Search

In fifth-generation (5G)-based vehicular networks, vehicles share information about the road's condition to make driving safer and alleviate traffic congestion. Given the public nature of the medium, addressing issues of confidentiality and security is of paramount importance. Existing systems are vulnerable to a distributed denial-of-service (DDoS) attack from an attacker or high traffic in a dense area because of the time-consuming and complex operations based on bilinear pair and elliptic curve cryptographies used. In order to protect vehicle-to-vehicle communication in 5G-based vehicular networks from DDoS attacks, a strategy based on the Chebyshev polynomial is proposed in this study. The semi-group and chaotic features of the Chebyshev polynomial are utilised in our proposal. Our solutions also meet all applicable standards for security and privacy, such as node authentication, message integrity, preserving identity privacy, traceability, unlinkability, and resistance to attacks. Finally, our innovation decreases the computational burden to produce a message signature by 66.67% and the burden to verify a signature by 33.33%. However, the size of the message-signature tuple is affected by the communication expenses of our work by 5.00%. [ABSTRACT FROM AUTHOR]

Mobile Health (m-Health) has become an integral part of modern healthcare, utilizing digital devices like laptops, smart phones, and tablets to facilitate the rapid exchange of real-time patient data through interconnected channels. However, the reliance on centralized cloud computing in m-health systems introduces potential security vulnerabilities. Among these threats, Distributed Denial of Service (DDoS) attacks pose a significant risk, capable of disrupting networks and compromising system reliability. The research paper addresses the vulnerability of m-healthcare systems to DDoS attacks and proposes a four-layered architecture to enhance security measures. The focus on recognizing and identifying DDoS attacks within the system is crucial for early detection and prevention of potential harm. Moreover, the exploration of different deterrence approaches in a virtualized cloud-based environment allows for a comprehensive assessment of their effectiveness. The analysis of performance metrics, particularly the maximum and mean values of DDoS attack success rates, provides valuable insights into the efficacy of the proposed architecture and defense mechanisms. This information will undoubtedly assist in refining and strengthening the system's security measures to mitigate the impact of potential DDoS attacks. Overall, the research paper delves into a critical aspect of m-healthcare system security, shedding light on the vulnerabilities and proposing feasible solutions. By adopting a proactive approach to counter DDoS attacks, the proposed architecture holds the potential to significantly enhance the reliability and privacy of m-health systems, ultimately benefiting patients and healthcare providers alike. The proposed approach taken is innovative and promising. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attacks constitute a formidable threat, obstructing access to legitimate internet services and disrupting the seamless provision of services by organizations. Despite extensive research dedicated to developing defense mechanisms against DDoS attacks, their persistence remains a challenge. The majority of research in DDoS defense can be categorized into attack detection, mitigation, and prevention. Notably, defense strategies falling within the purview of attack detection and mitigation are reactive in nature, often activated after some level of damage has already occurred. In addition, the terms "detection" and "mitigation," maintain consistent meanings in the literature. However, the term "prevention" in the context of DDoS attacks has been associated with varying interpretations in the literature. This paper undertakes a comprehensive review of techniques labeled as "prevention" in the realm of DDoS attacks. In addition, because prevention techniques do not have a standard meaning in the literature, we further classify these techniques into Ideal Prevention, True Prevention, and Partial Prevention. By scrutinizing these techniques and their implications, we shed light on the complexity of mitigating DDoS threats effectively. In particular, we advocate for increased focus on True Prevention techniques, emphasizing the need for dynamism, computational efficiency, scalability, and practical deployability. [ABSTRACT FROM AUTHOR]

In the world of connected devices, there is huge growth of less secure Internet of Things (IoT) devices, and the ease of performing sophisticated cyberattacks using these devices has posed a serious threat to the security of Internet-based services or networks. Distributed Denial of Service (DDoS) attack is one of the most significant cyberattacks. It aims to damage or exhaust victims' resources, services, or networks and make them unavailable to legitimate users. Several solutions are available in the literature to detect DDoS attacks. However, it is difficult to detect them in real-time due to today's high speed or high volume of attack traffic. Therefore, this paper proposes an Apache Storm-based distributed detection approach for IoT network traffic-based DDoS attacks, namely SDDA-IoT. SDDA-IoT is composed of two primary modules: model development and model deployment. In the case of model development, we created five distributed detection models by utilizing a Hadoop cluster and the extremely scalable H2O.ai machine learning platform. In the case of model deployment, we deploy an efficient distributed detection model on the Apache Storm stream processing framework for analyzing ingress streaming data and classifying it into seven classes in near-real-time. To create new models or update existing ones, this module also saves the highly discriminating input features of each network flow along with the predicted outcome in the Hadoop Distributed File System (HDFS). The effectiveness of the SDDA-IoT approach has been examined using a variety of configured scenarios. The experimental results show that the SDDA-IoT approach detects DDoS attacks faster than recent state-of-the-art methods and more accurately with 99%+ accuracy. [ABSTRACT FROM AUTHOR]

The increasing reliance on internet-based services has heightened the vulnerability of network infrastructure to cyberattacks, particularly distributed denial of service (DDoS) attacks. These attacks can cause severe disruptions and significant financial losses. Early detection of malicious traffic is crucial in effectively combating such threats. This paper presents an innovative approach called the Encoder-Stacked deep neural networks (E-SDNN) model, which leverages Stacked/bagged multi-layer perceptrons (MLP) for accurate DDoS attack detection. The proposed method employs an encoder to select pertinent features from a preprocessed dataset, enabling precise attack detection. Extensive experiments were conducted on benchmark cybersecurity datasets, namely CICDS2017 and CICDDoS2019, encompassing various DDoS attack scenarios. The experimental results demonstrate the superiority of the E-SDNN model compared to state-of-the-art methods. The proposed E-SDNN model achieved an impressive overall accuracy rate of 99.94% and 98.86% for CICDDS2017 and CICDDoS2019, respectively. [ABSTRACT FROM AUTHOR]

With the proliferation of the Internet, the number of cyber-attacks has increased worldwide. To prevent cyber-attacks, network administrators need to use analytical tools to disclose six new critical statistics such as Internet Protocol (IP) authenticity and classification, IP ownership, frequency of attacks, time of day, day of the week, and country of attack. There are four SSH attack analysis tools available, but existing tools lack visualization and cannot provide the necessary attack statistics. This paper proposes SSHAA, the first open source PyPI analysis tool that meets the requirement. Text mining technology is used for extracting data from SSH log files, classifying IPs with identified country names and calculating a variety of statistics. PyPI allows SSHAA to run on Windows, MacOS, and Linux operating systems. This paper highlights how to debut a PyPI application using SSHAA which will be the world’s first tutorial in the security journals for maximum software dissemination. According to PePy, SSHAA has been downloaded 7668 times worldwide. The substantial number of downloads signifies the efficacy of the proposed tool. The proposed system offers ten functional statistics for SSH attack analysis. The six new functional statistics to information security are significant. [ABSTRACT FROM AUTHOR]

