Search

A vehicular ad hoc network (VANET) has significantly improved transportation efficiency with efficient traffic management, driving safety, and delivering emergency messages. However, existing IP-based VANETs encounter numerous challenges, like security, mobility, caching, and routing. To cope with these limitations, named data networking (NDN) has gained significant attention as an alternative solution to TCP/IP in VANET. NDN offers promising features, like intermittent connectivity support, named-based routing, and in-network content caching. Nevertheless, NDN in VANET is vulnerable to a variety of attacks. On top of attacks, an interest flooding attack (IFA) is one of the most critical attacks. The IFA targets intermediate nodes with a storm of unsatisfying interest requests and saturates network resources such as the Pending Interest Table (PIT). Unlike traditional rule-based statistical approaches, this study detects and prevents attacker vehicles by exploiting a machine learning (ML) binary classification system at roadside units (RSUs). In this connection, we employed and compared the accuracy of five (5) ML classifiers: logistic regression (LR), decision tree (DT), K-nearest neighbor (KNN), random forest (RF), and Gaussian naïve Bayes (GNB) on a publicly available dataset implemented on the ndnSIM simulator. The experimental results demonstrate that the RF classifier achieved the highest accuracy (94%) in detecting IFA vehicles. On the other hand, we evaluated an attack prevention system on Python that enables intermediate vehicles to accept or reject interest requests based on the legitimacy of vehicles. Thus, our proposed IFA detection technique contributes to detecting and preventing attacker vehicles from compromising the network resources. [ABSTRACT FROM AUTHOR]

The study in this paper characterizes lightweight IoT networks as being established by devices with few computer resources, such as reduced battery life, processing power, memory, and, more critically, minimal security and protection, which are easily vulnerable to DDoS attacks and propagating malware. A DDoS attack detection model is crucial for attacks in various industries, ensuring the availability and reliability of their networks and systems. The model distinguishes between legitimate and malicious traffic by analyzing network traffic patterns and identifying anomalies. This safeguards critical infrastructure, preserves business continuity, and protects the user experience, minimizing the impact of DDoS attacks. Numerous scholars have studied the notion that protecting lightweight IoT networks essentially requires improving intrusion detection systems. This research is valuable, as it follows a tailored pre-processing methodology specific to IoT network challenges, addressing a pressing need in cybersecurity by focusing on a growing concern related to IoT devices and DDoS attacks, enhancing the security of essential network systems in various industries by effectively detecting DDoS attacks, and developing a lightweight intrusion detection system that aligns with the limited resources of IoT devices. This manuscript proposes a compact and lightweight intrusion detection system that blends machine learning classifiers with a fresh approach to data pre-processing. The handling of missing values, data standardization using Standard Scalar, feature selection using ExtraTreeClassifier wherein only the 15 best features are extracted, and anomaly detection using a classifier are performed. The network dataset of TON-IOT and BOT-IOT datasets is used for experiments, specifically binary classifications and multiple-class classification for the experiment with DDoS and all attacks, respectively. There is an imbalance between the TON-IOT and BOT-IOT attack classes. In trials using the TON-IOT and BOT-IOT datasets, the classes were balanced using several iterations of the SMOTE approach. This research provides a number of classifier types, namely logistic regression, random forest, naïve bayes, artificial neural network, and k nearest neighbor algorithms, which are used to build a lightweight intrusion detection system that is ideally suited for protecting against DDoS attacks in IoT networks. The time taken to train and predict the DDoS attacks is also implemented. Random forest performed well under TON-IOT and naïve bayes performed well under BOT-IOT under binary and multiple-class classification, achieving an accuracy of 100% with less training and prediction time. [ABSTRACT FROM AUTHOR]

Smart cities have experienced significant growth in recent years, transforming people's lives into a more futuristic version. The smart city initiative includes a diverse collection of specifications, encompassing a large number of users whose requirements vary significantly and heterogeneously. Each device in smart cities generates a significant amount of data, which places a load on the gateways. Smart cities face a major challenge due to the enormous amount of data they generate. Through software-defined networking (SDN), network information paths are optimized, ensuring that traffic flow is evenly distributed across all network nodes. A considerable number of IoT devices with limited resources are susceptible to various security threats, such as device hijacking, ransomware, man-in-the-middle (MiM) attacks, and distributed denial-of-service (DDoS) attacks. These threats can pose a severe challenge to network security. Additionally, DDoS attacks have disrupted web businesses, resulting in the loss of valuable data. To counter DDoS attacks in a smart city, several options exist, yet many challenges remain. This research presents a secure and intelligent system to combat DDoS attacks on smart cities. SDN security controllers and machine learning models with optimization are employed in this study to reduce the impact of common DDoS attacks on smart cities. This work utilizes an SDN based on security controllers and a detection mechanism rooted in a machine learning model with optimization to mitigate various types of prevalent DDoS attacks within smart cities. Employing binary classification, XGBoost achieved an accuracy of 99.99%, precision of 97%, recall of 99%, an F1 score of 98%, and a false-positive rate of 0.05. In multiclass classification, the average accuracy is 99.29%, precision is 97.7%, recall is 96.69%, and the F1 score is 97.51%. These results highlight the superiority of this approach over other existing machine learning techniques. [ABSTRACT FROM AUTHOR]

Software-defined networking (SDN) is becoming the standard for the management of networks due to its scalability and flexibility to program the network. SDN provides many advantages but it also involves some specific security problems; for example, the controller can be taken down using cyber attacks, which can result in the whole network shutting down, creating a single point of failure. In this paper, DDoS attacks in SDN are detected using AI-enabled machine and deep learning models with some specific features for a dataset under normal DDoS traffic. In our approach, the initial dataset is collected from 84 features on Kaggle and then the 20 top features are selected using a permutation importance algorithm. The dataset is learned and tested with five AI-enabled models. Our experimental results show that the use of a machine learning-based random forest model achieves the highest accuracy rate of 99.97% in DDoS attack detection in SDN. Our contributions through this study are, firstly, that we found the top 20 features that contributed to DDoS attacks. Secondly, we reduce the time and cost of comparing various learning models and their performance in determining a learning model suitable for DDoS detection. Finally, various experimental methods to evaluate the performance of the learning model are presented so that related researchers can utilize them. [ABSTRACT FROM AUTHOR]

