks increases. Hence, a novel hybrid optimized long short-term memory (LSTM) approach is proposed. Whereas a convolutional neural network is used to extract the temporal and spatial correlated features of the IoT network, the optimized LSTM is used to predict the different attacks in the network. Furthermore, firefly swarm optimization is integrated with LSTM to reduce the computational overhead, which in turn increases the prediction accuracy. Nearly 19,00,503 real-time normal and attack data were collected from the experimental simulation setup based on the OMNET++–Python–IoT framework. Extensive experimentation was carried out to evaluate the proposed algorithm, and various metrics, such as accuracy, sensitivity, specificity, and F1-score, were calculated and compared with state-of-the-art learning-based network intrusion detection systems. Furthermore, other benchmarks, such as the CIDCC-15, UNSW-NB15, and NSL-KDD datasets, were used to evaluate the performance of the different deep-learning-based intrusion detection systems. The results demonstrate that the proposed deep-learning method outperforms other classical learning models with low complexity and high prediction performance. [ABSTRACT FROM AUTHOR]

Service availability plays a vital role on computer networks, against which Distributed Denial of Service (DDoS) attacks are an increasingly growing threat each year. Machine learning (ML) is a promising approach widely used for DDoS detection, which obtains satisfactory results for pre-known attacks. However, they are almost incapable of detecting unknown malicious traffic. This paper proposes a novel method combining both supervised and unsupervised algorithms. First, a clustering algorithm separates the anomalous traffic from the normal data using several flow-based features. Then, using certain statistical measures, a classification algorithm is used to label the clusters. Employing a big data processing framework, we evaluate the proposed method by training on the CICIDS2017 dataset and testing on a different set of attacks provided in the more up-to-date CICDDoS2019. The results demonstrate that the Positive Likelihood Ratio (LR+) of our method is approximately 198% higher than the ML classification algorithms. [ABSTRACT FROM AUTHOR]

The fifth generation (5G) networks are characterized with ultra-dense deployment of base stations with limited footprint. Consequently, user equipment's handover frequently as they move within 5G networks. In addition, 5G requirements of ultra-low latencies imply that handovers should be executed swiftly to minimize service disruptions. To preserve security and privacy while at the same time maintaining optimal performance during handovers, numerous schemes have been developed. However, majority of these techniques are either limited to security and privacy or address only performance aspect of the handover mechanism. As such, there is need for a novel handover authentication protocol that addresses security, privacy and performance simultaneously. This paper presents a machine learning protocol that not only facilitates optimal selection of target cell but also upholds both security and privacy during handovers. Formal security analysis using the widely adopted Burrows–Abadi–Needham (BAN) logic shows that the proposed protocol achieves all the six formulated under this proof. As such, the proposed protocol facilitates strong and secure mutual authentication among the communicating entities before generating the shares session key. The derived session key protected the exchanged packets to avert attacks such as forgery. In addition, informal security evaluation of the proposed protocol shows that it offers perfect forward key secrecy, mutual authentication any user anonymity. It is also demonstrated to be robust against attacks such as denial of service (DoS), man-in-the-middle (MitM), masquerade, packet replays and forgery. In terms of performance, simulation results shows that it has lower packets drop rate and ping–pong rate, with higher ratio of packets received compared with improved 5G authentication and key agreement (5G AKA') protocol. Specifically, using 5G AKA' as the basis, the proposed protocol reduces the handover rate by 94.4%, hence the resulting handover signaling is greatly minimized. [ABSTRACT FROM AUTHOR]

While Vehicular Ad-hoc Network (VANET) is developed to enable effective vehicle communication and traffic information exchange, VANET is also vulnerable to different security attacks, such as DOS attacks. The usage of an intrusion detection system (IDS) is one possible solution for preventing attacks in VANET. However, dealing with a large amount of vehicular data that keep growing in the urban environment is still an critical challenge for IDSs. This paper, therefore, proposes a new machine learning model to improve the performance of IDSs by using Random Forest and a posterior detection based on coresets to improve the detection accuracy and increase detection efficiency. The experimental results show that the proposed machine learning model can significantly enhance the detection accuracy compared to classical application of machine learning models. [ABSTRACT FROM AUTHOR]

Distributed denial-of-service attacks are still difficult to handle as per current scenarios. The attack aim is a menace to network security and exhausting the target networks with malicious traffic from multiple sites. Although a plethora of conventional methods have been proposed to detect DDoS attacks, so far the rapid diagnosis of these attacks using feature selection algorithms is a daunting challenge. The proposed system uses a hybrid methodology for selecting features by applying feature selection methods on machine learning classifiers. Feature selections methods, namely chi-square, Extra Tree and ANOVA have been applied on four classifiers Random Forest, Decision Tree, k-Nearest Neighbors and XGBoost for early detection of DDoS attacks on IoT devices. We use the CICDDoS2019 dataset containing comprehensive DDoS attacks to train and assess the proposed methodology in a cloud-based environment (Google Colab). Based on the experimental results, the proposed hybrid methodology provides superior performance with a feature reduction ratio of 82.5% by achieving 98.34% accuracy with ANOVA for XGBoost and helps in early detection of DDoS attacks on IoT devices. [ABSTRACT FROM AUTHOR]

