Search

In fifth-generation (5G)-based vehicular networks, vehicles share information about the road's condition to make driving safer and alleviate traffic congestion. Given the public nature of the medium, addressing issues of confidentiality and security is of paramount importance. Existing systems are vulnerable to a distributed denial-of-service (DDoS) attack from an attacker or high traffic in a dense area because of the time-consuming and complex operations based on bilinear pair and elliptic curve cryptographies used. In order to protect vehicle-to-vehicle communication in 5G-based vehicular networks from DDoS attacks, a strategy based on the Chebyshev polynomial is proposed in this study. The semi-group and chaotic features of the Chebyshev polynomial are utilised in our proposal. Our solutions also meet all applicable standards for security and privacy, such as node authentication, message integrity, preserving identity privacy, traceability, unlinkability, and resistance to attacks. Finally, our innovation decreases the computational burden to produce a message signature by 66.67% and the burden to verify a signature by 33.33%. However, the size of the message-signature tuple is affected by the communication expenses of our work by 5.00%. [ABSTRACT FROM AUTHOR]

Mobile Health (m-Health) has become an integral part of modern healthcare, utilizing digital devices like laptops, smart phones, and tablets to facilitate the rapid exchange of real-time patient data through interconnected channels. However, the reliance on centralized cloud computing in m-health systems introduces potential security vulnerabilities. Among these threats, Distributed Denial of Service (DDoS) attacks pose a significant risk, capable of disrupting networks and compromising system reliability. The research paper addresses the vulnerability of m-healthcare systems to DDoS attacks and proposes a four-layered architecture to enhance security measures. The focus on recognizing and identifying DDoS attacks within the system is crucial for early detection and prevention of potential harm. Moreover, the exploration of different deterrence approaches in a virtualized cloud-based environment allows for a comprehensive assessment of their effectiveness. The analysis of performance metrics, particularly the maximum and mean values of DDoS attack success rates, provides valuable insights into the efficacy of the proposed architecture and defense mechanisms. This information will undoubtedly assist in refining and strengthening the system's security measures to mitigate the impact of potential DDoS attacks. Overall, the research paper delves into a critical aspect of m-healthcare system security, shedding light on the vulnerabilities and proposing feasible solutions. By adopting a proactive approach to counter DDoS attacks, the proposed architecture holds the potential to significantly enhance the reliability and privacy of m-health systems, ultimately benefiting patients and healthcare providers alike. The proposed approach taken is innovative and promising. [ABSTRACT FROM AUTHOR]

In the world of connected devices, there is huge growth of less secure Internet of Things (IoT) devices, and the ease of performing sophisticated cyberattacks using these devices has posed a serious threat to the security of Internet-based services or networks. Distributed Denial of Service (DDoS) attack is one of the most significant cyberattacks. It aims to damage or exhaust victims' resources, services, or networks and make them unavailable to legitimate users. Several solutions are available in the literature to detect DDoS attacks. However, it is difficult to detect them in real-time due to today's high speed or high volume of attack traffic. Therefore, this paper proposes an Apache Storm-based distributed detection approach for IoT network traffic-based DDoS attacks, namely SDDA-IoT. SDDA-IoT is composed of two primary modules: model development and model deployment. In the case of model development, we created five distributed detection models by utilizing a Hadoop cluster and the extremely scalable H2O.ai machine learning platform. In the case of model deployment, we deploy an efficient distributed detection model on the Apache Storm stream processing framework for analyzing ingress streaming data and classifying it into seven classes in near-real-time. To create new models or update existing ones, this module also saves the highly discriminating input features of each network flow along with the predicted outcome in the Hadoop Distributed File System (HDFS). The effectiveness of the SDDA-IoT approach has been examined using a variety of configured scenarios. The experimental results show that the SDDA-IoT approach detects DDoS attacks faster than recent state-of-the-art methods and more accurately with 99%+ accuracy. [ABSTRACT FROM AUTHOR]

