Search

Summary: Among the recent network security issues, Distributed Denial of Service (DDoS) attack is one of the most dangerous threats in today's cyberspace that can disrupt essential services. These attacks compromise network security by flooding the target with malicious traffic. Several researchers have designed effective DDoS detection mechanisms using machine learning (ML) and deep learning (DL)‐based techniques. However, existing detection approaches paid less attention to issues such as class imbalance, multi‐classification, or computational cost of the models, especially time. In this study, we propose a novel framework for detecting and classifying DDoS attacks with high accuracy and low computational cost. To address the class imbalance, we employ random sampling, while feature selection techniques such as low information gain, quasi‐constant elimination, and principal component analysis are utilized for optimal feature selection and reduction. Our proposed CNN‐based model achieves outstanding performance, boasting an accuracy of 99.99% for binary classification and 98.44% for multi‐classification. The proposed model is compared to existing works and baseline line models and found to be effective in binary and multi‐classification. [ABSTRACT FROM AUTHOR]

In smart applications, edge nodes are deployed to perform faster computations. Due to the limited computational capability of edge nodes, collaborative computing is used in which multiple edge nodes collaborate for request processing. For faster processing, these edge nodes are used in many applications namely, smart homes, smart farming, healthcare and so forth. In this paper, we have discussed the use of edge nodes in smart home applications. The smart home application contains different types of sensors and these sensors generate various types of data. Edge nodes are used in these applications for the immediate processing of data. A data classifier is used to classify the data and to reduce delay in data processing. However, the data classifier is more susceptible to DDoS attacks. Hence, an efficient attack detection mechanism is required to detect DDoS attacks. We have used a Feature Selection SVM (FSSVM) algorithm to select optimal parameters for attack recognition. In this algorithm, the information gain ratio is used for optimal parameter selection, and SVM is used for classification. The FSSVM algorithm has been compared with KPCA‐SVM, SVM, and Naive Bayes. Simulation results show that the FSSVM algorithm provides better accuracy compared to KPCA‐SVM, SVM, and Naive Bayes algorithms. [ABSTRACT FROM AUTHOR]

Summary: Software defined network (SDN) has emerged as a new paradigm in terms of network architecture, providing flexibility, agility, and programmability to network management. These benefits boosted the SDN adoption, bringing new challenges mainly related to security, in particular, those related to Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. The detection, prevention, and mitigation of these attacks are important since they can affect the entire network. Many current security measures use statistical techniques, as entropy, or machine learning (ML) algorithms to detect DoS and DDoS attacks. While the definition of a threshold to determine whether a traffic is an attack is not trivial in statistical techniques, ML solutions may provide better accuracy but require considerable computational resources and time to converge to a model able to detect these attacks. Trying to circumvent these limitations, current hybrid approaches either use the results from entropy as input in ML algorithms (Entropy→$$ \to $$ML) or use entropy as a filter and ML algorithms to identify attacks. This work goes one step ahead and combines these techniques in a three‐step approach (Entropy→$$ \to $$ML→$$ \to $$Entropy), called ML‐Entropy, which inherits the intelligence of ML algorithms to adjust the threshold used by entropy. The proposed solution was implemented and evaluated in two datasets, the well‐known synthetic DARPA dataset and a dataset composed by traffic collected from a real‐corporate environment. Experimental results show that, in general, ML‐Entropy presents an accuracy above 99%, similar to support vector machine (SVC) and random forest (RF) algorithms, being able to converge to a detection model up to 192,771×$$ 192,771\times $$ and 137,924×$$ 137,924\times $$ faster than RF and SVC, respectively. [ABSTRACT FROM AUTHOR]