This research presents the detection and mitigation of distributed denial of service (DDoS) in software defined networks (SDN). The proposed method consists of three modules: classifier module, mitigation module, and collaborative module. An ensemble classifier called V-NKDE is capable of detecting DDoS attacks accurately. The mitigation module blocks malicious traffics and purges entries of malicious traffic from the switch flow table. The collaborative module shares DDoS detection and mitigation rules among multiple SDN controllers using Redis Simple Message Queue mechanism. The proposed classifier performance validation on InSDN2020, CICIDS2017, NSL-KDD and UNSW-NB15 datasets. Furthermore we evaluated our proposed classifier in real traffic on an SDN simulation tested. The results show that the proposed method can detect DDoS attacks with high accuracy using an ensemble classifier, which performs better than single classifiers. More importantly, the false positive rate is greatly reduced, showing detection and mitigation of DDoS attacks across multi-controller domains with low controller overhead. [ABSTRACT FROM AUTHOR]

The detection and identification of Distributed Denial-of-Service (DDoS) attacks remains a challenge in cloud/edge/fog computing environments. It usually requires network middleboxes, such as deep packet inspectors (DPI), for detection task mostly. But clouds and fogs have native powerful telemetry systems that are not yet fully exploited for DDoS detection; and provide so much information that could aid attack identification tasks as well. Machine Learning (ML) algorithms can help one diving into the richness of cloud's native data collection services, which have a multitude of metrics from both physical and virtual hosts. This paper evaluates the use of ML algorithms over datasets collected from a experimental testbed based on OpenStack. Controlled attack scenarios were used to investigate the ability of ML for tasks such as detecting and identifying SYN_Flood and GET_Flood DDoS attacks mixed, in different proportions, with legitimate clients. kNN and Random Forest ML algorithms were trained and tested, and for evaluation the metrics accuracy, recall, precision, and F1-score were used. Our experiments presented about 87% of accuracy in the detection of SYN_Flood and GET_Flood DDoS attacks, whereas Snort IDS mostly fails to detect the latter attack by processing the corresponding packet traces. Also, the detection of PING_Flood DDoS attack was tested without training as an initial evaluation towards the generalization of the proposal. [ABSTRACT FROM AUTHOR]

The problem of detecting anomalies in network traffic caused by the distributed denial of service (DDoS) attack so far has mainly been investigated in terms of detection of illegitimate DDoS traffic generated by conventional terminal devices (PCs, laptops, mobile devices, tablets, servers). Technological development has resulted in the emergence of the Internet of Things (IoT) concept, whose implementation implies numerous terminal devices with a low level of implemented protection. The large growth and prediction of future growth is noticeable in the environment of a smart home and smart office. IoT devices in such environments are increasingly being used as a platform for generating DDoS traffic due to its numeracy and low level of protection. The aim of this research is to propose a novel approach for detection of DDoS traffic generated by IoT devices in a form of conceptual network anomaly detection model. Proposed conceptual model is based on device classes which are dependent on individual device traffic characteristics. [ABSTRACT FROM AUTHOR]

The distributed denial-of-service (DDoS) attack is a security challenge for the software-defined network (SDN). The different limitations of the existing DDoS detection methods include the dependency on the network topology, not being able to detect all DDoS attacks, applying outdated and invalid datasets and the need for powerful and costly hardware infrastructure. Applying static thresholds and their dependency on old data in previous periods reduces their flexibility for new attacks and increases the attack detection time. A new method detects DDoS attacks in SDN. This method consists of the three collector, entropy-based and classification sections. The experimental results obtained by applying the UNB-ISCX, CTU-13 and ISOT datasets indicate that this method outperforms its counterparts in terms of accuracy in detecting DDoS attacks in SDN. [ABSTRACT FROM AUTHOR]

In blockchain, transactions between parties are regrouped into blocks, in order to be added to the blockchain's distributed ledger. Miners are nodes of the network that generate new blocks according to the consensus protocol. The miner that adds a valid block to the distributed ledger is rewarded. However, to find a valid block, the miner needs to solve a computationally difficult problem, which makes it difficult to a single miner to gain rewards. Therefore, miners join mining pools, where the powers' of miners are federated to ensure stable revenues. In public blockchains, access to mining pools is not restricted, which makes mining pools vulnerable to considerable threats such as: block withholding (BWH) attacks and distributed denial of service (DDoS) attacks. In the present work, we propose a new reputation based blockchain named PoolCoin based on a distributed trust model for a mining pools. The trust model used by PoolCoin is inspired from the job market signaling model. The proposed PoolChain blockchain allows pool managers the selection of trusted miners in their mining pools, while miners are able to evaluate them. Furthermore, to detect malicious miners that claim bigger computing capacity, we also provided a machine learning module to estimate the real miners' capacities. The efficiency of the proposed trust model is studied and the obtained simulation results are presented and discussed. Thus, the model parameters' are optimized in order to detect and exclude misbehaving miners, while honest miners are maintained in the mining pool. [ABSTRACT FROM AUTHOR]