Summary: Software defined network (SDN) is a paradigm that emphasizes the separation of the control plane from the data plane, offering advantages such as flexibility and programmability. However, from a security perspective, SDN also introduces new vulnerabilities due to the communication required between these planes. SYN Flood attacks are typical distributed denial‐of‐service (DDoS) attacks that especially challenge network administrators since they produce a large volume of semi‐open TCP connections to a target, compromising its availability. Most of the current solutions to detect and mitigate these attacks are designed to operate at the control plane, imposing an additional overhead on controller functions. Moreover, traffic‐blocking mechanisms, a widely used alternative to protect network resources, have the drawback of restricting legitimate traffic. This work proposes DataPlane‐ML, an integrated solution to detect and mitigate DDoS attacks on SDN, acting directly in the data plane. DataPlane‐ML uses machine learning techniques for attack detection and a mitigation solution based on the node's reputation to avoid blocking legitimate traffic during an attack. Experimental results show that DataPlane‐ML is ≈26%$$ \approx 26\% $$ faster than statistical‐based solutions for attack detection while presenting better accuracy. Moreover, the DataPlane‐ML mitigation solution can preserve more than 95%$$ 95\% $$ of legitimate traffic during an attack. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) and Address Resolution Protocol (ARP) attacks pose significant threats to the security of Software-Defined Internet of Things (SD-IoT) networks. The standard Software-Defined Networking (SDN) architecture faces challenges in effectively detecting, preventing, and mitigating these attacks due to its centralized control and limited intelligence. In this paper, we present P4-HLDMC, a novel collaborative secure framework that combines machine learning (ML), stateful P4, and a hierarchical logically distributed multi-controller architecture. P4-HLDMC overcomes the limitations of the standard SDN architecture, ensuring scalability, performance, and an efficient response to attacks. It comprises four modules: the multi-controller dedicated interface (MCDI) for real-time attack detection through a distributed alert channel (DAC), the MSMPF, a P4-enabled stateful multi-state matching pipeline function for analyzing IoT network traffic using nine state tables, the modified ensemble voting (MEV) algorithm with six classifiers for enhanced detection of anomalies in P4-extracted traffic patterns, and an attack mitigation process distributed among multiple controllers to effectively handle larger-scale attacks. We validate our framework using diverse test cases and real-world IoT network traffic datasets, demonstrating high detection rates, low false-alarm rates, low latency, and short detection times compared to existing methods. Our work introduces the first integrated framework combining ML, stateful P4, and SDN-based multi-controller architecture for DDoS and ARP detection in IoT networks. [ABSTRACT FROM AUTHOR]

The cyberspace is a convenient platform for creative, intellectual, and accessible works that provide a medium for expression and communication. Malware, phishing, ransomware, and distributed denial-of-service attacks pose a threat to individuals and organisations. To detect and predict cyber threats effectively and accurately, an intelligent system must be developed. Cybercriminals can exploit Internet of Things devices and endpoints because they are not intelligent and have limited resources. A hybrid decision tree method (HIDT) is proposed in this article that integrates machine learning with blockchain concepts for anomaly detection. In all datasets, the proposed system (HIDT) predicts attacks in the shortest amount of time and has the highest attack detection accuracy (99.95% for the KD99 dataset and 99.72% for the UNBS-NB 15 dataset). To ensure validity, the binary classification test results are compared to those of earlier studies. The HIDT's confusion matrix contrasts with previous models by having low FP/FN rates and high TP/TN rates. By detecting malicious nodes instantly, the proposed system reduces routing overhead and has a lower end-to-end delay. Malicious nodes are detected instantly in the network within a short period. Increasing the number of nodes leads to a higher throughput, with the highest throughput measured at 50 nodes. The proposed system performed well in terms of the packet delivery ratio, end-to-end delay, robustness, and scalability, demonstrating the effectiveness of the proposed system. Data can be protected from malicious threats with this system, which can be used by governments and businesses to improve security and resilience. [ABSTRACT FROM AUTHOR]

Intrusion detection systems are increasingly using machine learning. While machine learning has shown excellent performance in identifying malicious traffic, it may increase the risk of privacy leakage. This paper focuses on implementing a model stealing attack on intrusion detection systems. Existing model stealing attacks are hard to implement in practical network environments, as they either need private data of the victim dataset or frequent access to the victim model. In this paper, we propose a novel solution called Fast Model Stealing Attack (FMSA) to address the problem in the field of model stealing attacks. We also highlight the risks of using ML-NIDS in network security. First, meta-learning frameworks are introduced into the model stealing algorithm to clone the victim model in a black-box state. Then, the number of accesses to the target model is used as an optimization term, resulting in minimal queries to achieve model stealing. Finally, adversarial training is used to simulate the data distribution of the target model and achieve the recovery of privacy data. Through experiments on multiple public datasets, compared to existing state-of-the-art algorithms, FMSA reduces the number of accesses to the target model and improves the accuracy of the clone model on the test dataset to 88.9% and the similarity with the target model to 90.1%. We can demonstrate the successful execution of model stealing attacks on the ML-NIDS system even with protective measures in place to limit the number of anomalous queries. [ABSTRACT FROM AUTHOR]

Having a large number of device connections provides attackers with multiple ways to attack a network. This situation can lead to distributed denial-of-service (DDoS) attacks, which can cause fiscal harm and corrupt data. Thus, irregularity detection in traffic data is crucial in detecting malicious behavior in a network, which is essential for network security and the integrity of modern Cyber–Physical Systems (CPS). Nevertheless, studies have shown that current techniques are ineffective at detecting DDoS attacks on networks, especially in the case of high-speed networks (HSN), as detecting attacks on the latter is very complex due to their fast packet processing. This review aims to study and compare different approaches to detecting DDoS attacks, using machine learning (ML) techniques such as k-means, K-Nearest Neighbors (KNN), and Naive Bayes (NB) used in intrusion detection systems (IDSs) and flow-based IDSs, and expresses data paths for packet filtering for HSN performance. This review highlights the high-speed network accuracy evaluation factors, provides a detailed DDoS attack taxonomy, and classifies detection techniques. Moreover, the existing literature is inspected through a qualitative analysis, with respect to the factors extracted from the presented taxonomy of irregular traffic pattern detection. Different research directions are suggested to support researchers in identifying and designing the optimal solution by highlighting the issues and challenges of DDoS attacks on high-speed networks. [ABSTRACT FROM AUTHOR]

In recent years, the Internet of Things (IoT) has gained much popularity, increasing the flow of sensitive user data across the web. In addition, the adoption of fog and edge technologies for latency-sensitive applications aggravates the privacy issues in the scenario as the sensitive data are processed in the user vicinity. Furthermore, the presence of the processing layer near the user end increases the attack surface and thus attracts malicious or curious intruders. In this light, the authors present a stacked-ensemble privacy-preserving attack detection framework, P2ADF. The framework detects the popular man-in-the-middle (MiTM) and denial-of-service (DoS)/distributed DoS (DDoS) attacks in the fog-IoT setup with a maximum accuracy of about 99.98 percent. The proposed model is trained over benchmark datasets, say, IoTID20, TON_IoT, N-BaIoT, UNSW-NB15, and CICDDoS19. The performance of the proposed model is also compared to existing state-of-the-art approaches, and P2ADF outperforms them all. [ABSTRACT FROM AUTHOR]