The early and accurate detection of Distributed Denial of Service (DDoS) attacks is a fundamental area of research to safeguard the integrity and functionality of organizations' digital ecosystems. Despite the growing importance of neural networks in recent years, the use of classical techniques remains relevant due to their interpretability, speed, resource efficiency, and satisfactory performance. This article presents the results of a comparative analysis of six machine learning techniques, namely, Random Forest (RF), Decision Tree (DT), AdaBoost (ADA), Extreme Gradient Boosting (XGB), Multilayer Perceptron (MLP), and Dense Neural Network (DNN), for classifying DDoS attacks. The CICDDoS2019 dataset was used, which underwent data preprocessing to remove outliers, and 22 features were selected using the Pearson correlation coefficient. The RF classifier achieved the best accuracy rate (99.97%), outperforming other classifiers and even previously published neural network-based techniques. These findings underscore the feasibility and effectiveness of machine learning algorithms in the field of DDoS attack detection, reaffirming their relevance as a valuable tool in advanced cyber defense. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) has shown incredible adaptability in recent years and has become an integral part of human life. The proliferation of IoT technology has made IoT devices more prone to severe security threats, such as Distributed Denial of Service (DDoS) attacks, which are dangerous threats to public systems and networks. Further, the frequency and complexity of IoT traffic-based DDoS attacks are increasing year-by-year. This article proposes an IoT traffic-based DDoS attack detection approach for classifying incoming IoT network traffic into 11 classes using multiclass machine learning techniques. The proposed approach comprises two phases: (i) designing and (ii) detection. In the designing phase, we employ the embedded feature reduction technique to create cost-effective and efficient classification models with a high feature reduction rate. Further, we evaluate these models using the K-fold cross-validation technique. While in the detection phase, we evaluate the performance of an efficient model by executing four different IoT traffic-based scenarios. A publicly available Bot-IoT dataset is employed to design and validate the proposed multiclass classification approach. The results show that the proposed approach provides an 84.4% feature reduction rate and approximately 5.19% higher classification accuracy than the existing approaches. [ABSTRACT FROM AUTHOR]

In recent days, with the rapid advancement of technology in informatics systems, the Internet of Things (IoT) becomes crucial in many aspects of daily life. IoT applications have gained popularity due to the availability of various IoT enabler gadgets, such as smartwatches, smartphones, and so on. However, the vulnerability of IoT devices has led to security challenges, including Distributed Denial-of-Service (DDoS) attacks. These limitations result from the dynamic communication between IoT devices due to their limited data storage and processing resources. The primary research challenge is to create a model that can recognize legitimate traffic while effectively protecting the network against various classes of DDoS attacks. This article proposes a CNN-BiLSTM DDoS detection model by combining three deep-learning algorithms. The models are evaluated using the CICIDS2017 dataset against commonly used performance criteria which the models perform well, achieving an accuracy of around 99.76%, except for the CNN model, which achieves an accuracy of 98.82%. The proposed model performs best, achieving an accuracy of 99.9%. [ABSTRACT FROM AUTHOR]

Due to rising cyber threats, IoT devices' security vulnerabilities are expanding. However, these devices cannot run complicated security algorithms locally due to hardware restrictions. Data must be transferred to cloud nodes for processing, giving attackers an entry point. This research investigates distributed computing on the edge, using AI-enabled IoT devices and container orchestration tools to process data in real time at the network edge. The purpose is to identify and mitigate DDoS assaults while minimizing CPU usage to improve security. It compares typical IoT devices with and without AI-enabled chips, container orchestration, and assesses their performance in running machine learning models with different cluster settings. The proposed architecture aims to empower IoT devices to process data locally, minimizing the reliance on cloud transmission and bolstering security in IoT environments. The results correlate with the update in the architecture. With the addition of AI-enabled IoT device and container orchestration, there is a difference of 60% between the new architecture and traditional architecture where only Raspberry Pi were being used. [ABSTRACT FROM AUTHOR]

In today's digital landscape, Distributed Denial of Service (DDoS) attacks stand out as a formidable threat to organisations all over the world. As known technology gradually advances and the proliferation of mobile devices, cellular network operators face pressure to fortify their infrastructure against these risks. DDoS incursions into Cellular Long-Term Evolution (LTE) networks can wreak havoc, elevate packet loss, and suboptimal network performance. Managing the surges in traffic that afflict LTE networks is of paramount importance. Queue management algorithms emerge as a viable solution to wrest control over congestion at the Radio Link Control (RLC) layer within LTE networks. These algorithms work proactively, anticipating, and mitigating congestion by curtailing data transfer rates and fortifying defences against potential DDoS onslaughts. In the paper, we delve into a range of queue management methods Drop-Tail, Random Early Detection (RED), Controlled Delay (CoDel), Proportional Integral Controller Enhanced (PIE), and Packet Limited First In, First Out queue (pFIFO). Our rigorous evaluation of these queue management algorithms hinges on a multifaceted assessment that encompasses vital performance parameters. We gauge the LTE network's resilience against DDoS incursions, measuring performance based on end-to-end delay, throughput, packet delivery rate (PDF), and fairness index values. The crucible for this evaluation is none other than the NS3 simulator, a trusted platform for testing and analysis. The outcomes of our simulations provide illuminating insights. CoDel, RED, PIE, pFIFO, and Drop-Tail algorithms emerge as top performers in succession. These findings underscore the critical role of advanced queue management algorithms in fortifying LTE networks against DDoS attacks, offering robust defences and resilient network performance. [ABSTRACT FROM AUTHOR]

IoT networks are increasingly being connected to a wide range of devices, and the number of devices connected has significantly increased in recent years. As a consequence, the number of vulnerabilities to IoT networks has also been increasing tremendously. In IoT networks, botnet‐based Distributed Denial of Service attack is challenging due to its dynamic behavior. The sensors and actuators connected to IoT networks are low‐powered and have less memory. Because of their inherent vulnerability, IoT devices can always be compromised by an attacker and be used to form a large botnet. A detailed analysis of IoT botnet attacks is presented in this article, along with statistics and the architectures of the botnet. We also survey the existing literature on IoT botnet traffic analysis and present a taxonomy of attack detection methods. We particularly focus on deep learning‐based methods and conduct a comparative study to evaluate their performance on IoT traffic analysis. We identify the current issues and research challenges in this field, and we conclude by highlighting some future research directions. [ABSTRACT FROM AUTHOR]