Software‐defined networking (SDN) has received considerable attention and adoption owing to its inherent advantages, such as enhanced scalability, increased adaptability, and the ability to exercise centralized control. However, the control plane of the system is vulnerable to denial‐of‐service (DoS) attacks, which are a primary focus for attackers. These attacks have the potential to result in substantial delays and packet loss. In this study, we present a novel system called Two‐Phase Authentication for Attack Detection that aims to enhance the security of SDN by mitigating DoS attacks. The methodology utilized in our study involves the implementation of packet filtration and machine learning classification techniques, which are subsequently followed by the targeted restriction of malevolent network traffic. Instead of completely deactivating the host, the emphasis lies on preventing harmful communication. Support vector machine and K‐nearest neighbours algorithms were utilized for efficient detection on the CICDoS 2017 dataset. The deployed model was utilized within an environment designed for the identification of threats in SDN. Based on the observations of the banned queue, our system allows a host to reconnect when it is no longer contributing to malicious traffic. The experiments were run on a VMware Ubuntu, and an SDN environment was created using Mininet and the RYU controller. The results of the tests demonstrated enhanced performance in various aspects, including the reduction of false positives, the minimization of central processing unit utilization and control channel bandwidth consumption, the improvement of packet delivery ratio, and the decrease in the number of flow requests submitted to the controller. These results confirm that our Two‐Phase Authentication for Attack Detection architecture identifies and mitigates SDN DoS attacks with low overhead. [ABSTRACT FROM AUTHOR]

IoT networks are increasingly being connected to a wide range of devices, and the number of devices connected has significantly increased in recent years. As a consequence, the number of vulnerabilities to IoT networks has also been increasing tremendously. In IoT networks, botnet‐based Distributed Denial of Service attack is challenging due to its dynamic behavior. The sensors and actuators connected to IoT networks are low‐powered and have less memory. Because of their inherent vulnerability, IoT devices can always be compromised by an attacker and be used to form a large botnet. A detailed analysis of IoT botnet attacks is presented in this article, along with statistics and the architectures of the botnet. We also survey the existing literature on IoT botnet traffic analysis and present a taxonomy of attack detection methods. We particularly focus on deep learning‐based methods and conduct a comparative study to evaluate their performance on IoT traffic analysis. We identify the current issues and research challenges in this field, and we conclude by highlighting some future research directions. [ABSTRACT FROM AUTHOR]

Distributed denial of service (DDoS) attacks represent a significant cybersecurity challenge, posing a critical risk to computer networks. Developing an effective defense mechanism against these attacks is crucial but challenging, given their diverse attack types, network and computing platform heterogeneity, and complex communication protocols. Moreover, the emergence of innovative DDoS attack methods presents a formidable threat to existing countermeasures. Various machine learning techniques have shown promise in detecting DDoS attacks with low false‐positive rates and high detection rates. This survey paper offers a comprehensive taxonomy of machine learning‐based methods for detecting DDoS attacks, reviewing supervised, unsupervised, hybrid approaches, and analyzing the related challenges. Further, we explore relevant datasets, highlighting their strengths and limitations, and propose future research directions to address the current gaps in this domain. This paper aims to provide a profound understanding of DDoS attack detection mechanisms, aiding researchers, and practitioners in developing effective cybersecurity approaches against such attacks. This research is essential because DDoS attacks are diverse and pose a formidable threat to computer networks, and various machine learning techniques have shown promise in detecting them. Its implications include providing insights that can inform the development of robust defense mechanisms against DDoS attacks. [ABSTRACT FROM AUTHOR]

Summary: Software defined network (SDN) is a paradigm that emphasizes the separation of the control plane from the data plane, offering advantages such as flexibility and programmability. However, from a security perspective, SDN also introduces new vulnerabilities due to the communication required between these planes. SYN Flood attacks are typical distributed denial‐of‐service (DDoS) attacks that especially challenge network administrators since they produce a large volume of semi‐open TCP connections to a target, compromising its availability. Most of the current solutions to detect and mitigate these attacks are designed to operate at the control plane, imposing an additional overhead on controller functions. Moreover, traffic‐blocking mechanisms, a widely used alternative to protect network resources, have the drawback of restricting legitimate traffic. This work proposes DataPlane‐ML, an integrated solution to detect and mitigate DDoS attacks on SDN, acting directly in the data plane. DataPlane‐ML uses machine learning techniques for attack detection and a mitigation solution based on the node's reputation to avoid blocking legitimate traffic during an attack. Experimental results show that DataPlane‐ML is ≈26%$$ \approx 26\% $$ faster than statistical‐based solutions for attack detection while presenting better accuracy. Moreover, the DataPlane‐ML mitigation solution can preserve more than 95%$$ 95\% $$ of legitimate traffic during an attack. [ABSTRACT FROM AUTHOR]