Denial-of-service (DoS) attacks conducted on online systems cause the targeted resources to become inoperative. This is caused by the abnormal traffic intentionally directed toward the system resources by the attacker(s). Several techniques can be used to detect and mitigate such attacks, and machine learning (ML) is one of them. Herein, the literature on ML techniques used to address DDoS attacks is systematically reviewed. Five search engines are used to identify relevant studies, the results are filtered based on specific selection criteria, and 48 studies are shortlisted and analyzed. Considerable variations are observed in the literature with respect to the datasets used for training ML models, with more than 20 datasets being used. To conduct performance evaluations, most studies have employed the accuracy metric. More than 30 modeling algorithms have been used to build the ML models. The outcomes of this review reveal the state of the literature and the manner in which the problem of DDoS attacks has been dealt with. Our results can guide future studies toward more constructive methods than the existing ones to address this problem. [ABSTRACT FROM AUTHOR]

Security poses a substantial challenge in the context of wireless sensor networks (WSNs). WSNs, which are frequently employed for real-time monitoring in various Internet of Things (IoT)-based applications, are particularly vulnerable to a range of Denial of Service (DoS) attacks. These attacks represent a significant security concern and are among the most prevalent issues confronting WSNs today.In our research, we have introduced a WSN DoS dataset using the Matrix Laboratory (MATLAB) tool. This dataset was developed through the utilization of the Leach Protocol and incorporates various types of DoS attacks, including Wormhole, Blackhole, Grayhole, Flooding, and Time Division Multiple Access (TDMA) attacks. In our study, we assessed the performance of several machine learning techniques using our dataset. We employed various performance evaluation metrics that gauge both the classification accuracy and the complexity of these machine learning models. These metrics included parameters such as the number of accurately classified and misclassified instances, along with the time required for constructing the model. This comprehensive evaluation aimed to demonstrate the effectiveness of our proposed approach.The results of our analysis revealed that the Light Gradient Boosting Machine (LightGBM), Extreme Gradient Boosting (XGBoost), and Bagging algorithms exhibited strong performance on our dataset. They achieved impressive accuracy levels of up to 99.16%, 99.16%, and 99.8%, respectively, when using 14 features. Additionally, these algorithms achieved accuracy rates of 99.16%, 98.75%, and 99.8%, respectively, with 5 features, and 95.41%, 95%, and 93.75%, respectively, when considering only 3 features such as node ID and Energy-Consumed, Attack_type. Notably, LightGBM outperformed the others in terms of speed, as it employs a leaf-wise growth strategy, consumes less memory, and requires less time for model construction. Consequently, LightGBM emerged as the most efficient choice for our WSN DoS dataset. [ABSTRACT FROM AUTHOR]

The recent surge in the attention garnered by blockchain technology, an immutable ledger enabling decentralized transactions, is noteworthy. However, the security of blockchain remains susceptible to various attacks, including distributed denial-of-service (DDoS) attacks, which have increasingly targeted Bitcoin services. In response, deep learning algorithms have emerged as a potent solution to complex problems within the realm of information science. This study proposes a novel approach, utilizing these algorithms within hybrid frameworks, to address intricate cybersecurity issues. The methodologies were implemented and fine-tuned within a Python environment. Initially, a technique known as data augmentation was applied to an experimental domain aimed at verifying efficiency and boosting precision in complex datasets. Data augmentation, a method of generating new data points from existing ones, artificially enhances the volume of data. A Conditional Table Generative Adversarial Network (CTGAN) approach was adopted for the creation of tabular synthetic data. The utilization of synthetic data was found to enhance the model's performance and robustness compared to the exclusive use of original data. Subsequently, a binary classification hybrid deep learning model, incorporating Recurrent Neural Network (RNN) and Long Short-Term Memory (LSTM) algorithms, was proposed for the detection of DDoS attacks within cryptocurrency networks. The proposed model was then validated using actual instances of DDoS attacks within the Bitcoin service dataset. The validation process incorporated a test set comprising 20% of the augmented data. Evidently, the proposed model outperformed standard deep learning implementations, achieving an impressive accuracy of approximately 95.84%. This study, therefore, presents a promising approach to mitigating DDoS attacks within the Bitcoin ecosystem. [ABSTRACT FROM AUTHOR]

Recently, the process control network (PCN) of oil and gas installation has been subjected to amorphous cyber-attacks. Examples include the denial-of-service (DoS), distributed denial-of-service (DDoS), and man-in-the-middle (MitM) attacks, and this may have largely been caused by the integration of open network to operation technology (OT) as a result of low-cost network expansion. The connection of OT to the internet for firmware updates, third-party support, or the intervention of vendors has exposed the industry to attacks. The inability to detect these unpredictable cyber-attacks exposes the PCN, and a successful attack can lead to devastating effects. This paper reviews the different forms of cyber-attacks in PCN of oil and gas installations while proposing the use of machine learning algorithms to monitor data exchanges between the sensors, controllers, processes, and the final control elements on the network to detect anomalies in such data exchanges. Python 3.0 Libraries, Deep-Learning Toolkit, MATLAB, and Allen Bradley RSLogic 5000 PLC Emulator software were used in simulating the process control. The outcomes of the experiments show the reliability and functionality of the different machine learning algorithms in detecting these anomalies with significant precise attack detections identified using tree algorithms (bagged or coarse) for man-in-the-middle (MitM) attacks while taking note of accuracy-computation complexity trade-offs. [ABSTRACT FROM AUTHOR]

The software defined network (SDN) collects network traffic data and proactively manages networks. SDN's programmability makes it excellent for developing distributed applications, cybersecurity, and decentralized network control in multitenant data centers. This exceptional architecture is vulnerable to security concerns, such as distributed denial of service (DDoS) attacks. DDoS attacks can be very serious due to the fact that they prevent authentic users from accessing, temporarily or indefinitely, resources they would normally expect to have. Moreover, there are continuous efforts from attackers to produce new techniques to avoid detection. Furthermore, many existing DDoS detection methods now in use have a high potential for producing false positives. This motivates us to provide an overview of the research studies that have already been conducted in this area and point out the strengths and weaknesses of each of those approaches. Hence, adopting an optimal detection method is necessary to overcome these issues. Thus, it is crucial to accurately detect abnormal flows to maintain the availability and security of the network. In this work, we propose hybrid deep learning algorithms, which are the long short-term memory network (LSTM) and convolutional neural network (CNN) with a stack autoencoder for DDoS attack detection and checkpoint network, which is a fault tolerance strategy for long-running processes. The proposed approach is trained and tested with the aid of two DDoS attack datasets in the SDN environment: the DDoS attack SDN dataset and Botnet dataset. The results show that the proposed model achieves a very high accuracy, reaching 99.99% in training, 99.92% in validation, and 100% in precision, recall, and F1 score with the DDoS attack SDN dataset. Also, it achieves 100% in all metrics with the Botnet dataset. Experimental results reveal that our proposed model has a high feature extraction ability and high performance in detecting attacks. All performance metrics indicate that the proposed approach is appropriate for a real-world flow detection environment. [ABSTRACT FROM AUTHOR]