The increasing reliance on internet-based services has heightened the vulnerability of network infrastructure to cyberattacks, particularly distributed denial of service (DDoS) attacks. These attacks can cause severe disruptions and significant financial losses. Early detection of malicious traffic is crucial in effectively combating such threats. This paper presents an innovative approach called the Encoder-Stacked deep neural networks (E-SDNN) model, which leverages Stacked/bagged multi-layer perceptrons (MLP) for accurate DDoS attack detection. The proposed method employs an encoder to select pertinent features from a preprocessed dataset, enabling precise attack detection. Extensive experiments were conducted on benchmark cybersecurity datasets, namely CICDS2017 and CICDDoS2019, encompassing various DDoS attack scenarios. The experimental results demonstrate the superiority of the E-SDNN model compared to state-of-the-art methods. The proposed E-SDNN model achieved an impressive overall accuracy rate of 99.94% and 98.86% for CICDDS2017 and CICDDoS2019, respectively. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) has shown incredible adaptability in recent years and has become an integral part of human life. The proliferation of IoT technology has made IoT devices more prone to severe security threats, such as Distributed Denial of Service (DDoS) attacks, which are dangerous threats to public systems and networks. Further, the frequency and complexity of IoT traffic-based DDoS attacks are increasing year-by-year. This article proposes an IoT traffic-based DDoS attack detection approach for classifying incoming IoT network traffic into 11 classes using multiclass machine learning techniques. The proposed approach comprises two phases: (i) designing and (ii) detection. In the designing phase, we employ the embedded feature reduction technique to create cost-effective and efficient classification models with a high feature reduction rate. Further, we evaluate these models using the K-fold cross-validation technique. While in the detection phase, we evaluate the performance of an efficient model by executing four different IoT traffic-based scenarios. A publicly available Bot-IoT dataset is employed to design and validate the proposed multiclass classification approach. The results show that the proposed approach provides an 84.4% feature reduction rate and approximately 5.19% higher classification accuracy than the existing approaches. [ABSTRACT FROM AUTHOR]

Software-defined networks (SDNs) present a novel network architecture that is widely used in various datacenters. However, SDNs also suffer from many types of security threats, among which a distributed denial of service (DDoS) attack, which aims to drain the resources of SDN switches and controllers, is one of the most common. Once the switch or controller is damaged, the network services can be affected. Many defense schemes against DDoS attacks have been proposed from the perspective of attack detection; however, such defense schemes are known to suffer from a time consuming and unpromising accuracy, which could result in an unavailable network service before specific countermeasures are taken. To address this issue through a systematic investigation, we propose an elaborate resource-management mechanism against DDoS attacks in an SDN. Specifically, by considering the SDN topology, we leverage the M/M/c queuing model to measure the resistance of an SDN to DDoS attacks. Network administrators can therefore invest a reasonable number of resources into SDN switches and SDN controllers to defend against DDoS attacks while guaranteeing the quality of service (QoS). Comprehensive analyses and empirical data-based experiments demonstrate the effectiveness of the proposed approach. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attacks are among the most severe threats in cyberspace. The existing methods are only designed to decide whether certain types of DDoS attacks are ongoing. As a result, they cannot detect other types of attacks, not to mention the even more challenging mixed DDoS attacks. In this paper, we comprehensively analyzed the characteristics of various types of DDoS attacks and innovatively proposed five new features from heterogeneous packets including entropy rate of IP source flow, entropy rate of flow, entropy of packet size, entropy rate of packet size, and number of ICMP destination unreachable packet to detect not only various types of DDoS attacks, but also the mixture of them. The experimental results show that the proposed fives features ranked at the top compared with other common features in terms of effectiveness. Besides, by using these features, our proposed framework outperforms the existing methods when detecting various DDoS attacks and mixed DDoS attacks. The detection accuracy improvements over the existing methods are between 21% and 53%. [ABSTRACT FROM AUTHOR]

Software-defined networking (SDN) is considered a next-generation networking model. Several networking components are managed through a centralized controller that enables efficiency and flexibility in configuring network devices, implementing policy decisions, and managing the underlying network infrastructure through a programmable unit. Despite its default security protocols, SDN is considered to be contradictory towards DDoS attacks. It is observed from state-of-art studies that intrusion in SDN is possible at various layers of its core architecture. Addressing this problem, this article presents a novel ensemble mechanism inspired by quantum cryptography to secure various layers of SDN. This paper presents a two-fold mechanism to secure communications at the SDN architecture's data plane and control plane. It was firstly addressing the secured communication at the data plane, a novel quantum protocol devised. Further, a machine learning-inspired ensemble classifier is devised to detect DDoS attack-prone traffic at the control plane. Simulation studies presented in this article evidenced that the proposed mechanism outperforms the state of art mechanisms in terms of Accuracy and rate of prediction. [ABSTRACT FROM AUTHOR]

Due to the huge flow of data and complications in mutable characteristics of the data, Distributed Denial of Services attacks existed in the Multimedia Internet of Things. Attacks over the IoT have become an increasing menace in recent time, which tries to hack or illegally tamper the streaming data available over the networks. On the other hand, there has been an increase in volume in research contributions to effectively counter these attacks and implement a strong defense mechanism. There have been numerous algorithms and frameworks implemented in recent times that are intelligent and soft computing-based. These evolution-based algorithms play a vital role in self-adapting the system under attack towards increasing and new types of attacks which are increasing day by day. One such area of soft computing algorithms investigated in this paper is the Artificial Neural Network or popularly known as ANNs. It works analogously to the biological neurons in the human body. In this paper, we systematically explain the ANN-based network model to counteract the DDoS attacks in the Multimedia Internet of Things, architecture, and implementation of ANNs, the experimental investigations and findings which help in drawing an inference of ANN-based defense models. [ABSTRACT FROM AUTHOR]