Summary: Cloud system is a set of resources meant to provide cloud customers with on‐demand services. Accessibility to cloud environment is provided through internet services, making data stored on cloud more accessible to attackers internally and externally. Several intrusion detection systems and authentication methods have been developed in previous studies to identify the intruders, however they are generally unsuccessful with certain drawbacks. Numerous existing researchers have focused on machine learning techniques for identifying intrusions. This article intends to introduce a new intrusion detection model in the cloud and it involves three processes like preprocessing, feature extraction and detection. Initially, preprocessing takes place and the preprocessed data are subjected to feature extraction process. The flow‐based features, statistical, and higher‐order statistical features with improved holoentropy features, and the technical indicators are extracted. After extracting the features, they are subjected to a detection process, where the optimized radial bias function neural network (RBF‐NN) is exploited. For precise detection, the weight of RBF‐NN is tuned optimally by (harmonic mean based poor and rich optimization) HMPRO Algorithm. The main aim of the proposed model is to detect attacks in the cloud. Finally, the performance of the presented scheme is computed over the existing approaches using the CICDDoS2019 and UNSW‐NB_15 dataset in terms of different metrics. [ABSTRACT FROM AUTHOR]

Summary: This article gives the framework of extensive experimentation of various machine learning models to detect distributed denial of service attacks (DDoS). We use six‐tier feature ranking methods that use statistical techniques as well as machine learning based classifiers to obtain the significant features. The measurable statistical based feature selection involves Chi‐Square (Chi2), information gain (IG), merged Chi‐Square (Chi2)‐IG ranking and machine learning classifiers involve ensemble classifiers, that is, decision tree, random forest and eXtreme gradient boosting (XGBoost). Different supervised machine learning models (logistic regression, decision tree classifier, linear support vector machine, k‐nearest neighbors, Gaussian Naive Bayes, random forest classifier, XGBoost) are trained on a feature‐engineered datasets. To further our research, we use neural networks (ANN and CNN) using both feature‐selected and auto‐feature selection training setup. We check the validation and adaptability of these models with the optimal tuning of various parameters using GridSearchCV and the effectiveness of random sampling in overcoming the class imbalance problem. Based on various feature selection methods, the models are evaluated for their best performance. The experimental results show that our trained machine learning models and neural networks outperformed the ones in the state of art. The performance analysis is done based on confusion matrix scores, that is, accuracy, false alarm rate, sensitivity, specificity, false‐positive rate, F1 score, area under curve analysis and loss functions on well‐known KDD Cup 99 and UNSW‐NB15 datasets. This study is significant for furthering the research in DDoS detection with machine learning and deep neural networks. [ABSTRACT FROM AUTHOR]

Distributed denial of service attacks (DDoS) penetrate numerous computer system and implant malicious codes thereby making them ready for launching a collaborative attack. These attacks paralyze the target system mainly the web server by exhausting their network resources of the target server. The threats posed by DDoS attacks on the Internet demands for effective detection and mitigation methods of these attacks. In the paper, we proposed an integrated method for detection and mitigation of DDoS attack using machine learning and a line of defenses respectively. The detection phase consists of feature selection through ensemble feature selection algorithm and classification using machine learning algorithm. Feature selection algorithms are important as they reduce the dimension of the dataset. The selection of an efficient classification model will improve the detection rate of the proposed system. In the mitigation phase, we introduce two lines of defense to minimize the exhaustion of the victim server's resources. Using the existing dataset, we show experimentally that it is possible to detect the presence of attacks and mitigate them to a minimum level. The proposed integrated method yields an accuracy of 97.8% in detecting the attacks and able to reduce the utilization of processors upto an average of 25.95%. [ABSTRACT FROM AUTHOR]

Aiming at the low rate and strong concealment of low‐rate Denial of Service (LDoS) attacks, the calculation of traffic Hurst index is combined with traffic classification, and a machine learning LDoS attack detection method based on search sorting is proposed. The method first calculates the segmentation Hurst exponent of each flow, and constructs a traffic similarity matrix as a statistical feature. Then, using the improved model XGBoost of the Gradient Boosting Decision Tree (GBDT), the traffic is classified and predicted. The network angle distinguishes between normal traffic and abnormal Origin‐Destination (OD) flows containing LDoS attacks, thereby achieving the purpose of detecting LDoS attacks. The method in this study was validated using the US public network dataset Abilene. The experimental results show that the global LDoS attack traffic detection method based on the Hurst index and GBDT algorithm achieves better detection results under different attack rates. [ABSTRACT FROM AUTHOR]