Supervisory Control and Data Acquisition (SCADA) systems, which play a critical role in monitoring, managing, and controlling industrial processes, face flexibility, scalability, and management difficulties arising from traditional network structures. Software-defined networking (SDN) offers a new opportunity to overcome the challenges traditional SCADA networks face, based on the concept of separating the control and data plane. Although integrating the SDN architecture into SCADA systems offers many advantages, it cannot address security concerns against cyber-attacks such as a distributed denial of service (DDoS). The fact that SDN has centralized management and programmability features causes attackers to carry out attacks that specifically target the SDN controller and data plane. If DDoS attacks against the SDN-based SCADA network are not detected and precautions are not taken, they can cause chaos and have terrible consequences. By detecting a possible DDoS attack at an early stage, security measures that can reduce the impact of the attack can be taken immediately, and the likelihood of being a direct victim of the attack decreases. This study proposes a multi-stage learning model using a 1-dimensional convolutional neural network (1D-CNN) and decision tree-based classification to detect DDoS attacks in SDN-based SCADA systems effectively. A new dataset containing various attack scenarios on a specific experimental network topology was created to be used in the training and testing phases of this model. According to the experimental results of this study, the proposed model achieved a 97.8% accuracy rate in DDoS-attack detection. The proposed multi-stage learning model shows that high-performance results can be achieved in detecting DDoS attacks against SDN-based SCADA systems. [ABSTRACT FROM AUTHOR]

The advent of cloud computing has made it simpler for users to gain access to data regardless of their physical location. It works for as long as they have access to the internet through an approach where the users pay based on how they use these resources in a model referred to as “pay-as-per-usage”. Despite all these advantages, cloud computing has its shortcomings. The biggest concern today is the security risks associated with the cloud. One of the biggest problems that might arise with cloud services availability is Distributed Denial of Service attacks (DDoS). DDoS attacks work by multiple machines attacking the user by sending packets with large data overhead. Therefore, the network is overwhelmed with unwanted traffic. This paper proposes an intrusion detection framework using Ensemble feature selection with RNN (ERNN) to tackle the problem at hand. It combines an Ensemble of multiple Machine Learning (ML) algorithms with a Recurrent Neural Network (RNN). The framework aims to address the issue by selecting the most relevant features using the ensemble of six ML algorithms. These selected features are then used to classify the network traffic as either normal or attack, employing RNN. The effectiveness of the proposed model is evaluated using the CICDDoS2019 dataset, which contains new types of attacks. To assess the performance of the model, metrics like precision, accuracy, F-1 score, and recall are taken into consideration. [ABSTRACT FROM AUTHOR]

Cloud computing makes it easier for users to access resources from anywhere at any time. This is for as long as they have access to the internet connectivity by employing a “pay-as-you-use” model. Despite its merits, cloud computing faces shortcomings, notably the escalating security concerns linked with it. Distributed Denial of Service (DDoS) attack is a primary and biggest concert to the availability of the services offered by cloud. DDoS attacks use numerous machines to flood consumers with packets with high data overhead, flooding the network with unwanted traffic. Due to the obsolete datasets, many deep learning (DL) models are processing-intensive or may not successfully address new DDoS threats. This paper seeks to address this issue by proposing FEwDN, an AI-based DDoS detection framework that employs a hybrid approach, integrating machine learning and deep learning algorithms. The framework optimizes feature selection via ensemble techniques, enhancing accuracy by leveraging deep neural networks for traffic classification. The proposed framework is experimented on the CICDDoS2019 dataset and demonstrates superior performance over benchmark techniques across multiple metrics. The FEwDN outperforms well with other models against various performance metrics. This research strengthens cloud security and DDoS detection in modern clouds. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT), projected to exceed 30 billion active device connections globally by 2025, presents an expansive attack surface. The frequent collection and dissemination of confidential data on these devices exposes them to significant security risks, including user information theft and denial-of-service attacks. This paper introduces a smart, network-based Intrusion Detection System (IDS) designed to protect IoT networks from distributed denial-of-service attacks. Our methodology involves generating synthetic images from flow-level traffic data of the Bot-IoT and the LATAM-DDoS-IoT datasets and conducting experiments within both supervised and self-supervised learning paradigms. Self-supervised learning is identified in the state of the art as a promising solution to replace the need for massive amounts of manually labeled data, as well as providing robust generalization. Our results showcase that self-supervised learning surpassed supervised learning in terms of classification performance for certain tests. Specifically, it exceeded the F1 score of supervised learning for attack detection by 4.83% and by 14.61% in accuracy for the multiclass task of protocol classification. Drawing from extensive ablation studies presented in our research, we recommend an optimal training framework for upcoming contrastive learning experiments that emphasize visual representations in the cybersecurity realm. This training approach has enabled us to highlight the broader applicability of self-supervised learning, which, in some instances, outperformed supervised learning transferability by over 5% in precision and nearly 1% in F1 score. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) refers to the network of interconnected physical devices that are embedded with software, sensors, etc., allowing them to exchange and collect information. Although IoT devices have several advantages and can improve people's efficacy, they also pose a security risk. The malicious actor frequently attempts to find a new way to utilize and exploit specific resources, and an IoT device is an ideal candidate for such exploitation owing to the massive number of active devices. Especially, Distributed Denial of Service (DDoS) attacks include the exploitation of a considerable number of devices like IoT devices, which act as bots and transfer fraudulent requests to the services, thereby obstructing them. There needs to be a robust system of detection based on satisfactory methods for detecting and identifying whether these attacks have occurred or not in a network. The most widely used technique for these purposes is artificial intelligence (AI), which includes the usage of Deep Learning (DL) and Machine Learning (ML) to find cyberattacks. The study presents a Piecewise Harris Hawks Optimizer with an Optimal Deep Learning Classifier (PHHO-ODLC) for a secure IoT environment. The fundamental goal of the PHHO-ODLC algorithm is to detect the existence of DDoS attacks in the IoT platform. The PHHO-ODLC method follows a three-stage process. At the initial stage, the PHHO algorithm can be employed to choose relevant features and thereby enhance the classification performance. Next, an attention-based bidirectional long short-term memory (ABiLSTM) network can be applied to the DDoS attack classification process. Finally, the hyperparameter selection of the ABiLSTM network is carried out by the use of a grey wolf optimizer (GWO). A widespread simulation analysis was performed to exhibit the improved detection accuracy of the PHHO-ODLC technique. The extensive outcomes demonstrated the significance of the PHHO-ODLC technique regarding the DDoS attack detection technique in the IoT platform. [ABSTRACT FROM AUTHOR]

Smart grids (SGs) play a vital role in the smart city environment, which exploits digital technology, communication systems, and automation for effectively managing electricity generation, distribution, and consumption. SGs are a fundamental module of smart cities that purpose to leverage technology and data for enhancing the life quality for citizens and optimize resource consumption. The biggest challenge in dealing with SGs and smart cities is the potential for cyberattacks comprising Distributed Denial of Service (DDoS) attacks. DDoS attacks involve overwhelming a system with a huge volume of traffic, causing disruptions and potentially leading to service outages. Mitigating and detecting DDoS attacks in SGs is of great significance to ensuring their stability and reliability. Therefore, this study develops a new White Shark Equilibrium Optimizer with a Hybrid Deep-Learning-based Cybersecurity Solution (WSEO-HDLCS) technique for a Smart City Environment. The goal of the WSEO-HDLCS technique is to recognize the presence of DDoS attacks, in order to ensure cybersecurity. In the presented WSEO-HDLCS technique, the high-dimensionality data problem can be resolved by the use of WSEO-based feature selection (WSEO-FS) approach. In addition, the WSEO-HDLCS technique employs a stacked deep autoencoder (SDAE) model for DDoS attack detection. Moreover, the gravitational search algorithm (GSA) is utilized for the optimal selection of the hyperparameters related to the SDAE model. The simulation outcome of the WSEO-HDLCS system is validated on the CICIDS-2017 dataset. The widespread simulation values highlighted the promising outcome of the WSEO-HDLCS methodology over existing methods. [ABSTRACT FROM AUTHOR]