In recent times, distributed denial of service (DDoS) has been one of the most prevalent security threats in internet-enabled networks, with many internet of things (IoT) devices having been exploited to carry out attacks. Due to their inherent security flaws, the attacks seek to deplete the resources of the target network by flooding it with numerous spoofed requests from a distributed system. Research studies have demonstrated that a DDoS attack has a considerable impact on the target network resources and can result in an extended operational outage if not detected. The detection of DDoS attacks has been approached using a variety of methods. In this paper, a comprehensive survey of the methods used for DDoS attack detection on selected internet-enabled networks is presented. This survey aimed to provide a concise introductory reference for early researchers in the development and application of attack detection methodologies in IoT-based applications. Unlike other studies, a wide variety of methods, ranging from the traditional methods to machine and deep learning methods, were covered. These methods were classified based on their nature of operation, investigated as to their strengths and weaknesses, and then examined via several research studies which made use of each approach. In addition, attack scenarios and detection studies in emerging networks such as the internet of drones, routing protocol based IoT, and named data networking were also covered. Furthermore, technical challenges in each research study were identified. Finally, some remarks for enhancing the research studies were provided, and potential directions for future research were highlighted. [ABSTRACT FROM AUTHOR]

With the rise of DDoS attacks, several machine learning-based attack detection models have been used to mitigate malicious behavioral attacks. Understanding how machine learning models work is not trivial. This is particularly true for complex and nonlinear models, such as deep learning models that have high accuracy. The struggle to explain these models creates a tension between accuracy and explanation. Recently, different methods have been used to explain deep learning models and address ambiguity issues. In this paper, we utilize the LSTM model to classify DDoS attacks. We then investigate the explanation of LSTM using LIME, SHAP, Anchor, and LORE methods. Predictions of 17 DDoS attacks are explained by these methods, where common explanations are obtained for each class. We also use the output of the explanation methods to extract intrinsic features needed to differentiate DDoS attacks. Our results demonstrate 51 intrinsic features to classify attacks. We finally compare the explanation methods and evaluate them using descriptive accuracy (DA) and descriptive sparsity (DS) metrics. The comparison and evaluation show that the explanation methods can explain the classification of DDoS attacks by capturing either the dominant contribution of input features in the prediction of the classifier or a set of features with high relevance. [ABSTRACT FROM AUTHOR]

Amongst network and Intrusion Detection System (IDS) threats, Distributed Denial of Service (DDoS) attacks often take precedence due to their significant potential to disrupt services, leading to financial and reputational damages for organizations. This study employs eight advanced machine learning techniques to distinguish between two types of DDoS attacks: DoS Hulk and DoS Slow HTTP Test. The applied algorithms include Decision Tree (DT), Random Forest (RF), Gradient Boosting (GB), AdaBoost, Naive Bayes (NB), Extreme Gradient Boosting (XGB), Ridge regression, and Multilayer Perceptron (MLP). Utilizing a Python environment, these methods were applied to the DDoS attacks in the CICIDS2017 dataset for classification into benign or DoS categories across two distinct experiments. The results were highly encouraging: The first experiment achieved an accuracy rate exceeding 99%, while the second experiment achieved a perfect success rate of 100%. These findings outperform those of previous studies in terms of their efficiency, demonstrating the potential of these machine learning techniques in enhancing DDoS attack detection. [ABSTRACT FROM AUTHOR]

With the emergence of technology, the usage of IoT (Internet of Things) devices is said to be increasing in people's lives. Such devices can benefit the average individual, who does not necessarily have to have technical knowledge. The IoT can be found in home security and alarm systems, smart fridges, smart televisions, and more. Although small Internet-connected devices have numerous benefits and can help enhance people's efficiency, they also can pose a security threat. Malicious actors often attempt to find new ways to exploit and utilize certain resources, and IoT devices are a perfect candidate for such exploitation due to the huge volume of active devices. This is particularly true for Distributed Denial of Service (DDoS) attacks, which involve the exploitation of a massive number of devices, such as IoT devices, to act as bots and send fraudulent requests to services, thus obstructing them. To identify and detect whether such attacks have occurred or not in a network, there must be a reliable mechanism of detection based on adequate techniques. The most common technique for this purpose is artificial intelligence, which involves the use of Machine Learning (ML) and Deep Learning (DL) to help identify cyberattacks. ML models involve algorithms that use structured data to learn from, predict outcomes from, and identify patterns. The goal of this paper is to review selected studies and publications relevant to the topic of DDoS detection in IoT-based networks using machine-learning-relevant publications. It offers a wealth of references for academics looking to define or expand the scope of their research in this area. [ABSTRACT FROM AUTHOR]

Distributed denial-of-service (DDoS) attacks pose a significant cybersecurity threat to software-defined networks (SDNs). This paper proposes a feature-engineering- and machine-learning-based approach to detect DDoS attacks in SDNs. First, the CSE-CIC-IDS2018 dataset was cleaned and normalized, and the optimal feature subset was found using an improved binary grey wolf optimization algorithm. Next, the optimal feature subset was trained and tested in Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbor (k-NN), Decision Tree, and XGBoost machine learning algorithms, from which the best classifier was selected for DDoS attack detection and deployed in the SDN controller. The results show that RF performs best when compared across several performance metrics (e.g., accuracy, precision, recall, F1 and AUC values). We also explore the comparison between different models and algorithms. The results show that our proposed method performed the best and can effectively detect and identify DDoS attacks in SDNs, providing a new idea and solution for the security of SDNs. [ABSTRACT FROM AUTHOR]

Nowadays, the Internet of Things (IoT) concept plays a pivotal role in society and brings new capabilities to different industries. The number of IoT solutions in areas such as transportation and healthcare is increasing and new services are under development. In the last decade, society has experienced a drastic increase in IoT connections. In fact, IoT connections will increase in the next few years across different areas. Conversely, several challenges still need to be faced to enable efficient and secure operations (e.g., interoperability, security, and standards). Furthermore, although efforts have been made to produce datasets composed of attacks against IoT devices, several possible attacks are not considered. Most existing efforts do not consider an extensive network topology with real IoT devices. The main goal of this research is to propose a novel and extensive IoT attack dataset to foster the development of security analytics applications in real IoT operations. To accomplish this, 33 attacks are executed in an IoT topology composed of 105 devices. These attacks are classified into seven categories, namely DDoS, DoS, Recon, Web-based, brute force, spoofing, and Mirai. Finally, all attacks are executed by malicious IoT devices targeting other IoT devices. The dataset is available on the CIC Dataset website. [ABSTRACT FROM AUTHOR]

Botnets pose a real threat to cybersecurity by facilitating criminal activities like malware distribution, attacks involving distributed denial of service, fraud, click fraud, phishing, and theft identification. The methods currently used for botnet detection are only appropriate for specific botnet commands and control protocols; they do not endorse botnet identification in early phases. Security guards have used honeypots successfully in several computer security defence systems. Honeypots are frequently utilised in botnet defence because they can draw botnet compromises, reveal spies in botnet membership, and deter attacker behaviour. Attackers who build and maintain botnets must devise ways to avoid honeypot traps. Machine learning methods support identification and inhibit bot threats to address the problems associated with botnet attacks. To choose the best features to feed as input to the machine learning classifiers to estimate the performance of botnet detection, a Kernel-based Ensemble Meta Classifier (KEMC) Strategy is suggested in this work. And particle swarm optimization (PSO) and genetic algorithm (GA) intelligent optimization algorithms are used to establish the ideal order. The model covered in this paper is employed to forecast Internet cyber security circumstances. The Binary Cross-Entropy (loss), the GA-PSO optimizer, the Softsign activation functions and ensembles were used in the experiment to produce the best results. The model succeeded because Forfileless malware, gathered from well-known datasets, achieved a total accuracy of 93.3% with a True Positive (TP) Range of 87.45% at zero False Positive (FP). [ABSTRACT FROM AUTHOR]