Distributed denial of service (DDoS) attacks disrupt the availability of cloud services. The detection of these attacks is a major challenge in the cloud computing environment. Machine learning models can be used to detect these attacks efficiently. In this work, a hybrid machine learning model based approach to detect these attacks is proposed. Firstly, a hybrid machine learning model using extreme learning machine (ELM) and adaptive differential evolution is proposed. In the proposed model, input to hidden layer link weights, and hidden layer biases of ELM are optimized using adaptive differential evolution while weights of links between hidden and output layers are analytically determined. The adaptive differential evolution is modified to choose the apt crossover operator during the evolution process. After that, a DDoS attack detection system using the suggested hybrid model is proposed for cloud computing.. Three state-of-the-art datasets NSL-KDD, ISCX IDS 2012, and CIDDS-001 are used to evaluate the performance of the proposed attack detection system. [ABSTRACT FROM AUTHOR]

The increasing prevalence of computer network attacks globally has created a need for enhanced intrusion detection and prevention solutions. Traditional intrusion detection systems often struggle to differentiate genuine network traffic from malicious DDoS attacks especially, in case of low-rate or stealthy incursions. Signature-based and rule-based systems face challenges in adapting the emerging attack patterns, resulting in a high false-positive rate that can overwhelm security teams with irrelevant alerts. To address these limitations, this research introduces the self-adaptive lightweight attention module-based bidirectional long short-term memory (SLWAM-BiLSTM), which involves spatial and channel attention mechanisms, to enhance its ability to discern malicious activity from normal network behavior. The self-adaptive nature of the attention modules ensures that the model can dynamically adjust its focus, making the model well-suited for real-time intrusion detection. The spatial and channel attention mechanisms are employed to optimize the model. Additionally, the drift evaluation mechanism implemented in this research is a dynamic assessment mechanism that adaptively monitors the network traffic behavior and manages emerging attack patterns. The experimental outcomes reveal that the SLWAM-BiLSTM model has a higher sensitivity of 93.91%, specificity of 97.31%, and overall accuracy of 96.91%, at TP 80% while using the CIC-DDoS2019 dataset, outperforming conventional approaches in DDoS attack. [ABSTRACT FROM AUTHOR]

Currently, Distributed Denial of Service Attacks are the most dangerous cyber danger. By inhibiting the server's ability to provide resources to genuine customers, the affected server's resources, such as bandwidth and buffer size, are slowed down. A mathematical model for distributed denial-of-service attacks is proposed in this study. Machine learning algorithms such as Logistic Regression and Naive Bayes, are used to detect attacks and normal scenarios. The CAIDA 2007 Dataset is used for experimental study. The machine learning algorithms are trained and tested using this dataset and the trained algorithms are validated. Weka data mining platform are used in this study for implementation and results of the same are analysed and compared. Other machine learning algorithms used with respect to denial of service attacks are compared with the existing work. [ABSTRACT FROM AUTHOR]

A distributed denial of service (DDoS) attack is the most destructive threat for internet-based systems and their resources. It stops the execution of victims by transferring large numbers of network traces. Due to this, legitimate users experience a delay while accessing internet-based systems and their resources. Even a short delay in responses leads to a massive financial loss. Numerous techniques have been proposed to protect internet-based systems from various kinds of DDoS attacks. However, the frequency and strength of attacks are increasing year-after-year. This paper proposes a novel Apache Kafka Streams-based distributed classification approach named KS-DDoS. For this classification approach, firstly, we design distributed classification models on the Hadoop cluster using highly scalable machine learning algorithms by fetching data from Hadoop distributed files system (HDFS). Secondly, we deploy an efficient distributed classification model on the Kafka Stream cluster to classify incoming network traces into nine classes in real-time. Further, this distributed classification approach stores highly discriminative features with predicted outcomes into HDFS for creating/updating models using a new set of instances. We implemented a distributed processing framework-based experimental environment to design, deploy, and validate the proposed classification approach for DDoS attacks. The results show that the proposed distributed KS-DDoS classification approach efficiently classifies incoming network traces with at least 80% classification accuracy. [ABSTRACT FROM AUTHOR]

The main goal of Denial of Service (DoS) attack is to restrict authorized users from gaining access to available services and resources or to prevent from processing the benign events. When a DoS attack is launched by multiple connected devices distributed over a network, the attack becomes a Distributed DoS attack (DDoS). The research community addressed various types of DDoS attacks in literature. DDoS attacks are very hazardous and difficult to resolve in real time. Each of these types of attacks has some key features that are identified to improve network security in real time. In this paper, an approach using Random Forest method is presented to extract the basic features from KDDCUP'99 dataset. With these features as the input, the proposed approach is smoothly extended for detection of new and unseen DDoS attacks with the assistance of nine support vector machine kernel functions namely Hyperbolic tangent kernel, Linear kernel, ANOVA RBF kernel, Spline kernel, Radial Basis kernel, Polynomial kernel, Laplacian kernel, Bessel kernel, and String kernel. The experimental study clearly shows that Laplace Dot support vector machine kernel (Laplacian kernel) function gives the paramount performance in terms of detecting seen and unseen DDoS attacks. [ABSTRACT FROM AUTHOR]