Distributed denial-of-service (DDoS) attacks pose a significant cybersecurity threat to software-defined networks (SDNs). This paper proposes a feature-engineering- and machine-learning-based approach to detect DDoS attacks in SDNs. First, the CSE-CIC-IDS2018 dataset was cleaned and normalized, and the optimal feature subset was found using an improved binary grey wolf optimization algorithm. Next, the optimal feature subset was trained and tested in Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbor (k-NN), Decision Tree, and XGBoost machine learning algorithms, from which the best classifier was selected for DDoS attack detection and deployed in the SDN controller. The results show that RF performs best when compared across several performance metrics (e.g., accuracy, precision, recall, F1 and AUC values). We also explore the comparison between different models and algorithms. The results show that our proposed method performed the best and can effectively detect and identify DDoS attacks in SDNs, providing a new idea and solution for the security of SDNs. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) is developing as a novel phenomenon that is applied in the growth of several crucial applications. However, these applications continue to function on a centralized storage structure, which leads to several major problems, such as security, privacy, and a single point of failure. In recent years, blockchain (BC) technology has become a pillar for the progression of IoT-based applications. The BC technique is utilized to resolve the security, privacy, and single point of failure (third-part dependency) issues encountered in IoT applications. Conversely, the distributed denial of service (DDoS) attacks on mining pools revealed the existence of vital fault lines amongst the BC-assisted IoT networks. Therefore, the current study designs a hybrid Harris Hawks with sine cosine and a deep learning-based intrusion detection system (H3SC-DLIDS) for a BC-supported IoT environment. The aim of the presented H3SC-DLIDS approach is to recognize the presence of DDoS attacks in the BC-assisted IoT environment. To enable secure communication in the IoT networks, BC technology is used. The proposed H3SC-DLIDS technique designs a H3SC technique by integrating the concepts of Harris Hawks optimization (HHO) and sine cosine algorithm (SCA) for feature selection. For the intrusion detection process, a long short-term memory auto-encoder (LSTM-AE) model is utilized in this study. Finally, the arithmetic optimization algorithm (AOA) is implemented for hyperparameter tuning of the LSTM-AE technique. The proposed H3SC-DLIDS method was experimentally validated using the BoT-IoT database, and the results indicate the superior performance of the proposed H3SC-DLIDS technique over other existing methods, with a maximum accuracy of 99.05%. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attacks, advanced persistent threats, and malware actively compromise the availability and security of Internet services. Thus, this paper proposes an intelligent agent system for detecting DDoS attacks using automatic feature extraction and selection. We used dataset CICDDoS2019, a custom-generated dataset, in our experiment, and the system achieved a 99.7% improvement over state-of-the-art machine learning-based DDoS attack detection techniques. We also designed an agent-based mechanism that combines machine learning techniques and sequential feature selection in this system. The system learning phase selected the best features and reconstructed the DDoS detector agent when the system dynamically detected DDoS attack traffic. By utilizing the most recent CICDDoS2019 custom-generated dataset and automatic feature extraction and selection, our proposed method meets the current, most advanced detection accuracy while delivering faster processing than the current standard. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attacks are among the most severe threats in cyberspace. The existing methods are only designed to decide whether certain types of DDoS attacks are ongoing. As a result, they cannot detect other types of attacks, not to mention the even more challenging mixed DDoS attacks. In this paper, we comprehensively analyzed the characteristics of various types of DDoS attacks and innovatively proposed five new features from heterogeneous packets including entropy rate of IP source flow, entropy rate of flow, entropy of packet size, entropy rate of packet size, and number of ICMP destination unreachable packet to detect not only various types of DDoS attacks, but also the mixture of them. The experimental results show that the proposed fives features ranked at the top compared with other common features in terms of effectiveness. Besides, by using these features, our proposed framework outperforms the existing methods when detecting various DDoS attacks and mixed DDoS attacks. The detection accuracy improvements over the existing methods are between 21% and 53%. [ABSTRACT FROM AUTHOR]

The adoption of network function visualization (NFV) and softwaredefined radio (SDN) has created a tremendous increase in Internet traffic due to flexibility brought in the network layer. An increase in traffic flowing through the network poses a security threat that becomes tricky to detect and hence selects an appropriate mitigation strategy. Under such a scenario occurrence of the distributed denial of service (DDoS) and flash events (FEs) affect the target servers and interrupt services. Isolating the attacks is the first step before selecting an appropriate mitigation technique. However, detecting and isolating the DDoS attacks from FEs when happening simultaneously is a challenge that has attracted the attention of many researchers. This study proposes a deep learning framework to detect the FEs and DDoS attacks occurring simultaneously in the network and isolates one from the other. This step is crucial in designing appropriate mechanisms to enhance network resilience against such cyber threats. The experiments indicate that the proposed model possesses a high accuracy level in detecting and isolating DDoS attacks and FEs in networked systems. [ABSTRACT FROM AUTHOR]

The Internet of Things enables the creation of transmitted use cases for interconnected devices and complementary channels. The varied structure of it creates additional security needs and problems. In particular, the safeguards used in the IoT should adjust to the changing environment. One of the major dangers to the World Wide Web (WWW) things is Distributed Denial of Service (DDoS). Therefore, in this work, an intelligent Game Theory-based Adaptive security (GT-AS) mathematical model was developed to maximize the effectiveness of DDoS attack mitigation. Moreover, this strategy can strongly derive the five parameters such as energy channel, memory, intruder, and hybrid. These all can achieve a stronger defense posture against DDoS attacks from the newly designed IoT. Consequently, the Recurrent Bat (RB) framework is developed to classify the nodes into two classes such as trusted node and malicious node. In addition, the proposed frameworks analyze how protection effectiveness and energy consumption interact when evaluating adaptive security techniques. To analyze the effectiveness of the suggested paradigm, researchers also give the outcomes of simulation experiments. Researchers demonstrate that, in comparison to existing models, the developed approach has increased the lifespan of the connected objects by 47 %. Also, the developed strategy has attained better accuracy and lower error rates when comparing traditional strategies. Moreover, the packet delivery ratio is 60 KB, energy consumption is 116 KJ, Mean Location Error is 0.078 and resource usage is 148. [ABSTRACT FROM AUTHOR]