The impact of a Distributed Denial of Service (DDoS) attack on Software Defined Networks (SDN) is briefly analyzed. Many approaches to detecting DDoS attacks exist, varying on the feature being considered and the method used. Still, the methods have a deficiency in the performance of detecting DDoS attacks and mitigating them. To improve the performance of SDN, an efficient Real-time Multi-Constrained Adaptive Replication and Traffic Approximation Model (RMCARTAM) is sketched in this article. The RMCARTAM considers different parameters or constraints in running different controllers responsible for handling incoming packets. The model is designed with multiple controllers to handle network traffic but can turn the controllers according to requirements. The multi-constraint adaptive replication model monitors different features of network traffic like rate of packet reception, class-based packet reception and target-specific reception. According to these features, the method estimates the Replication Turning Weight (RTW) based on which triggering controllers are performed. Similarly, the method applies Traffic Approximation (TA) in the detection of DDoS attacks. The detection of a DDoS attack is performed by approximating the incoming traffic to any service and using various features like hop count, payload, service frequency, and malformed frequency to compute various support measures on bandwidth access, data support, frequency support, malformed support, route support, and so on. Using all these support measures, the method computes the value of legitimate weight to conclude the behavior of any source in identifying the malicious node. Identified node details are used in the mitigation of DDoS attacks. The method stimulates the network performance by reducing the power factor by switching the controller according to different factors, which also reduces the cost. In the same way, the proposed model improves the accuracy of detecting DDoS attacks by estimating the features of incoming traffic in different corners. [ABSTRACT FROM AUTHOR]

This paper presents a system implementation to detect and classify different DDoS attacks. The system adopts features of inter-arrival time, entropy, and packet length distribution for a hybrid machine learning model, which is based on the hierarchical temporal memory (HTM) with a k-nearest neighbors (KNN) classifier that can mine network traffic anomalies. Furthermore, it can incrementally learn new traffic behavior and recognize new types of attacks. Finally, system evaluation is conducted based on the CICDDoS 2019 dataset. Thus, the proposed system can successfully identify different attacks with high detection rate, accuracy, and precision. [ABSTRACT FROM AUTHOR]

As the number of devices linked to the Internet (IOT devices) has dramatically increased, botnet attacks are becoming one of the most serious threats on the Internet. Many studies have been proposed for botnet detection based on machine learning. However, most of these existing studies focus on offline botnet detection using supervised machine learning methods. Since botnet attacks are committed in real time, they require online detection. Also, classification may not be practical for IOT applications such as botnet detection for many reasons that will be discussed in this paper. In order to overcome this limitation in the existing models, we propose an online botnet detection technique using unsupervised hybrid DBSCAN-GWO architecture. In this model, DBSCAN's eps parameter is generated automatically for each data stream using grey wolf optimizer which searches for the optimum eps value to give the best clustering quality for each data stream adaptively. After finding clusters in each data stream, a comparison is made between the clusters depending on the difference between their values to find the botnet clusters for each data stream adaptively. This model is evaluated using N_BaIot datasets of six different IOT devices. The results show the efficiency of DBSCAN-GWO model in detecting botnet data in all datasets compared to the regular DBSCAN with 3 different eps values and OPTICS clustering algorithms, as the best accuracy reaches 98%, which is also compared to a number of existing techniques which are the semi-supervised K-means clustering algorithm of 79.60%, DBSCAN clustering algorithm of 80%, and clustering-based semi-supervised machine learning approach of 96.66% for detecting anomalies and DDOS attacks. [ABSTRACT FROM AUTHOR]

LSTM (Long Short-Term Memory) and CNN (Convolutional Neural Networks) are two types of deep learning algorithms; by combining the strengths of LSTM and CNN, researchers have developed deep learning models that can effectively detect SDN (Software-Defined Network) attacks including Distributed Denial of Service. These models effectively analyze network traffic, encompassing temporal and spatial characteristics, resulting in precise identification of malicious traffic. In this research, a hybrid model composed of CNN and LSTM is used to detect the DDoS attack in SDN network. Where the CNN component of the model can identify spatial patterns in network traffic, such as the characteristics of individual packets, while the LSTM component can capture temporal patterns in traffic over time, such as the timing and frequency of traffic bursts. The proposed model has been trained on a labeled network traffic dataset, with one class representing normal traffic and another class representing DDoS attack traffic. During the training process, the model adjusts its weights and biases to minimize the difference between its predicted output and the actual output for each input sample. Once trained, the hybrid model classifies incoming network traffic in the dataset as either normal or malicious with an initial accuracy of (78.18%) and losses of (39.77%) at the 1st epoch till it reaches an accuracy of (99.99%) with losses of (9.29×10-5) at the epoch number 500. It should be mentioned that the hybrid model of CNN and LSTM for DDoS detection is implemented using Python Anaconda platform with an ETA 28ms/step. [ABSTRACT FROM AUTHOR]

With the development of the Internet of Things, a huge number of devices are connected to the network, network traffic is exhibiting massive and low latency characteristics. At the same time, it is becoming cheaper and cheaper to launch DDoS attacks, and the attack traffic is becoming larger and larger. Software-defined networking SDN is proposed as a new network architecture. However, the controller as the core of SDN is vulnerable to DDoS attacks and causes a single point of failure in the network. This paper combines the ideas of distributed and edge computing, firstly, a DDoS attack detection algorithm using heterogeneous integrated feature selection and random forest algorithm is proposed. Then, this DDoS attack detection algorithm is distributed and deployed on the edge equipment switches of SDN to perform distributed edge parallel computing using the residual computing power of the switches for fast and accurate detection of DDoS attacks. Finally, simulation experiments are conducted in the SDN environment using the CIC-DDoS2019 dataset to evaluate the effectiveness and feasibility of the proposed scheme. The experimental results show that the performance evaluation metrics of this solution: accuracy, precision, recall and F-value all reach 99.99%, while the prediction time is only 0.4 s, all metrics are better than other DDoS attack detection methods in the same category. Therefore, this solution is able to detect DDoS attacks in a timely and accurate manner. [ABSTRACT FROM AUTHOR]