Distributed denial of service (DDoS) is an immense threat for Internet based-applications and their resources. It immediately floods the victim system by transmitting a large number of network packets, and due to this, the victim system resources become unavailable for legitimate users. Therefore, this attack is claimed to be a dangerous attack for Internet-based applications and their resources. Several security approaches have been proposed in the literature to protect Internet-based applications from this type of threat. However, the frequency and strength of DDoS attacks are increasing day-by-day. Further, most of the traditional and distributed processing frameworks-based DDoS attack detection systems analyzed network flows in offline batch processing. Hence, they failed to classify network flows in real-time. This paper proposes a novel Spark Streaming and Kafka-based distributed classification system, named by SSK-DDoS, for classifying different types of DDoS attacks and legitimate network flows. This classification approach is implemented using a distributed Spark MLlib machine learning algorithms on a Hadoop cluster and deployed on the Spark streaming platform to classify streams in real-time. The incoming streams consume by Kafka's topic to perform preprocessing tasks such as extracting and formulating features for classifying them into seven groups: Benign, DDoS-DNS, DDoS-LDAP, DDoS-MSSQL, DDoS-NetBIOS, DDoS-UDP, and DDoS-SYN. Further, the SSK-DDoS classification system stores formulated features with their predicted class into the HDFS that will help to retrain the distributed classification approach using a new set of samples. The proposed SSK-DDoS classification system has been validated using the recent CICDDoS2019 dataset. The results show that the proposed SSK-DDoS efficiently classified network flows into seven classes and stored formulated features with the predicted value of each incoming network flow into HDFS. [ABSTRACT FROM AUTHOR]

In today's technological world, distributed denial of service (DDoS) attacks threaten Internet users by flooding huge network traffic to make critical Internet services unavailable to genuine users. Therefore, design of DDoS attack detection system is on urge to mitigate these attacks for protecting the critical services. Nowadays, deep learning techniques are extensively used to detect these attacks. The existing deep feature learning approaches face the lacuna of designing an appropriate deep neural network structure for detection of DDoS attacks which leads to poor performance in terms of accuracy and false alarm. In this article, a tuned vector convolutional deep neural network (TVCDNN) is proposed by optimizing the structure and parameters of the deep neural network using binary and real cumulative incarnation (CuI), respectively. The CuI is a genetic-based optimization technique which optimizes the tuning process by providing values generated from best-fit parents. The TVCDNN is tested with publicly available benchmark network traffic datasets and compared with existing classifiers and optimization techniques. It is evident that the proposed optimization approach yields promising results compared to the existing optimization techniques. Further, the proposed approach achieves significant improvement in performance over the state-of-the-art attack detection systems. [ABSTRACT FROM AUTHOR]

Internet of Things is one of the most versatile technologies in existence today. It has taken over our day to day activities and thus has many applications that are designed to make life easier and simpler. Partly because IoT is new, it is replete with insecurities and vulnerabilities. Due to the lack of fundamental security controls, and the integration of real-world objects with the Internet, IoT devices are facile targets for cyber-criminals and other aggressors. This means that these vulnerabilities can be exploited for hacking, adding to Botnets, and then used to launch DoS and DDoS against organizations. To provide security from DoS and DDoS attacks, various solutions have been proposed. In this paper, Machine Learning, as well as Deep Learning algorithms, have been employed to analyze the DoS and DDoS attacks. The Bot-IoT dataset of the Centre of UNSW Canberra Cyber was used for training purposes. ARGUS software was used to generate the features from the pcap files of UNSW. A testbed was setup using 20 devices and generated dataset. From the result, the best accuracy of attack classification is 99.5% and 99.9% for Deep Learning and Machine Learning algorithms respectively. [ABSTRACT FROM AUTHOR]

Software defined networks (SDN) creates an environment for designing customized networks based on consumer needs. SDN can effectively apply the decoupling methods on the forwarding plane and the control plane. The SDN controller will forward the traffic information to northbound API and controller obtain the traffic information from openflow virtual switch. SDN routes data and control packets to their destinations based on flow labels, but it lacks protection features to prevent malicious traffic. The SDN environment faces denial of service (DoS) attacks and distribute denial of service attacks, it leads to service unavailability. This paper is mainly focused on dynamically configuring the firewall to identify DoS attacks and decrease malevolent traffic. Virtual networks are simulated using mininet with dynamic access control list rules, and the result show that the suggested solution has improved attack alleviation time bins. [ABSTRACT FROM AUTHOR]