This paper applies an organized flow of feature engineering and machine learning to detect distributed denial-of-service (DDoS) attacks. Feature engineering has a focus to obtain the datasets of different dimensions with significant features, using feature selection methods of backward elimination, chi2, and information gain scores. Different supervised machine learning models are applied on the feature-engineered datasets to demonstrate the adaptability of datasets for machine learning under optimal tuning of parameters within given sets of values. The results show that substantial feature reduction is possible to make DDoS detection faster and optimized with minimal performance hit. The paper proposes a strategic-level framework which incorporates the necessary elements of feature engineering and machine learning with a defined flow of experimentation. The models are also validated with cross-validation and evaluated for area-under-curve analyses. It provides comprehensive solutions which can be trusted to avoid the overfitting and collinearity problems of data while detecting DDoS attacks. In the case study of DDoS datasets, K-nearest neighbors algorithm overall exhibits the best performance followed by support vector machine, whereas low-dimensional datasets of discrete feature types perform better under the Random Forest model as compared to high dimensions with numerical features. The accuracy scores of dataset with the lowest number of features remain competitive with other datasets under all machine learning models, leading to a substantially reduced processing overhead. The experiments show that approximately 68% reduction in the feature space is possible with an impact of only about 0.03% on accuracy. [ABSTRACT FROM AUTHOR]

With the dramatic opening-up of network, network security becomes a severe social problem with the rapid development of network technology. Intrusion Detection System (IDS) is an innovative and proactive network security technology, which becomes a hot topic in both industry and academia in recent years. There are four main characteristics of intrusion data that affect the performance of IDS including multicomponent, data imbalance, time-varying and unknown attacks. We propose a novel IDS framework called HMLD to address these issues, which is an exquisite designed framework based on Hybrid Multi-Level Data Mining. In this paper, we use KDDCUP99 dataset to evaluate the performance of HMLD. The experimental results show that HMLD can reach 96.70% accuracy which is nearly 1% higher than the recent proposed optimal algorithm SVM+ELM+Modified K-Means. In details, HMLD greatly increased the detection accuracy of DoS attacks and R2L attacks. [ABSTRACT FROM AUTHOR]

Technological advancements in the information systems and networks are the outcome of potential developments resulting in the networking and communications. The role of Critical Infrastructure is playing a vital role in imparting the condition of effective information systems management. However, with some of the negative developments like DDoS attacks that impact the operations of network application systems, there are adverse set of issues encountered. With the rising number of DDoS attacks phenomenon, researchers have focused on developing contemporary solutions that can support in thwarting such attacks. From the review of such models in the literature review, it is imperative that two distinct dimensions like the detection and mitigation accuracy levels has scope for improvement and profoundly majority of such models were tested on the static datasets which are not pragmatic. Considering such equations, the model proposed in this manuscript focused on a contemporary range of solution that can be high on accuracy rate and also is tested over the dynamic dataset to understand the efficacy of the system. Using the ensemble classifiers comprising drift detection features, at service request stream level, the proposed solution if implemented can lead to better levels of detection. Experimental study of the model carried out using the service request stream that is synthesized is tested based on statistical metrics like accuracy, prediction value and true negative rates. Significance of the model is imperative in terms of results generated and its comparative analysis to the other bench-mark models in the segment. [ABSTRACT FROM AUTHOR]

The performance of mobile ad hoc networks (MANETs) is significantly affected by the malicious nodes. One of the most common attacks in MANETs is denial of service (DoS); a type of intrusion specifically designed to target service integrity and availability of a certain network node. Hence, it is important to use an efficient intrusion detection system (IDS) that detects and removes the malicious nodes in the network to improve the performance by monitoring the network traffic continuously. The main contribution of this paper is the integration of an IDS into MANETs as a reliable and potent solution. A new approach to intrusion detection is developed based on support vector machine algorithm. The proposed IDS can detect the DoS type attacks at a high detection rate with a simple structure and short computing time. It is shown by extensive computer simulation that the proposed IDS improves the reliability of the network significantly by detecting and removing the malicious nodes in the system. The performance of the suggested approach is independent of the network routing protocol. The detection rate of the system is also not effected by node mobility and network size. [ABSTRACT FROM AUTHOR]

An approach to the classification of the state of a network based on of statistical parameters is investigated. Deficiencies of methods for classifying the state of a network are established and the basic implementation of a committee of classifier is considered. A modification of the committee of classifiers using a neural network as a metaclassifier is proposed. Experiments on classifying the state of a network were carried out. [ABSTRACT FROM AUTHOR]