This paper discusses the Internet of Things (IoT) and the security challenges associated with it. IoT is a network of interconnected devices that share information. However, the low power and resources of IoT devices make them vulnerable to attacks. Using heavy protocols like HTTP for IoT devices can prove costly and using popular lightweight protocols like CoAP can invite attacks such as DoS (Denial-of-Service). While security models such as DTLS and LSPWSN can secure IoT against such attacks, they also have limitations. To overcome this problem, this paper proposes a machine learning model that detects DoS amplification attacks against CoAP with 99% accuracy. To the best of our knowledge, this research is the first to use the multi-classification process to detect and classify the different types of the DoS amplification techniques that attack CoAP client use against victim CoAP clients. [ABSTRACT FROM AUTHOR]

The increasing use of Internet of Things (IoT) devices has led to a rise in Distributed Denial of Service (DDoS) and Denial of Service (DoS) attacks on these networks. These attacks can have severe consequences, resulting in the unavailability of critical services and financial losses. In this paper, we propose an Intrusion Detection System (IDS) based on a Conditional Tabular Generative Adversarial Network (CTGAN) for detecting DDoS and DoS attacks on IoT networks. Our CGAN-based IDS utilizes a generator network to produce synthetic traffic that mimics legitimate traffic patterns, while the discriminator network learns to differentiate between legitimate and malicious traffic. The syntactic tabular data generated by CTGAN is employed to train multiple shallow machine-learning and deep-learning classifiers, enhancing their detection model performance. The proposed approach is evaluated using the Bot-IoT dataset, measuring detection accuracy, precision, recall, and F1 measure. Our experimental results demonstrate the accurate detection of DDoS and DoS attacks on IoT networks using the proposed approach. Furthermore, the results highlight the significant contribution of CTGAN in improving the performance of detection models in machine learning and deep learning classifiers. [ABSTRACT FROM AUTHOR]

Wireless Local Area Networks (WLANs) have revolutionized modern communication by providing a user-friendly and cost-efficient solution for Internet access and network resources. However, the increasing popularity of WLANs has also led to a rise in security threats, including jamming, flooding attacks, unfair radio channel access, user disconnection from access points, and injection attacks, among others. In this paper, we propose a machine learning algorithm to detect Layer 2 threats in WLANs through network traffic analysis. Our approach uses a deep neural network to identify malicious activity patterns. We detail the dataset used, including data preparation steps, such as preprocessing and division. We demonstrate the effectiveness of our solution through series of experiments and show that it outperforms other methods in terms of precision. The proposed algorithm can be successfully applied in Wireless Intrusion Detection Systems (WIDS) to enhance the security of WLANs and protect against potential attacks. [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) is a massive network based on tiny devices connected internally and to the internet. Each connected device is uniquely identified in this network through a dedicated IP address and can share the information with other devices. In contrast to its alternatives, IoT consumes less power and resources; however, this makes its devices more vulnerable to different types of attacks as they cannot execute heavy security protocols. Moreover, traditionally used heavy protocols for web-based communication, such as the Hyper Text Transport Protocol (HTTP) are quite costly to be executed on IoT devices, and thus specially designed lightweight protocols, such as the Constrained Application Protocol (CoAP) are employed for this purpose. However, while the CoAP remains widely-used, it is also susceptible to attacks, such as the Distributed Denial-of-Service (DDoS) attack, which aims to overwhelm the resources of the target and make them unavailable to legitimate users. While protocols, such as the Datagram Transport Layer Security (DTLS) and Lightweight and the Secure Protocol for Wireless Sensor Network (LSPWSN) can help in securing CoAP against DDoS attacks, they also have their limitations. DTLS is not designed for constrained devices and is considered as a heavy protocol. LSPWSN, on the other hand, operates on the network layer, in contrast to CoAP which operates on the application layer. This paper presents a machine learning model, using the CIDAD dataset (created on 11 July 2022), that can detect the DDoS attacks against CoAP with an accuracy of 98%. [ABSTRACT FROM AUTHOR]

Detecting anomalously behaving devices in security-and-safety-critical applications is an important challenge. This article presents an off-device methodology for detecting the anomalous behavior of devices considering their power consumption data. The methodology takes advantage of the fact that every action on-board a device will be reflected in its power trace. This argument makes it inevitable for anomalously behaving device to go undetected. We transform the device's one-dimensional (1D) instantaneous power consumption signals to 2D time–frequency images using Constant Q Transformation (CQT). The CQT images capture valuable information about the tasks performed on-board a device. By applying Histograms of Oriented Gradients (HOG) on the CQT images, we extract robust features that preserve the edges of time–frequency structures and capture the directionality of the edge information. Consequently, we transform the anomaly detection problem into an image classification problem. We train a Convolutional Neural Network on the HOG images to classify the power signals to detect anomaly. We validated the methodology using a wide spectrum of emulated malware scenarios, five real malware applications from the well-known Drebin dataset, Distributed Denial of Service attacks, cryptomining malware, and faulty CPU cores. Across 18 datasets, our methodology demonstrated detection performance of ∼88% accuracy and 85% F-Score, resulting in improvements of 9–17% over other methods using power signals. [ABSTRACT FROM AUTHOR]

The exponential growth of the Internet of Things (IoT) has led to the rapid expansion of interconnected systems, which has also increased the vulnerability of IoT devices to security threats such as distributed denial-of-service (DDoS) attacks. In this paper, we propose a machine learning pipeline that specifically addresses the issue of DDoS attack detection in IoT networks. Our approach comprises of (i) a processing module to prepare the data for further analysis, (ii) a dynamic attribute selection module that selects the most adaptive and productive features and reduces the training time, and (iii) a classification module to detect DDoS attacks. We evaluate the effectiveness of our approach using the CICI-IDS-2018 dataset and five powerful yet simple machine learning classifiers—Decision Tree (DT), Gaussian Naive Bayes, Logistic Regression (LR), K-Nearest Neighbor (KNN), and Random Forest (RF). Our results demonstrate that DT outperforms its counterparts and achieves up to 99.98% accuracy in just 0.18 s of CPU time. Our approach is simple, lightweight, and accurate for detecting DDoS attacks in IoT networks. [ABSTRACT FROM AUTHOR]

This paper focuses on the implementation of nfstream, an open source network data analysis tool and machine learning model using the TensorFlow library for HTTP attack detection. HTTP attacks are common and pose a significant security threat to networked systems. In this paper, we propose a machine learning-based approach to detect the aforementioned attacks, by exploiting the machine learning capabilities of TensorFlow. We also focused on the collection and analysis of network traffic data using nfstream, which provides a detailed analysis of network traffic flows. We pre-processed and transformed the collected data into vectors, which were used to train the machine learning model using the TensorFlow library. The proposed model using nfstream and TensorFlow is effective in detecting HTTP attacks. The machine learning model achieved high accuracy on the tested dataset, demonstrating its ability to correctly identify HTTP attacks while minimizing false positives. [ABSTRACT FROM AUTHOR]