Due to massive data flow and complexity of changeable data characteristics, the dimension disasters problems is ordinary existed in the prediction of the Distributed Denial of Services (DDoS) large-flow attack for multimedia Internet of Things, which will result in the following deficiency such as excessive consumption of computing, and storage resources, reduced analysis efficiency. In this paper, a novel method with the combination of matrix diversity and principal component analysis is proposed for DDoS feature reduction. Firstly, matrix diversity is used to reduce the multiple feature properties of DDoS, and then principal component analysis is used to reduce these features further. Then, the statistical characteristics of these correlations are analyzed. Finally, real-time attack detection is carried out based on mahalanobis distance (MD). It is obvious demonstrated that the proposed method has higher prediction accuracy and more computational efficiency than the traditional method. [ABSTRACT FROM AUTHOR]

The future of information technology mainly depends upon cloud computing. Hence security in cloud computing is highly essential for the consumers as well as the service providers of the particular cloud environment. There are many security threats are challenging the current cloud environment. One of the important security threat ever in cloud environment is considered to be the Distributed Denial of Service (DDoS) attack. Where cloud is of greater benefit in terms of providing on-demand services, a certain kind of attack named as Economic Denial of Sustainability (EDoS) occurs in pay per use payment model. Due to the occurrence of this attack the consumers are forced to pay additional amount for the services offered. EDoS attacks are similar to that of DDoS attacks Which is classified as-attacks associated with bandwidth consuming, application targeted attacks and the exhaustion of the connection layer. The main objective of the proposed work is to design a profile-based novel framework for maximizing the detection of various types of EDoS attacks. During this process, the proposed framework consisting Feature Classification (FC) algorithm ensures that false positives and negatives along with bandwidth and memory consumption are highly minimized. The proposed algorithm allows only the limited resources for allocation to the available virtual machines which increases the chances of the detecting the attack and preventing the misuse propagation of resources. The accuracy and efficiency of this approach is proven to be higher with lesser computational complexity when compare to the existing approaches. [ABSTRACT FROM AUTHOR]

Software-defined networking (SDN) is an approach in the network that provides many advantages with the help of separating the intelligence of the network (controller) with the underlying network infrastructure (data plane). But this isolation also gives birth to many security concerns; therefore, the need to protect the network from various attacks is becoming mandatory. Distributed Denial of Service (DDoS) in SDN is one such attack that is becoming a hurdle to its growth. Before the mitigation of DDoS attacks, the primary step is to detect them. In this paper, an early DDoS detection tool is created by using SNORT IDS (Intrusion Detection System). This tool is integrated with popularly used SDN controllers (Opendaylight and Open Networking Operating System). For the experimental setup, five different network scenarios are considered. In each scenario number of hosts, switches and data packets vary. For the creation of different hosts, switches the Mininet emulation tool is used whereas for generating the data packets four different penetration tools such as Hping3, Nping, Xerxes, Tor Hammer, LOIC are used. The generated data packets are ranging from (50,000 per second–2,50,000 per second) and the number of hosts/switches are ranging from (50–250) in every scenario respectively. The data traffic is bombarded towards the controllers and the evaluation of these packets is achieved by making use of Wireshark. The analysis of our DDoS detection system is performed on the basis of various parameters such as time to detect the DDoS attack, Round Trip Time (RTT), percentage of packet loss and type of DDoS attack. It is found that ODL takes minimum time to detect the successful DDoS attack and more time to go down than ONOS. Our tool ensures the timely detection of fast DDoS attacks which delivers the better performance of the SDN controller and not compromising the overall functionality of the entire network. [ABSTRACT FROM AUTHOR]

In the present computer era, the vulnerabilities inherent in the Internet architecture enable various kinds of attacks. Distributed Denial of Service (DDoS) is one of such prominent attack that is a lethal threat to Internet domain that harnesses its computing and communication resources. The increase in network traffic rates of legitimate traffic and its flow similarity with attack traffic has made the DDoS detection very difficult despite deployment of diversified defense solutions. The ISPs are bound to invest heavily to counter such problems which has a significant impact on company finances. To provide uninterrupted quality services to the end users, ISPs needs to deploy a distributed solution for timely detection and discrimination of attack and behaviorally similar flash events (FE) traffic. Such distributed defense systems can be deployed at source-end, intermediate network-end or at the victim-end location. Since the volume of traffic to be analyzed is very large, the detection accuracy and low computational complexity of the proposed defense solution is always a challenging problem. This paper proposes an ISP level distributed, collaborative and automated (D-CAD) defense system for detecting DDoS attacks and FEs, and has the capability to effectively distinguishing the two. Additionally, D-CAD defense system is also capable of categorizing FE traffic and has low computational complexity. The proposed system is validated in novel software defined networks (SDN) using Mininet emulator. The results show that D-CAD defense system outperformed its existing counterparts on various detection system evaluation metrics. [ABSTRACT FROM AUTHOR]