Summary: Malware is a constant threat to the safety of the public Internet and private networks. It also affects the security of endpoint devices. An infected endpoint device can take part in aggressive or slow distributed denial of service attacks globally. Polymorphic malware has rendered traditional signature‐based detection ineffective. Hence the efforts to identify malware have been focused on behavioral modeling to identify and classify malware. This behavioral identification paved the way for artificial intelligence (AI) in cybersecurity. AI can detect a zero‐day attack and malware, but it suffers from several false positives. This article presents an extensive analysis of traditional and AI‐based methods for malware detection and related challenges. AI is vulnerable to attacks, such as dataset poisoning and adversarial data input, which can reduce model accuracy and increase false negatives. AI has helped to improve malware detection and reduce manual work through automation of feature extraction and feature selection. It is also beneficial to create models that are less prone to malware variations and capture the malicious behavior holistically. This article explores the transition of malware detection from traditional to AI‐based techniques. Furthermore, it also explains how some conventional approaches are still relevant today in terms of detection speed. [ABSTRACT FROM AUTHOR]

Summary: Cloud computing is a progressive technology that offers computing resources as Internet‐based services, revolutionized information, and communication technologies. From an economic standpoint, this transformation is beneficial because it allows them to streamline technology infrastructure and capital costs. However, economical denial of service (EDoS) potential is a crucial impediment to cloud computing success. Several improved ways to detect EDoS and distributed denial of service (DDoS) attacks in the cloud have been presented; nevertheless, these approaches still result in a considerable reduction in detection accuracy when employed in a cloud setting. Because selecting relevant features and precise classifiers for attack detection is a challenge. We recommend using an EDoS and DDoS attack identification framework in the cloud based on optimized deep learning techniques for higher detection accuracy. The experimental results reveal True Positive Rate (TPR) varies from 98.9% to 99.8% when using deep belief network with support vector machine as a learning mechanism, while True Negative Rate (TNR) from 99.6% to 99.9%. TPR and TNR were found to have average values of 99.32% and 99.67%, respectively. At 1600 requests/s, the maximum accuracy achieved and the overall accuracy of the proposed strategy was 99.78%. [ABSTRACT FROM AUTHOR]

Summary: The problem of distributed denial‐of‐service (DDoS) attack detection remains challenging due to new and innovative methods developed by attackers to evade the deployed security systems. In this work, we devise an unsupervised machine learning (ML)‐based approach for the detection of different types of DDoS attacks by augmenting the performance of K‐means clustering algorithm with the aid of a hybrid method for feature selection and extraction. By sequentially combining an integrated feature selection (IFS) algorithm and a deep autoencoder (DAE), we develop the hybrid method for extracting encoded features, which can better separate the clusters of benign and malicious network flows. We formulate the problem of DDoS attack detection as a binary clustering of network flows. Although K‐means clustering is the simplest and widely used algorithm, we investigate its performance for DDoS attack detection before and after applying the proposed hybrid method for feature selection and extraction. Our results show that after employing the proposed hybrid method, the performance of K‐means clustering model improves, and it is comparable to the state‐of‐the‐art supervised ML and deep learning (DL)‐based methods developed for DDoS attack detection. [ABSTRACT FROM AUTHOR]

Summary: As time is progressing, the number and the complexity of methods adopted for launching distributed denial of service (DDoS) attacks are changing. Therefore, we propose a methodology for the development of a generalized machine learning (ML)‐based model for the detection of DDoS attacks. After exploring various attributes of the dataset chosen for this study, we propose an integrated feature selection (IFS) method which consists of three stages and integration of two different methods, that is, filter and embedded methods to select features which highly contribute to the detection of various types of DDoS attacks. We use light gradient boosting machine (LGBM) algorithm for training of the model for classification of benign and malicious flows. For ensuring satisfactory performance and generalized behavior of the developed model, we test it by passing records of unseen DDoS attack types. Several performance metrics are employed for the evaluation of the model. By comparing the performance of developed model against state‐of‐the‐art models, we state an improvement of around 20% for almost all the reported metrics. We also show that the performance of the model improves if feature space is reduced by 77%. Furthermore, the generalized behavior of the developed model is justified by demonstrating a trade‐off between high variance and high bias ML models. [ABSTRACT FROM AUTHOR]