In recent times, providing privacy to the medical dataset has been the biggest issue in medical applications. Since, in hospitals, the patient's data are stored in files, the files must be secured properly. Thus, different machine learning models were developed to overcome data privacy issues. But, those models faced some problems in providing privacy to medical data. Therefore, a novel model named Honey pot-based Modular Neural System (HbMNS) was designed in this paper. Here, the performance of the proposed design is validated with disease classification. Also, the perturbation function and the verification module are incorporated into the designed HbMNS model to provide data privacy. The presented model is implemented in a python environment. Moreover, the system outcomes are estimated before and after fixing the perturbation function. A DoS attack is launched in the system to validate the method. At last, a comparative assessment is made between executed models with other models. From the comparison, it is verified that the presented model achieved better outcomes than others. [ABSTRACT FROM AUTHOR]

The advent of the digital era has brought unprecedented convenience and efficiency to the banking sector. However, it has also exposed financial institutions to a multitude of cyber threats. In particular, the increasing value of banking information in the digital realm has made it an attractive target for malicious actors. The repercussions of successful hacking attempts on these systems can be severe, ranging from financial losses to compromised customer data and erosion of trust in the banking sector. Consequently, bolstering the security of banking systems has become a paramount concern. This paper undertakes a comprehensive analysis of the security landscape surrounding financial organizations by leveraging a bank dataset comprising 15,000 samples and 38 variables. Through rigorous data analysis techniques, the dataset is utilized to train a Random Forest algorithm, which is then employed to evaluate and identify Distributed Denial-of-Service (DDoS) attacks launched against financial institutions. The results of this study are highly promising, as the Random Forest algorithm achieves an impressive accuracy rate of 99% in identifying potential security flaws. By providing valuable insights and empirical evidence, this research contributes to the existing body of knowledge in the field of cyber security, specifically concerning the detection and prevention of DDoS attacks in financial organizations. [ABSTRACT FROM AUTHOR]

Industrial automation and control systems have gained increasing attention in the literature recently. Their integration with various systems has triggered considerable developments in critical infrastructure systems. With different network structures, these systems need to communicate with each other, work in an integrated manner, be controlled, and intervene effectively when necessary. Supervision Control and Data Acquisition (SCADA) systems are mostly utilized to achieve these aims. SCADA systems, which control and monitor the connected systems, have been the target of cyber attackers. These systems are subject to cyberattacks due to the openness to external networks, remote controllability, and SCADA-architecture-specific cyber vulnerabilities. Protecting SCADA systems on critical infrastructure systems against cyberattacks is an important issue that concerns governments in many aspects such as economics, politics, transport, communication, health, security, and reliability. In this study, we physically demonstrated a scaled-down version of a real water plant via a Testbed environment created including a SCADA system. In order to disrupt the functioning of the SCADA system in this environment, five attack scenarios were designed by performing various DDoS attacks, i.e., TCP, UDP, SYN, spoofing IP, and ICMP Flooding. Additionally, we evaluated a scenario with the baseline behavior of the SCADA system that contains no attack. During the implementation of the scenarios, the SCADA system network was monitored, and network data flow was collected and recorded. CNN models, LSTM models, hybrid deep learning models that amalgamate CNN and LSTM, and traditional machine learning models were applied to the obtained data. The test results of various DDoS attacks demonstrated that the hybrid model and the decision tree model are the most suitable for such environments, reaching the highest test accuracy of 95% and 99%, respectively. Moreover, we tested the hybrid model on a dataset that is used commonly in the literature which resulted in 98% accuracy. Thus, it is suggested that the security of the SCADA system can be effectively improved, and we demonstrated that the proposed models have a potential to work in harmony on real field systems. [ABSTRACT FROM AUTHOR]

Software-defined networking (SDN) is a revolutionary innovation in network technology with many desirable features, including flexibility and manageability. Despite those advantages, SDN is vulnerable to distributed denial of service (DDoS), which constitutes a significant threat due to its impact on the SDN network. Despite many security approaches to detect DDoS attacks, it remains an open research challenge. Therefore, this study presents a systematic literature review (SLR) to systematically investigate and critically analyze the existing DDoS attack approaches based on machine learning (ML), deep learning (DL), or hybrid approaches published between 2014 and 2022. We followed a predefined SLR protocol in two stages on eight online databases to comprehensively cover relevant studies. The two stages involve automatic and manual searching, resulting in 70 studies being identified as definitive primary studies. The trend indicates that the number of studies on SDN DDoS attacks has increased dramatically in the last few years. The analysis showed that the existing detection approaches primarily utilize ensemble, hybrid, and single ML-DL. Private synthetic datasets, followed by unrealistic datasets, are the most frequently used to evaluate those approaches. In addition, the review argues that the limited literature studies demand additional focus on resolving the remaining challenges and open issues stated in this SLR. [ABSTRACT FROM AUTHOR]

DDoS attacks remain a persistent cybersecurity threat, blocking services to legitimate users and causing significant damage to reputation, finances, and potential customers. For the detection of DDoS attacks, machine learning techniques such as supervised learning have been extensively employed, but their effectiveness declines when the framework confronts patterns exterior to the dataset. In addition, DDoS attack schemes continue to improve, rendering conventional data model-based training ineffectual. We have developed a novelty open-set recognition framework for DDoS attack detection to overcome the challenges of traditional methods. Our framework is built on a Convolutional Neural Network (CNN) construction featuring geometrical metric (CNN-Geo), which utilizes deep learning techniques to enhance accuracy. In addition, we have integrated an incremental learning module that can efficiently incorporate novel unknown traffic identified by telecommunication experts through the monitoring process. This unique approach provides an effective solution for identifying and alleviating DDoS. The module continuously improves the model's performance by incorporating new knowledge and adapting to new attack patterns. The proposed model can detect unknown DDoS attacks with a detection rate of over 99% on conventional attacks from CICIDS2017. The model's accuracy is further enhanced by 99.8% toward unknown attacks with the open datasets CICDDoS2019. [ABSTRACT FROM AUTHOR]

Software-defined networking (SDN) has emerged as a promising approach for managing network infrastructure through a centralized controller. However, the dynamic nature of SDN makes it susceptible to security threats, including DoS and DDoS attacks. Intrusion detection systems (IDS) based on machine learning (ML) can efficiently detect and mitigate these attacks. This study compares two ML models, namely support vector machines (SVM) and artificial neural networks (ANN), for intelligent intrusion detection in SDN. To assess the performance of the ML models, we utilized the NSL-KDD dataset, with a specific emphasis on DDoS attacks, and compared their accuracy (Acc), precision, recall, and F1-score metrics. The implementation outcomes show that SVM is better than ANN regarding response time and Acc. [ABSTRACT FROM AUTHOR]