Cloud computing offer various services over the Internet based on pay-per-use concept. Therefore, many organizations have already adopted this system to attract the users with its desirable features. However, due to its design, makes it vulnerable to malicious attacks. This demands an Intrusion Detection System that can detect such attacks with high detection accuracy in cloud environment. This paper proposes a novel intrusion detection system that combines a fuzzy c means clustering (FCM) algorithm with support vector machine (SVM) to improve the accuracy of the detection system in cloud computing environment. The proposed system is implemented and compared with existing mechanisms. The NSL-KDD dataset is used for experiments. Based on performance evaluation and comparative analysis, the results obtained using this new hybrid mechanism (FCM–SVM) show that the proposed system can detect the anomalies with high detection accuracy and low false alarm rates over the existing techniques. [ABSTRACT FROM AUTHOR]

Today, the providers of cloud computing services are among the most prominent service suppliers worldwide. Availability of cloud services is one of the most important concerns of cloud service providers (CSPs) and cloud users (CUs). Distributed Denial of Service (DDoS) attacks are common types of security issues which affect cloud services and consequently, can lead to unavailability of the services. Therefore, reducing the effects of DDoS attacks helps CSPs to provide high quality services to CUs. In this paper, first, we propose an anomaly-based DDoS attack detection framework in cloud environment using a third party auditor (TPA). Second, we provide multiple basic assumptions and configurations of cloud environments for establishing simulation tests to evaluate our proposed framework. Then, we provide results of simulation tests to analyze the feasibility of our approach. Simulation results demonstrate that our method for detecting DDoS attacks in CSPs has following advantages: efficiency, because of the low overhead of computations on CSPs for attack detection; rapid, due to informing a CSP about an attack in a short course of time regarding the maximum valid response time which is defined in a service level agreement (SLA); and precision, through no false positive detection as well as a low rate of false negative detection which is < 2% of all scenarios of the simulation tests. Finally, we present a table to compare characteristics of our framework with other ones in the literature. [ABSTRACT FROM AUTHOR]

Security and safety are fundamental issues in any wireless network. The problem becomes serious when the specified network is Vehicular Adhoc Network (VANET). VANET faces Distributed Denial of Service (DDoS) attacks, when several vehicles carry out various types of Denial of Service (DoS) attacks to disrupt the normal functioning of network, thereby endangering human lives. A highly efficient and reliable algorithm is required to be developed to detect and prevent DDoS attacks in VANET. This paper presents a hybrid detection algorithm based on the SVM kernel methods of AnovaDot and RBFDot for detecting DDoS attacks in VANETs. In this hybrid algorithm, features like collisions, packet drop, jitter etc. have been used to simulate real time network communication scenario where the network is operating under normal conditions, as well as under DDoS attacks. These features are used both for training and for testing the model based on the proposed hybrid algorithm. The performance of the model based on the proposed hybrid algorithm is compared with the models based on single SVM kernel algorithms AnovaDot and RBFDot based on Accuracy, Gini, KS, MER and H. The experimental results show that the model based on the proposed hybrid algorithm is superior to detect DDoS attacks as compared to the models based on single SVM kernel algorithms AnovaDot and RBFDot. The results also prove that by combining the the SVM kernel algorithms, an efficient and effective hybrid algorithm can be developed. [ABSTRACT FROM AUTHOR]

In a cloud computing environment, the Distributed Denial of Service (DDoS) attack is considered as the crucial issue that needs to be addressed in ensuring the availability of resources that emerge due to the compromisation of hosts. The process of detecting and preventing DDoS attacks is determined to be predominant when the potential benefits of decoupling data plane from the control plane are facilitated through the Software Defined Networking (SDN) in the cloud environment. The incorporation of SDN in DDoS mitigation also enhances the probability of investigating the data traffic flow using the reactive process of updating forwarding rules, analyzing the network with a global view and centralized control in monitoring for better DDoS mitigation enforcement. In this paper, a Convolution Recursively Enhanced Self Organizing Map and Software Defined Networking-based Mitigation Scheme (CRESOM-SDNMS) is proposed for ensuring the better rate of detection during the process of preventing DDoS attacks in clouds. This proposed CRESOM-SDNMS facilitates a predominant option in resolving the issue of vector quantization with enhanced topology preservation and the superior initialization mechanism during the process of SOM-based categorization of flooded data traffic flows into genuine and malicious. The simulation experiments and results of the proposed CRESOM-SDNMS confirmed a superior classification accuracy of around 21% when compared to the existing systems with minimized False Positive rate of 19% compared to the benchmarked DDoS mitigation schemes of the literature. [ABSTRACT FROM AUTHOR]