Summary: Rapid growth in technology has triggered the exponential growth in an advancement of the profoundly associated ubiquitous biological system of unavoidable gadgets, all things considered, called as Internet of Things (IoT). Although these devices make everyone's life as flexible and comfortable, they also suffer from various security breaches. Current scenario of security systems which are employed to safeguard the IoT devices are still in darker side, which has been considered as attractive prey for the attackers. This paper proposes the novel BEL three‐tier intrusion detection architecture which is based novel bat optimized extreme learning machines to detect the various cyber‐attacks over the IoT network. The proposed system consists of (1) design of scalable IoT deployable software which is used to collect the data which are used to classify the different behaviors of IoT networks and (2) data analyzer mechanism (DAM) which analyzes the various malicious characteristics of IoT networks after incurring the attacks in the networks and classifies the type of attacks that has been injected. The real‐time scenario of smart IoT networks for smart automation has been created using API NDNOMNeT which is an extension of OMNeT++ in which the 100 IoT devices has been deployed and attack methodology has been created by Python API. The efficiency of the projected IDS planning has been evaluated on the above test beds, deploying different attacks categories such as denial of services (DoS), man in middle (MIM)/spoofing, replay, and data leakage. The experiments demonstrate that the performance of the proposed IDS architecture has outperformed the other existing learning‐based IDS in terms of accuracy, sensitivity, time complexity, and reliability. [ABSTRACT FROM AUTHOR]

Summary: For the purpose of obtaining an answer to a spoofing IP issue and related problems in the cloud computing (CC) environment, a novel path identifier is recommended, in which a new packet approach with a new identifier (ID) is produced to every user or client system. For the purpose of identification of the spoofing attack, any watermark image pattern is introduced. Following this, the hypervisor is employed to ascertain plausible trust relationships among the VMs by considering personal sources that can be trusted along with utilizing empirical Bayesian inference (EBI) for the purpose of combining the VMs. With a restricted budget of resources for the maximized detection of attacks, an optimal detection load distribution strategy by improved cuckoo search (ICS) over VMs can be used, which thus provides the intended solution to the hypervisor. The ICS algorithm directs a hypervisor so as to assert among the VMs the optimal load distribution, taking into consideration real time, which causes maximization of the DDoS attacks and detection of transmission control protocol (TCP) flood attacks. Lastly, a fuzzy extreme learning machine (FELM) classifier is proposed in order to detect the attacks. [ABSTRACT FROM AUTHOR]

Summary: Software‐defined networking (SDN) is an emerging paradigm in enterprise networks because of its flexible and cost‐effective nature. By decoupling control and data plane, SDN can provide various defense solutions for securing futuristic networks. However, the architectural design and characteristics of SDN attract several severe attacks. Distributed denial of service (DDoS) is considered as a major destructive cyber attack that makes the services of controller unavailable for its legitimate users. In this research article, an intrusion detection framework is proposed to detect DDoS attacks against SDN. The proposed framework relies on voting‐based ensemble model for the attack detection. Ensemble model is a combination of multiple machine learning classifiers for prediction of final results. In this research article, we propose and analyze three ensemble models named as Voting‐CMN, Voting‐RKM, and Voting‐CKM particularly to benchmarking datasets such as UNSW‐NB15, CICIDS2017, and NSL‐KDD, respectively. For validation of the proposed models, a cross‐validation technique is used with the prediction algorithms. The effectiveness of proposed models is evaluated in terms of prominent metrics (accuracy, precision, recall, and F‐measure). Experimental results indicate that the proposed models achieve better performance in terms of accuracy as compared with other existing models. [ABSTRACT FROM AUTHOR]