DDoS attacks have impacted businesses financially and hit their market reputation. Entropy variation and machine learning are two popular measures of DDoS detection in the literature. The entropy-based detection takes fewer resources yet a longer time to detect the attack and produces high false positive rate. Meanwhile, traditional machine learning classifiers churn out more accurate classification, however, need ample resources for processing huge data. Since IoT devices generate large amounts of data generally; therefore training ML classifiers with all data is impractical. This paper presents an overview of practical merits and demerits of entropy-based detection approach and ML-based detection. In this paper, we have proposed a two-tier hybrid approach for IoT networks that employs entropy variation to filter the attack traffic from benign traffic in first tier. Further, the remaining and reduced volume of supposedly benign data is fed to the second tier which is ML-based detection approach. We have utilized the CICDDoS2019 dataset to illustrate our notions, perform evaluation and findings. The proposed approach has yielded 99.99% f1-score in the second cycle of training and prediction. The proposed approach gives the first response in comparatively less duration as compared to the ML classifiers and significantly reduces the false positive rate as compared to entropy-based detection. It is found that the proposed detection process takes fewer resources too. The findings of the analysis were validated on the CICIoT2023 dataset, which resulted in similar performance. The proposed approach is compared with peer IDSs and results indicate the effectiveness of our approach. [ABSTRACT FROM AUTHOR]

The increasing prevalence of computer network attacks globally has created a need for enhanced intrusion detection and prevention solutions. Traditional intrusion detection systems often struggle to differentiate genuine network traffic from malicious DDoS attacks especially, in case of low-rate or stealthy incursions. Signature-based and rule-based systems face challenges in adapting the emerging attack patterns, resulting in a high false-positive rate that can overwhelm security teams with irrelevant alerts. To address these limitations, this research introduces the self-adaptive lightweight attention module-based bidirectional long short-term memory (SLWAM-BiLSTM), which involves spatial and channel attention mechanisms, to enhance its ability to discern malicious activity from normal network behavior. The self-adaptive nature of the attention modules ensures that the model can dynamically adjust its focus, making the model well-suited for real-time intrusion detection. The spatial and channel attention mechanisms are employed to optimize the model. Additionally, the drift evaluation mechanism implemented in this research is a dynamic assessment mechanism that adaptively monitors the network traffic behavior and manages emerging attack patterns. The experimental outcomes reveal that the SLWAM-BiLSTM model has a higher sensitivity of 93.91%, specificity of 97.31%, and overall accuracy of 96.91%, at TP 80% while using the CIC-DDoS2019 dataset, outperforming conventional approaches in DDoS attack. [ABSTRACT FROM AUTHOR]

In today's digital age, the proliferation of network-connected devices has triggered a surge in cyberattacks. Distributed Denial-of-Service (DDoS) attacks pose a particularly formidable challenge to network security by disrupting access to vital services. While numerous researchers have proposed DDoS detection methods utilizing machine learning and deep learning techniques, developing a robust and reliable DDoS intrusion detection system remains challenging. This challenge is exacerbated by issues such as highly imbalanced data, multi-classification, and computational complexity. This paper proposes an innovative feature selection approach to create a robust intrusion detection system capable of detecting and classifying recent common DDoS attack types. We evaluate the performance of our model on the CICDDoS2019 benchmark dataset. Our experimental results demonstrate that our proposed model outperforms existing methods, achieving a detection accuracy of 96.82%, a recall of 96.82%, a precision of 96.76%, and an F1 score of 96.50%. Additionally, our model exhibits faster prediction times, with the ability to predict an attack in just 0.189 ms. Notably, our approach, combined with preprocessing and feature selection techniques, outperforms previous works and baseline models in DDoS attack classification. [Display omitted] • An innovative hybrid feature extraction method for training of DDoS attack detection model. • We propose a robust CNN model integrated with an Inception mechanism designed to classify various types of DDoS attacks. • Evaluated the network performance of the proposed system in terms of various parameters and compared the results with existing studies and baseline models. • The proposed model outperforms more than 96% in all performance metrics (Precision, Recall, Accuracy, and F1 Score). • The proposed model achieves the fastest prediction time of 0.189 ms among existing models in the literature. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) has widely expanded due to its advantages in enhancing the business, industrial, and social ecosystems. Nevertheless, IoT infrastructure is susceptible to several cyber-attacks due to the endpoint devices' restrictions in computation, storage, and communication capacity. As such, distributed denial-of-service (DDoS) attacks pose a serious threat to the security of the IoT. Attackers can easily utilize IoT devices as part of botnets to launch DDoS attacks by taking advantage of their flaws. This paper proposes an Ethereum blockchain model to detect and prevent DDoS attacks against IoT systems. Additionally, the proposed system can be used to resolve the single points of failure (dependencies on third parties) and privacy and security in IoT systems. First, we propose implementing a decentralized platform in place of current centralized system solutions to prevent DDoS attacks on IoT devices at the application layer by authenticating and verifying these devices. Second, we suggest tracing and recording the IP address of malicious devices inside the blockchain to prevent them from connecting and communicating with the IoT networks. The system performance has been evaluated by performing 100 experiments to evaluate the time taken by the authentication process. The proposed system highlights two messages with a time of 0.012 ms: the first is the request transmitted from the IoT follower device to join the blockchain, and the second is the blockchain response. The experimental evaluation demonstrated the superiority of our system because there are fewer I/O operations in the proposed system than in other related works, and thus it runs substantially faster. [ABSTRACT FROM AUTHOR]

Software-defined networking (SDN) is a new networking paradigm that provides centralized control, programmability, and a global view of topology in the controller. SDN is becoming more popular due to its high audibility, which also raises security and privacy concerns. SDN must be outfitted with the best security scheme to counter the evolving security attacks. A Distributed Denial-of-Service (DDoS) attack is a network attack that floods network links with illegitimate data using high-rate packet transmission. Illegitimate data traffic can overload network links, causing legitimate data to be dropped and network services to be unavailable. Low-rate Distributed Denial-of-Service (LDDoS) is a recent evolution of DDoS attack that has been emerged as one of the most serious vulnerabilities for the Internet, cloud computing platforms, the Internet of Things (IoT), and large data centers. Moreover, LDDoS attacks are more challenging to detect because this attack sends a large amount of illegitimate data that are disguised as legitimate traffic. Thus, traditional security mechanisms such as symmetric/asymmetric detection schemes that have been proposed to protect SDN from DDoS attacks may not be suitable or inefficient for detecting LDDoS attacks. Therefore, more research studies are needed in this domain. There are several survey papers addressing the detection mechanisms of DDoS attacks in SDN, but these studies have focused mainly on high-rate DDoS attacks. Alternatively, in this paper, we present an extensive survey of different detection mechanisms proposed to protect the SDN from LDDoS attacks using machine learning approaches. Our survey describes vulnerability issues in all layers of the SDN architecture that LDDoS attacks can exploit. Current challenges and future directions are also discussed. The survey can be used by researchers to explore and develop innovative and efficient techniques to enhance SDN's protection against LDDoS attacks. [ABSTRACT FROM AUTHOR]