This paper applies an organized flow of feature engineering and machine learning to detect distributed denial-of-service (DDoS) attacks. Feature engineering has a focus to obtain the datasets of different dimensions with significant features, using feature selection methods of backward elimination, chi2, and information gain scores. Different supervised machine learning models are applied on the feature-engineered datasets to demonstrate the adaptability of datasets for machine learning under optimal tuning of parameters within given sets of values. The results show that substantial feature reduction is possible to make DDoS detection faster and optimized with minimal performance hit. The paper proposes a strategic-level framework which incorporates the necessary elements of feature engineering and machine learning with a defined flow of experimentation. The models are also validated with cross-validation and evaluated for area-under-curve analyses. It provides comprehensive solutions which can be trusted to avoid the overfitting and collinearity problems of data while detecting DDoS attacks. In the case study of DDoS datasets, K-nearest neighbors algorithm overall exhibits the best performance followed by support vector machine, whereas low-dimensional datasets of discrete feature types perform better under the Random Forest model as compared to high dimensions with numerical features. The accuracy scores of dataset with the lowest number of features remain competitive with other datasets under all machine learning models, leading to a substantially reduced processing overhead. The experiments show that approximately 68% reduction in the feature space is possible with an impact of only about 0.03% on accuracy. [ABSTRACT FROM AUTHOR]

Technological advancements in the information systems and networks are the outcome of potential developments resulting in the networking and communications. The role of Critical Infrastructure is playing a vital role in imparting the condition of effective information systems management. However, with some of the negative developments like DDoS attacks that impact the operations of network application systems, there are adverse set of issues encountered. With the rising number of DDoS attacks phenomenon, researchers have focused on developing contemporary solutions that can support in thwarting such attacks. From the review of such models in the literature review, it is imperative that two distinct dimensions like the detection and mitigation accuracy levels has scope for improvement and profoundly majority of such models were tested on the static datasets which are not pragmatic. Considering such equations, the model proposed in this manuscript focused on a contemporary range of solution that can be high on accuracy rate and also is tested over the dynamic dataset to understand the efficacy of the system. Using the ensemble classifiers comprising drift detection features, at service request stream level, the proposed solution if implemented can lead to better levels of detection. Experimental study of the model carried out using the service request stream that is synthesized is tested based on statistical metrics like accuracy, prediction value and true negative rates. Significance of the model is imperative in terms of results generated and its comparative analysis to the other bench-mark models in the segment. [ABSTRACT FROM AUTHOR]

In this paper, we propose a method to detect network intrusions using anomaly detection technique based on probabilistic analysis. Victim’s computers under attack show various symptoms such as degradation of TCP throughput, increase in CPU usage, increased round trip time, frequent disconnection to the Web sites, etc. These symptoms can be used as components to construct the k-dimensional feature space of multivariate normal distribution, in which case an anomaly detection method can be applied for the detection of the attack on the distribution. These features are generally highly correlated. Thus we choose only a few of these features for the anomaly detection in multivariate normal distribution. We use Mahalanobis distance to detect the anomalies for each data, normal, and abnormal. Anomalies are identified when their square root of Mahalanobis distance exceeds certain threshold. A detailed description of the threshold setting and the various experiments are discussed in simulation results. [ABSTRACT FROM AUTHOR]

As Cloud computing is reforming the infrastructure of IT industries, it has become one of the critical security concerns of the defensive mechanisms applied to secure Cloud environment. Even if there are tremendous advancements in defense systems regarding the confidentiality, authentication and access control, there is still a challenge to provide security against availability of associated resources. Denial-of-service (DoS) attack and distributed denial-of-service (DDoS) attack can primarily compromise availability of the system services and can be easily started by using various tools, leading to financial damage or affecting the reputation. These attacks are very difficult to detect and filter, since packets that cause the attack are very much similar to legitimate traffic. DoS attack is considered as the biggest threat to IT industry, and intensity, size and frequency of the attack are observed to be increasing every year. Therefore, there is a need for stronger and universal method to impede these attacks. In this paper, we present an overview of DoS attack and distributed DoS attack that can be carried out in Cloud environment and possible defensive mechanisms, tools and devices. In addition, we discuss many open issues and challenges in defending Cloud environment against DoS attack. This provides better understanding of the DDoS attack problem in Cloud computing environment, current solution space, and future research scope to deal with such attacks efficiently. [ABSTRACT FROM AUTHOR]