Summary: Background: One of the significant attacks targeting the application layer is the distributed denial‐of‐service (DDoS) attack. It degrades the performance of the server by usurping its resources completely, thereby denying access to legitimate users and causing losses to businesses and organizations. Aim: This study aims to investigate existing methodologies for application‐layer DDoS (APDDoS) attack defense by using specific measures: detection methods/techniques, attack strategy, and feature exploration of existing APDDoS mechanisms. Methodology: The review is carried out on a database search of relevant literature in IEEE Xplore, ACM, Science Direct, Springer, Wiley, and Google Search. The search dates to capture journals and conferences are from 2000 to 2019. Review papers that are not in English and not addressing the APDDoS attack are excluded. Three thousand seven hundred eighty‐nine studies are identified and streamlined to a total of 75 studies. A quantifiable assessment is performed on the selected articles using six search procedures, namely: source, methods/technique, attack strategy, datasets/corpus, status, detection metric, and feature exploration. Results: Based on existing methods/techniques for detection, the results show that machine learning gave the highest proportion with 36%. However, assessment based on attack strategy shows that several studies do not consider an attack form for deploying their solution. Result based on existing features for the APDDoS detection technique shows request stream during a user session and packet pattern gave the highest result with 47%. Unlike packet header information with 33%, request stream during absolute time interval with 12% and web user features 8%. Conclusion: Research findings show that a large proportion of the solutions for APDDoS attack detection utilized features based on request stream during user session and packet pattern. The optimization of features will improve detection accuracy. Our study concludes that researchers need to exploit all attack strategies using deep learning algorithms, thus enhancing effective detection of APDDoS attack launch from different botnets. [ABSTRACT FROM AUTHOR]

Summary: We describe techniques based on symbolic execution for finding software vulnerabilities that are due to algorithmic complexity. Such vulnerabilities allow an attacker to mount denial‐of‐service attacks to deny service to benign users or to otherwise disable a software system. The techniques use an efficient guided symbolic execution of a program to compute bounds on the worst‐case complexity (for increasing input sizes) and to generate test values that trigger the worst‐case behaviours. The resulting bounds are fitted to a function to obtain a prediction of the worst‐case program behaviour at any input size. Scalability is achieved by using path policies that guide the symbolic execution towards worst‐case paths. The policies are learned from the worst‐case results obtained with exhaustive exploration at small input sizes and are applied to guide exploration at larger input sizes, where unguided exhaustive exploration is not possible. To achieve precision in the analysis, the path policies take into account the history of choices made along the path when deciding which branch to execute next. Furthermore, the computation is contextpreserving, meaning that the decision for each branch depends on the history computed with respect to the enclosing method. We further report preliminary results on a complementary technique that uses machine learning for building the path policies that guide the search. The techniques are implemented in open‐source projects that build on the Symbolic Pathfinder tool for analysing Java programs. Experimental evaluation shows that the techniques can find vulnerabilities in complex Java programs and can outperform previous symbolic approaches. [ABSTRACT FROM AUTHOR]

Summary: Summary Software‐Defined Networking (SDN) is an emerging network paradigm that has gained significant traction from many researchers to address the requirement of current data centers. Although central control is the major advantage of SDN, it is also a single point of failure if it is made unreachable by a Distributed Denial of Service (DDoS) attack. Despite the large number of traditional detection solutions that exist currently, DDoS attacks continue to grow in frequency, volume, and severity. This paper brings an analysis of the problem and suggests the implementation of four machine learning algorithms (SVM, MLP, Decision Tree, and Random Forest) with the purpose of classifying DDoS attacks in an SDN simulated environment (Mininet 2.2.2). With this goal, the DDoS attacks were simulated using the Scapy tool with a list of valid IPs, acquiring, as a result, the best accuracy with the Random Forest algorithm and the best processing time with the Decision Tree algorithm. Moreover, it is shown the most important features to classify DDoS attacks and some drawbacks in the implementation of a classifier to detect the three kinds of DDoS attacks discussed in this paper (controller attack, flow‐table attack, and bandwidth attack). [ABSTRACT FROM AUTHOR]

Summary: Software Defined Networks (SDNs) have been extensively studied in recent years. The centralised and programmable controller also brings many security challenges. As a conventional attack with the purpose of destruction, Distributed Denial of Service (DDoS) is still a threat for Software Defined Networks (SDNs). There is a lack of trust evaluation and management mechanism between the OpenFlow switches in SDNs. Therefore, in this paper, we propose a trust evaluation and management model, namely, the Intelligent Trust Model (ITM). In this framework, the Extreme Learning Machine (ELM) is applied to detect hybrid DDoS in Software Definition Networks (SDNs). Our model (ITM) can update the trust value of the OpenFlow switches in real time and respond quickly to different types of DDoS attacks. Compared with others, the experiment results show that our model can provide more efficient detection with high detection accuracy and low false positive rate for the hybrid DDoS attack. At last, in our proposal, OpenFlow switches with higher trust have a relatively higher priority. Therefore, we solve the flow conflict issue in the infrastructure layer. [ABSTRACT FROM AUTHOR]