• The devices and sensors in blockchain-enabled IoT network produce a lot of data, so AI is applied as analytical tool to provide consistent results in decision-making. • Fog computing paradigm is used to decentralize cloud based centralized security mechanism, thus data analysis and security related concerns are handled at edge of networks. • A distributed IDS is designed using fog computing to detect DDoS attacks against memory pool in blockchain-enabled IoT network. • To evaluate the proposed detection system two well-known machine learning algorithms, random forest and XGBoost are used in distributed architecture. • An actual IoT based BoT-IoT dataset is used to analyze the performance of the model. As it contains various recent Botnet related attacks such as DoS, DDoS, theft. • Different evaluation metrics such as accuracy, detection rate, false alarm rate, and precision are used to thoroughly investigate performance of the proposed. The Internet of Things (IoT) is emerging as a new technology for the development of various critical applications. However, these applications are still working on centralized storage architecture and have various key challenges like privacy, security, and single point of failure. Recently, the blockchain technology has emerged as a backbone for the IoT-based application development. The blockchain can be leveraged to solve privacy, security, and single point of failure (third-part dependency) issues of IoT applications. The integration of blockchain with IoT can benefit both individual and society. However, 2017 Distributed Denial of Service (DDoS) attack on mining pool exposed the critical fault-lines among blockchain-enabled IoT network. Moreover, this application generates huge amount of data. Machine Learning (ML) gives complete autonomy in big data analysis, capabilities of decision making and therefore is used as an analytical tool. Thus, in order to address above challenges, this paper proposes a novel distributed Intrusion Detection System (IDS) using fog computing to detect DDoS attacks against mining pool in blockchain-enabled IoT Network. The performance is evaluated by training Random Forest (RF) and an optimized gradient tree boosting system (XGBoost) on distributed fog nodes. The proposed model effectiveness is assessed using an actual IoT-based dataset i.e., BoT-IoT, which includes most recent attacks found in blockchain-enabled IoT network. The results indicate, for binary attack-detection XGBoost outperforms whereas for multi-attack detection Random Forest outperforms. Overall on distributed fog nodes RF takes less time for training and testing compared to XGBoost. [ABSTRACT FROM AUTHOR]

From smart homes to industrial environments, the IoT is an ally to easing daily activities, where some of them are critical. More and more devices are connected to and through the Internet, which, given the large amount of different manufacturers, may lead to a lack of security standards. Denial of service attacks (DDoS, DoS) represent the most common and critical attack against and from these networks, and in the third quarter of 2021, there was an increase of 31% (compared to the same period of 2020) in the total number of advanced DDoS targeted attacks. This work uses the Bot-IoT dataset, addressing its class imbalance problem, to build a novel Intrusion Detection System based on Machine Learning and Deep Learning models. In order to evaluate how the records timestamps affect the predictions, we used three different feature sets for binary and multiclass classifications; this helped us avoid feature dependencies, as produced by the Argus flow data generator, whilst achieving an average accuracy >99%. Then, we conducted comprehensive experimentation, including time performance evaluation, matching and exceeding the results of the current state-of-the-art for identifying denial of service attacks, where the Decision Tree and Multi-layer Perceptron models were the best performing methods to identify DDoS and DoS attacks over IoT networks. [ABSTRACT FROM AUTHOR]

A distributed denial of service (DDoS) attack is the most destructive threat for internet-based systems and their resources. It stops the execution of victims by transferring large numbers of network traces. Due to this, legitimate users experience a delay while accessing internet-based systems and their resources. Even a short delay in responses leads to a massive financial loss. Numerous techniques have been proposed to protect internet-based systems from various kinds of DDoS attacks. However, the frequency and strength of attacks are increasing year-after-year. This paper proposes a novel Apache Kafka Streams-based distributed classification approach named KS-DDoS. For this classification approach, firstly, we design distributed classification models on the Hadoop cluster using highly scalable machine learning algorithms by fetching data from Hadoop distributed files system (HDFS). Secondly, we deploy an efficient distributed classification model on the Kafka Stream cluster to classify incoming network traces into nine classes in real-time. Further, this distributed classification approach stores highly discriminative features with predicted outcomes into HDFS for creating/updating models using a new set of instances. We implemented a distributed processing framework-based experimental environment to design, deploy, and validate the proposed classification approach for DDoS attacks. The results show that the proposed distributed KS-DDoS classification approach efficiently classifies incoming network traces with at least 80% classification accuracy. [ABSTRACT FROM AUTHOR]

Distributed denial of service (DDoS) is an immense threat for Internet based-applications and their resources. It immediately floods the victim system by transmitting a large number of network packets, and due to this, the victim system resources become unavailable for legitimate users. Therefore, this attack is claimed to be a dangerous attack for Internet-based applications and their resources. Several security approaches have been proposed in the literature to protect Internet-based applications from this type of threat. However, the frequency and strength of DDoS attacks are increasing day-by-day. Further, most of the traditional and distributed processing frameworks-based DDoS attack detection systems analyzed network flows in offline batch processing. Hence, they failed to classify network flows in real-time. This paper proposes a novel Spark Streaming and Kafka-based distributed classification system, named by SSK-DDoS, for classifying different types of DDoS attacks and legitimate network flows. This classification approach is implemented using a distributed Spark MLlib machine learning algorithms on a Hadoop cluster and deployed on the Spark streaming platform to classify streams in real-time. The incoming streams consume by Kafka's topic to perform preprocessing tasks such as extracting and formulating features for classifying them into seven groups: Benign, DDoS-DNS, DDoS-LDAP, DDoS-MSSQL, DDoS-NetBIOS, DDoS-UDP, and DDoS-SYN. Further, the SSK-DDoS classification system stores formulated features with their predicted class into the HDFS that will help to retrain the distributed classification approach using a new set of samples. The proposed SSK-DDoS classification system has been validated using the recent CICDDoS2019 dataset. The results show that the proposed SSK-DDoS efficiently classified network flows into seven classes and stored formulated features with the predicted value of each incoming network flow into HDFS. [ABSTRACT FROM AUTHOR]

The fifth-generation (5G) technology is anticipated to permit connectivity to billions of devices, called the Internet of Things (IoT). The primary benefit of 5G is that it has maximum bandwidth and can drastically expand service beyond cell phones to standard internet service for conventionally fixed connectivity to homes, offices, factories, etc. But IoT devices will unavoidably be the primary target of diverse kinds of cyberattacks, notably distributed denial of service (DDoS) attacks. Since the conventional DDoS mitigation techniques are ineffective for 5G networks, machine learning (ML) approaches find helpful to accomplish better security. With this motivation, this study resolves the network security issues posed by network devices in the 5G networks and mitigates the harmful effects of DDoS attacks. This paper presents a new pigeon-inspired optimization-based feature selection with optimal functional link neural network (FLNN), PIOFS-OFLNN model for mitigating DDoS attacks in the 5G environment. The proposed PIOFS-OFLNN model aims to detect DDoS attacks with the inclusion of feature selection and classification processes. The proposed PIOFS-OFLNN model incorporates different techniques such as pre-processing, feature selection, classification, and parameter tuning. In addition, the PIOFS algorithm is employed to choose an optimal subset of features from the pre-processed data. Besides, the OFLNN based classification model is applied to determine DDoS attacks where the Rat Swarm Optimizer (RSO) parameter tuning takes place to adjust the parameters involved in the FLNN model optimally. FLNN is a low computational interconnectivity higher cognitive neural network. There are still no hidden layers. FLNN's input vector is operationally enlarged to produce non-linear remedies. More details can be accessed application of Nature-Inspired Method to Odia Written by hand Number system Recognition. To validate the improved DDoS detection performance of the proposed model, a benchmark dataset is used. [ABSTRACT FROM AUTHOR]