Cloud adoption by industry and governments has been on the rise for the past few years due to the obvious cloud technology advantages that include scalability, reliability, availability, agility, and cost efficiency. However, cloud security remains a main barrier for such adoption. Distributed denial of service (DDoS) attacks pose a serious security threat to cloud-hosted services and applications. In recent years, in addition to DDoS attacks, cloud systems are prone to be attacked by a new type of attacks known as economic denial of sustainability (EDoS). An EDoS attack targets the economic resources of the cloud adopter who gets billed and charged on a 'pay-as-you-use' basis. In an EDoS attack, the attacker goal is to make the cloud system unaffordable and no longer economically acceptable for the cloud adopter. An EDoS-Shield is known to be an effective technique to mitigate such attacks, in which malicious requests are detected and dropped prior to reaching the cloud service nodes. In this paper, we model and study the performance of EDoS-Shield using queuing theory modeling. Various scenarios applicable to EDoS-shielding are considered and analyzed. We analyzed and compared the performance of proposed system in terms of key performance metrics which include response time, CPU utilization of allocated cloud compute resources, and system throughput. [ABSTRACT FROM AUTHOR]

Distributed denial-of-service (DDoS) attacks have become a weapon of choice for hackers, cyber extortionists, and cyber terrorists. These attacks can swiftly incapacitate a victim, causing huge revenue losses. Despite the large number of traditional mitigation solutions that exists today, DDoS attacks continue to grow in frequency, volume, and severity. This calls for a new network paradigm to address the requirements of today's challenging security threats. Software-defined networking (SDN) is an emerging network paradigm which has gained significant traction by many researchers to address the requirement of today's data centers. Inspired by the capabilities of SDN, we present a comprehensive survey of existing SDN-based DDoS attack detection and mitigation solutions. We classify solutions based on DDoS attack detection techniques and identify requirements of an effective solution. Based on our findings, we propose a novel framework for detection and mitigation of DDoS attacks in a large-scale network which comprises a smart city built on SDN infrastructure. Our proposed framework is capable of meeting application-specific DDoS attack detection and mitigation requirements. The primary contribution of this paper is twofold. First, we provide an in-depth survey and discussion of SDN-based DDoS attack detection and mitigation mechanisms, and we classify them with respect to the detection techniques. Second, leveraging the characteristics of SDN for network security, we propose and present an SDN-based proactive DDoS Defense Framework (ProDefense). We show how this framework can be utilized to secure applications built for smart cities. Moreover, the paper highlights open research challenges, future research directions, and recommendations related to SDN-based DDoS detection and mitigation. [ABSTRACT FROM AUTHOR]

HTTP/2 is the second major version of the HTTP protocol published by the internet engineering steering group. The protocol is designed to improve reliability and performance Such enhancements have thus delineated the protocol as being more vulnerable to distributed denial-of-service (DDoS) attacks when compared to its predecessor. Recent phenomenon showed that legitimate traffic or flash crowds could have high-traffic flow characteristics as seen in DDoS attacks. In this paper, we demonstrate that legitimate HTTP/2 flash crowd traffic can be launched to cause denial of service. To the best of our knowledge, no previous study has been conducted to analyse the effect of both DDoS as well as flash crowd traffic against HTTP/2 services. Results obtained prove the effect of such attacks when tested under four varying protocol-dependant attack scenarios. [ABSTRACT FROM AUTHOR]

In this paper, we propose a behavior-based detection that can discriminate Distributed Denial of Service (DDoS) attack traffic from legitimated traffic regardless to various types of the attack packets and methods. Current DDoS attacks are carried out by attack tools, worms and botnets using different packet-transmission rates and packet forms to beat defense systems. These various attack strategies lead to defense systems requiring various detection methods in order to identify the attacks. Moreover, DDoS attacks can craft the traffics like flash crowd events and fly under the radar through the victim. We notice that DDoS attacks have features of repeatable patterns which are different from legitimate flash crowd traffics. In this paper, we propose a comparable detection methods based on the Pearson's correlation coefficient. Our methods can extract the repeatable features from the packet arrivals in the DDoS traffics but not in flash crowd traffics. The extensive simulations were tested for the optimization of the detection methods. We then performed experiments with several datasets and our results affirm that the proposed methods can differentiate DDoS attacks from legitimate traffics. [ABSTRACT FROM AUTHOR]

Distributed computing technology is widely used by Internet-based business applications. Supply chain management (SCM), customer relationship management (CRM), e-Commerce, and banking are some of the applications employing distributed computing. These applications are the main target to massive attacks known as distributed denial-of-service (DDoS) that cause a denial of service or degradation of services being rendered. The servers that provide reliable services to genuine users in a distributed environment are victims of such attacks that flood fake requests that appear genuine. Flash crowd, on the other hand, is the huge amount of traffic caused by certain flash events (FEs) that mimics DDoS attacks. Detection of DDoS attacks in the wake of flash crowds is a challenging problem to be addressed. The existing solutions are generally meant for either flash crowds or DDoS attacks and more research is needed to have a comprehensive approach for catering to the needs of detection of spoofed and non-spoofed variants of DDoS attacks. This paper proposes a methodology that can detect aforementioned DDoS attacks and differentiate them from flash crowds. NS-2 simulations are carried out on Ubuntu platform for validating the effectiveness of the proposed methodology. [ABSTRACT FROM AUTHOR]