Summary: Detecting malicious behavior is important for preventing security threats in a computer network. Denial of Service (DoS) is among the popular cyber attacks targeted at web sites of high‐profile organizations and can potentially have high economic and time costs. In this paper, several machine learning methods including ensemble models and autoencoder‐based deep learning classifiers are compared and tuned using Bayesian optimization. The autoencoder framework enables to extract new features by mapping the original input to a new space. The methods are trained and tested both for binary and multi‐class classification on Digiturk and Labris datasets, which were introduced recently for detecting various types of DDoS attacks. The best performing methods are found to be ensembles though deep learning classifiers achieved comparable level of accuracy. [ABSTRACT FROM AUTHOR]

Summary: Cloud computing is one of the most tempting technologies in today's computing scenario as it provides a cost‐efficient solutions by reducing the large upfront cost for buying hardware infrastructures and computing power. Fog computing is an added support to cloud environment by leveraging with doing some of the less compute intensive task to be done at the edge devices, which reduces the response time for end user computing. But the vulnerabilities to these systems are still a big concern. Among several security needs, availability is one that makes the demanded services available to the targeted customers all the time. Availability is often challenged by external attacks like Denial of service (DoS) and distributed denial of service (DDoS). This paper demonstrates a novel source‐based DDoS mitigating schemes that could be employed in both fog and cloud computing scenarios to eliminate these attacks. It deploys the DDoS defender module which works on a machine learning–based light detection method, present at the SDN controller. This scheme uses the network traffic data to analyze, predict, and filter incoming data, so that it can send the filtered legitimate packets to the server and blocking the rest. [ABSTRACT FROM AUTHOR]

Two supervised learning algorithms, a basic neural network and a long short‐term memory recurrent neural network, are applied to traffic including DDoS attacks. The joint effects of preprocessing methods and hyperparameters for machine learning on performance are investigated. Values representing attack characteristics are extracted from datasets and preprocessed by two methods. Binary classification and two optimizers are used. Some hyperparameters are obtained exhaustively for fast and accurate detection, while others are fixed with constants to account for performance and data characteristics. An experiment is performed via TensorFlow on three traffic datasets. Three scenarios are considered to investigate the effects of learning former traffic on sequential traffic analysis and the effects of learning one dataset on application to another dataset, and determine whether the algorithms can be used for recent attack traffic. Experimental results show that the used preprocessing methods, neural network architectures and hyperparameters, and the optimizers are appropriate for DDoS attack detection. The obtained results provide a criterion for the detection accuracy of attacks. [ABSTRACT FROM AUTHOR]

Summary: With an exponential increase in the data size and complexity of various documents to be investigated, existing methods of network forensics are found not much efficient with respect to accuracy and detection ratio. The existing techniques for network forensic analysis exhibit inherent limitations while processing a huge volume, variety, and velocity of data. It makes network forensic a time‐consuming and resource‐consuming task. To balance time taken and output delivered, these existing techniques put a limit on the amount of data under analysis, which results in a polynomial time complexity of these solutions. So to mitigate these issues, in this paper, we propose an effective framework to overcome the limitation to handle large volume, variety, and velocity of data. An architectural setup that consists of MapReduce framework on top of Hadoop Distributed File System environment is proposed in this paper. The proposed framework demonstrates its capability to handle issues of storage and processing of big data using cloud computing. Also, in the proposed framework, supervised machine learning (random forest‐based decision tree) algorithm has been implemented to demonstrate better sensitivity. To train and validate the model, online available data set from CAIDA is taken and university network traffic samples, with increasing size, has been taken for experiment. Results thus obtained confirm the superiority of the proposed framework in network forensics, with an average accuracy of 99.34% (malicious and nonmalicious traffic). [ABSTRACT FROM AUTHOR]