In today's technological world, distributed denial of service (DDoS) attacks threaten Internet users by flooding huge network traffic to make critical Internet services unavailable to genuine users. Therefore, design of DDoS attack detection system is on urge to mitigate these attacks for protecting the critical services. Nowadays, deep learning techniques are extensively used to detect these attacks. The existing deep feature learning approaches face the lacuna of designing an appropriate deep neural network structure for detection of DDoS attacks which leads to poor performance in terms of accuracy and false alarm. In this article, a tuned vector convolutional deep neural network (TVCDNN) is proposed by optimizing the structure and parameters of the deep neural network using binary and real cumulative incarnation (CuI), respectively. The CuI is a genetic-based optimization technique which optimizes the tuning process by providing values generated from best-fit parents. The TVCDNN is tested with publicly available benchmark network traffic datasets and compared with existing classifiers and optimization techniques. It is evident that the proposed optimization approach yields promising results compared to the existing optimization techniques. Further, the proposed approach achieves significant improvement in performance over the state-of-the-art attack detection systems. [ABSTRACT FROM AUTHOR]

Software‐defined network (SDN)‐based vehicular ad hoc network (VANET) is an outstanding technology for smart transportation as it increases traffic safety, efficiency, comfort, and manageability. However, despite all its benefits and good performance, SDN‐based VANET is vulnerable to attack threats such as distributed denial of service (DDoS). When SDN‐based VANET systems are exposed to DDoS attacks, this may affect traffic safety, causing traffic accidents and deaths. Therefore, the relevant security threats need to be addressed before integrating the SDN‐based VANETs into smart transportation systems. In this study, the stacked sparse autoencoder (SSAE) + Softmax classifier deep network model is proposed to detect DDoS attacks targeting SDN‐based VANETs. The features in the dataset obtained from the SDN‐based VANET were reduced dimensionally utilising SSAE, and the most significant features were obtained. Then, these features were used as input into the Softmax classifier. According to the experimental results, the best accuracy scores were calculated as 96.9% using the four‐layer SSAE + Softmax classifier deep network model proposed. When compared, the results demonstrate the SSAE + Softmax classifier deep network model proposed can obtain better results in the classification of DDoS attacks and is more successful than the other machine learning classifiers. [ABSTRACT FROM AUTHOR]

A Distributed Denial of Service (DDoS) attack is one of the lethal threats that can cripple down the computing and communication resources of a web server hosting Internet-based services and applications. It has motivated the researchers over the years to find diversified and robust solutions to combat against DDoS attacks and characterization of flash events (a sudden surge in the legitimate traffic) from HR-DDoS (High-Rate DDoS) attacks. In recent times, the volume of legitimate traffic has also magnified manifolds. It results in behavioral similarities of attack traffic and legitimate traffic that make it very difficult and crucial to differentiate between the two. Predominantly, Netflow-based techniques are in use for detecting and differentiating legitimate and attack traffic flows. Over the last decade, fellow researchers have extensively used distinct information theory metrics for Netflow-based DDoS defense solutions. However, a comprehensive analysis and comparison of these diversified information theory metrics used for particularly DDoS attack detection are needed for a better understanding of the defense systems based on information theory. This paper elucidates the efficacy and effectiveness of information theory-based various entropy and divergence measures in the field ofDDoS attack detection. As part of the work, a generalized NetFlow-based methodology has been proposed. The proposed detection methodology has been validated using the traffic traces of various real benchmarked datasets on a set of detection system evaluation metrics such as Detection rate (Recall), Precision, F-Measure, FPR, Classification rate, and Receiver-Operating Characteristics (ROC) curves. It has concluded that generalized divergence-based information theory metrics produce more accuracy in detecting different types of attack flows in contrast to entropy-based information theory metrics. [ABSTRACT FROM AUTHOR]

Reliability, and safety are considered as the indispensable twins during the adoption of the cloud computing environment since their breaches lead to catastrophic issues in poor resource management and unreliable service quality. To be specific, Distributed Denial of Service (DDoS) attack is determined as the most vulnerable threat in the cloud space as it lowers the ability of the predominant resources' for preventing their optimal utilization. The advent of Software-Defined Networking (SDN) is estimated to wide open the feasibility in preventing DDoS attacks in the cloud space. In this paper, a Rival-Model Penalized Self-Organizing Map (RMP-SOM) enforced DDoS Attack Prevention Mechanism is proposed for the remarkable prevention of DDoS attack by utilizing the potential characteristics of SDN that focuses on the possibility of facilitating network global perspective, effective investigation of network traffic, and an enhanced process of rule updating. This proposed RMPSOM-SDNDM scheme utilizes the benefits of the constant rate in order to ensure priority to the closest neuron and its neighborhood rather than its farthest rival neuron for facilitating better detection accuracy. The simulation results of the proposed RMPSOM approach confirmed a phenomenal sensitivity, specificity and accuracy rate during the process of detecting DDoS attacks in the cloud space on par with the baseline DDoS mitigation schemes considered from the literature. • Cloud Computing breaches leads to poor resource management and unreliable service quality. • DDoS attack lowers ability of predominant resources thus preventing their optimal utilization. • RMPSOM-SDNDM uses potential characteristics of SDN, focuses on network global perspective. • It focuses on effective investigation of network traffic and enhanced process of rule updating. • It uses constant rate to ensure priority to closest neuron for better detection accuracy. [ABSTRACT FROM AUTHOR]

One of the major security challenges in cloud computing is distributed denial of service (DDoS) attacks. In these attacks, multiple nodes are used to attack the cloud by sending huge traffic. This results in the unavailability of cloud services to legitimate users. In this research paper, a hybrid machine learning-based technique has been proposed to detect these attacks. The proposed technique is implemented by combining the extreme learning machine (ELM) model and the blackhole optimization algorithm. Various experiments have been performed with the help of four benchmark datasets namely, NSL KDD, ISCX IDS 2012, CICIDS2017, and CICDDoS2019, to evaluate the performance of our proposed technique. It achieves an accuracy of 99.23%, 92.19%, 99.50%, 99.80% with NSL KDD, ISCX IDS 2012, CICIDS2017, and CICDDoS2019, respectively. The performance comparison with other techniques based on ELM, artificial neural network (ANN) trained with blackhole optimization, backpropagation ANN, and other state-of-the-art techniques is also performed. [ABSTRACT FROM AUTHOR]