The purpose of the study is to establish probable trends in the development of algorithmic means of network security and the protection of web resources in the future. The research methods used in this publication are a bibliometric analysis of 500 relevant publications, which allowed us to establish probable trends in the future development of the subject field. The study found that currently the most likely algorithmic means of network security and website protection that will be intensively developed in the future are blockchain technologies (to protect inter-resource contact), deep and machine learning (to analyze and detect attacks and digital anomalies), artificial intelligence and neural networks (to develop complex security algorithms), and predictive analysis (to prevent possible attacks and malicious data injections). At the same time, technological development makes it possible to identify alternative security tools, including quantum and post-quantum cryptography (which is possible due to the development of quantum computing), augmented reality (which is the next iteration of the development of the interface between machine-human interaction), biometric identification (which is the next iteration of authentication and recognition systems) and DevSecOps (which is a promising technology for the production of digital tools and systems that have a relatively lower level of vulnerability to known digital threats). The correlative impact of Industry 4.0 technologies and solutions on the studied aspects of the security sector of the World Wide Web has been established. The growth of the network of devices requires the improvement of security algorithms in the paradigm of Industry 4.0 technologies, which will allow more effective detection and prevention of cyberattacks and protection of user data. [ABSTRACT FROM AUTHOR]

Concept drift is a main security issue that has to be resolved since it presents a significant barrier to the deployment of machine learning (ML) models. Due to attackers’ (and/or benign equivalents’) dynamic behavior changes, testing data distribution frequently diverges from original training data over time, resulting in substantial model failures. Due to their dispersed and dynamic nature, distributed denial-of-service attacks pose a danger to cybersecurity, resulting in attacks with serious consequences for users and businesses. This paper proposes a novel design for concept drift analysis and detection of malware attacks like Distributed Denial of Service (DDOS) in the network. The goal of this architecture combination is to accurately represent data and create an effective cyber security prediction agent. The intrusion detection system and concept drift of the network has been analyzed using secure adaptive windowing with website data authentication protocol (SAW_WDA). The network has been analyzed by authentication protocol to avoid malware attacks. The data of network users will be collected and classified using multilayer perceptron gradient decision tree (MLPGDT) classifiers. Based on the classification output, the decision for the detection of attackers and authorized users will be identified. The experimental results show output based on intrusion detection and concept drift analysis systems in terms of throughput, end-end delay, network security, network concept drift, and results based on classification with regard to accuracy, memory, and precision and F-1 score. [ABSTRACT FROM AUTHOR]

In recent few years, flying ad hoc networks are utilized more for interconnectivity. In the topological scenario of FANETs, IoT nodes are available on ground where UAVs collect information. Due to high mobility patterns of UAVs cause disruption where intruders easily deploy cyberattacks like DoS/DDoS. Flying ad hoc networks use to have UAVs, satellite, and base station in the physical structure. IoT-based UAV networks are having many applications which include agriculture, rescue operations, tracking, and surveillance. However, DoS/DDoS attacks disturb the behaviour of entire FANET which lead to unbalance energy, end-to-end delay, and packet loss. This research study is focused about the detail study of machine learning-based IDS. Also, cognitive lightweight-LR approach is modeled using UNSW-NB 15 dataset. IoT-based UAV network is introduced using machine learning to detect possible security attacks. The queuing and data traffic model is utilized to implement DT, RF, XGBoost, AdaBoost, Bagging and logistic regression in the environment of IoT-based UAV network. Logistic regression is the proposed approach which is used to estimate statistical possibility. Overall, experimentation is based on binomial distribution. There exists linear association approach in logistic regression. In comparison with other techniques, logistic regression behaviour is lightweight and low cost. The simulation results presents logistic regression better results in contrast with other techniques. Also, high accuracy is balanced well in optimal way. [ABSTRACT FROM AUTHOR]

Machine learning (ML) is efficiently disrupting and modernizing cities in terms of service quality for mobility, security, robotics, healthcare, electricity, finance, etc. Despite their undeniable success, ML algorithms need crucial computational efforts with high-speed computing hardware to deal with model complexity and commitments to obtain efficient, reliable, and resilient solutions. Quantum computing (QC) is presented as a strong candidate to help MLs reach their best performance especially for cybersecurity issues and digital defense. This paper presents quantum support vector machine (QSVM) model to detect distributed denial of service (DDoS) attacks on smart micro-grid (SMG). An evaluation of our approach against a real dataset of DDoS attack instances shows the effectiveness of our proposed model. Finally, conclusions and some open issues and challenges of the fitting of ML with QC are presented. [ABSTRACT FROM AUTHOR]

Connected and autonomous vehicles (CAVs) present exciting opportunities for the improvement of both the mobility of people and the efficiency of transportation systems. The small computers in autonomous vehicles (CAVs) are referred to as electronic control units (ECUs) and are often perceived as being a component of a broader cyber–physical system. Subsystems of ECUs are often networked together via a variety of in-vehicle networks (IVNs) so that data may be exchanged, and the vehicle can operate more efficiently. The purpose of this work is to explore the use of machine learning and deep learning methods in defence against cyber threats to autonomous cars. Our primary emphasis is on identifying erroneous information implanted in the data buses of various automobiles. In order to categorise this type of erroneous data, the gradient boosting method is used, providing a productive illustration of machine learning. To examine the performance of the proposed model, two real datasets, namely the Car-Hacking and UNSE-NB15 datasets, were used. Real automated vehicle network datasets were used in the verification process of the proposed security solution. These datasets included spoofing, flooding and replay attacks, as well as benign packets. The categorical data were transformed into numerical form via pre-processing. Machine learning and deep learning algorithms, namely k-nearest neighbour (KNN) and decision trees, long short-term memory (LSTM), and deep autoencoders, were employed to detect CAN attacks. According to the findings of the experiments, using the decision tree and KNN algorithms as machine learning approaches resulted in accuracy levels of 98.80% and 99%, respectively. On the other hand, the use of LSTM and deep autoencoder algorithms as deep learning approaches resulted in accuracy levels of 96% and 99.98%, respectively. The maximum accuracy was achieved when using the decision tree and deep autoencoder algorithms. Statistical analysis methods were used to analyse the results of the classification algorithms, and the determination coefficient measurement for the deep autoencoder was found to reach a value of R2 = 95%. The performance of all of the models that were built in this way surpassed that of those already in use, with almost perfect levels of accuracy being achieved. The system developed is able to overcome security issues in IVNs. [ABSTRACT FROM AUTHOR]

Nowadays, the number of Distributed Denial of Service (DDoS) attacks is growing rapidly. The aim of these type of attacks is to make the prominent and critical services unavailable for legitimate users. HTTP flooding is one of the most common DDoS attacks and because of its implementation in application layer, it is difficult to detect and prevent by the current defense mechanisms. This attack not only makes the web servers unavailable, but consumes the computational resources of the network equipment and congests communication links. Recently, the advent of Software Defined Networking (SDN) paradigm has enabled the network providers to detect and mitigate application layer DDoS attacks such as HTTP flooding. In this paper, we propose a defense mechanism named HTTPScout which leverages the benefits of SDN together with Machine Learning (ML) techniques to detect and mitigate HTTP flooding attack. HTTPScout is implemented as a security module in RYU controller and monitors the behavior of HTTP traffic flows. Upon detecting a malicious flow, it blocks the source of the attack at the edge switch and preserves the network resources from the adversarial effects of the attack. Simulation results confirm that HTTPScout brings a significant improvement of 64% in bandwidth consumption and 80% in the number of forwarding rules compared to normal SDN. [ABSTRACT FROM AUTHOR]