Software-defined networking (SDN) is an approach in the network that provides many advantages with the help of separating the intelligence of the network (controller) with the underlying network infrastructure (data plane). But this isolation also gives birth to many security concerns; therefore, the need to protect the network from various attacks is becoming mandatory. Distributed Denial of Service (DDoS) in SDN is one such attack that is becoming a hurdle to its growth. Before the mitigation of DDoS attacks, the primary step is to detect them. In this paper, an early DDoS detection tool is created by using SNORT IDS (Intrusion Detection System). This tool is integrated with popularly used SDN controllers (Opendaylight and Open Networking Operating System). For the experimental setup, five different network scenarios are considered. In each scenario number of hosts, switches and data packets vary. For the creation of different hosts, switches the Mininet emulation tool is used whereas for generating the data packets four different penetration tools such as Hping3, Nping, Xerxes, Tor Hammer, LOIC are used. The generated data packets are ranging from (50,000 per second–2,50,000 per second) and the number of hosts/switches are ranging from (50–250) in every scenario respectively. The data traffic is bombarded towards the controllers and the evaluation of these packets is achieved by making use of Wireshark. The analysis of our DDoS detection system is performed on the basis of various parameters such as time to detect the DDoS attack, Round Trip Time (RTT), percentage of packet loss and type of DDoS attack. It is found that ODL takes minimum time to detect the successful DDoS attack and more time to go down than ONOS. Our tool ensures the timely detection of fast DDoS attacks which delivers the better performance of the SDN controller and not compromising the overall functionality of the entire network. [ABSTRACT FROM AUTHOR]

Software‐defined network (SDN)‐based vehicular ad hoc network (VANET) is an outstanding technology for smart transportation as it increases traffic safety, efficiency, comfort, and manageability. However, despite all its benefits and good performance, SDN‐based VANET is vulnerable to attack threats such as distributed denial of service (DDoS). When SDN‐based VANET systems are exposed to DDoS attacks, this may affect traffic safety, causing traffic accidents and deaths. Therefore, the relevant security threats need to be addressed before integrating the SDN‐based VANETs into smart transportation systems. In this study, the stacked sparse autoencoder (SSAE) + Softmax classifier deep network model is proposed to detect DDoS attacks targeting SDN‐based VANETs. The features in the dataset obtained from the SDN‐based VANET were reduced dimensionally utilising SSAE, and the most significant features were obtained. Then, these features were used as input into the Softmax classifier. According to the experimental results, the best accuracy scores were calculated as 96.9% using the four‐layer SSAE + Softmax classifier deep network model proposed. When compared, the results demonstrate the SSAE + Softmax classifier deep network model proposed can obtain better results in the classification of DDoS attacks and is more successful than the other machine learning classifiers. [ABSTRACT FROM AUTHOR]

Cloud computing offer various services over the Internet based on pay-per-use concept. Therefore, many organizations have already adopted this system to attract the users with its desirable features. However, due to its design, makes it vulnerable to malicious attacks. This demands an Intrusion Detection System that can detect such attacks with high detection accuracy in cloud environment. This paper proposes a novel intrusion detection system that combines a fuzzy c means clustering (FCM) algorithm with support vector machine (SVM) to improve the accuracy of the detection system in cloud computing environment. The proposed system is implemented and compared with existing mechanisms. The NSL-KDD dataset is used for experiments. Based on performance evaluation and comparative analysis, the results obtained using this new hybrid mechanism (FCM–SVM) show that the proposed system can detect the anomalies with high detection accuracy and low false alarm rates over the existing techniques. [ABSTRACT FROM AUTHOR]

Today, the providers of cloud computing services are among the most prominent service suppliers worldwide. Availability of cloud services is one of the most important concerns of cloud service providers (CSPs) and cloud users (CUs). Distributed Denial of Service (DDoS) attacks are common types of security issues which affect cloud services and consequently, can lead to unavailability of the services. Therefore, reducing the effects of DDoS attacks helps CSPs to provide high quality services to CUs. In this paper, first, we propose an anomaly-based DDoS attack detection framework in cloud environment using a third party auditor (TPA). Second, we provide multiple basic assumptions and configurations of cloud environments for establishing simulation tests to evaluate our proposed framework. Then, we provide results of simulation tests to analyze the feasibility of our approach. Simulation results demonstrate that our method for detecting DDoS attacks in CSPs has following advantages: efficiency, because of the low overhead of computations on CSPs for attack detection; rapid, due to informing a CSP about an attack in a short course of time regarding the maximum valid response time which is defined in a service level agreement (SLA); and precision, through no false positive detection as well as a low rate of false negative detection which is < 2% of all scenarios of the simulation tests. Finally, we present a table to compare characteristics of our framework with other ones in the literature. [ABSTRACT FROM AUTHOR]

While internet technologies have been evolving day by day, threats against them have been increasing with the same pace. One of the most serious and commonly executed attack type is Distributed Denial of Service (DDoS) attacks. Despite there are many security mechanisms against this type of attack, there is still need for new solutions due to the occurred DDoS attacks worldwide. In this work, a DDoS attack detection approach based on fuzzy logic and entropy is proposed. Network is modelled as a graph and graph-based features are used for discriminating attack traffic from attack-free traffic. Fuzzy-c-means clustering is applied based on these features in order to show the tendencies of IP addresses or port numbers to be in a same cluster or not. Based on this uncertainty, attack and attack-free traffic are modelled. In detection phase, fuzzy membership function is used. This algorithm is tested on the real data collected from Bogaziçi University network. [ABSTRACT FROM AUTHOR]

The paper focuses on design, background and experimental results of real environment of DDoS attacks. The experimental testbed is based on employment of a tool for IT automation to perform DDoS attacks under monitoring. DDoS attacks are still serious threat in both IPv4 and IPv6 networks and creation of simple tool to test the network for DDoS attack and to allow evaluation of vulnerabilities and DDoS countermeasures of the networks is necessary. In proposed testbed, Ansible orchestration tool is employed to perform and coordinate DDoS attacks. Ansible is a powerful tool and simplifies the implementation of the test environment. Moreover, no special hardware is required for the attacks execution, the testbed uses existing infrastructure in an organization. The case study of implementation of this environment shows straightforwardness to create a testbed comparable with a botnet with ten thousand bots. Furthermore, the experimental results demonstrate the potential of the proposed environment and present the impact of the attacks on particular target servers in IPv4 and IPv6 networks. [ABSTRACT FROM AUTHOR]

In a cloud computing environment, the Distributed Denial of Service (DDoS) attack is considered as the crucial issue that needs to be addressed in ensuring the availability of resources that emerge due to the compromisation of hosts. The process of detecting and preventing DDoS attacks is determined to be predominant when the potential benefits of decoupling data plane from the control plane are facilitated through the Software Defined Networking (SDN) in the cloud environment. The incorporation of SDN in DDoS mitigation also enhances the probability of investigating the data traffic flow using the reactive process of updating forwarding rules, analyzing the network with a global view and centralized control in monitoring for better DDoS mitigation enforcement. In this paper, a Convolution Recursively Enhanced Self Organizing Map and Software Defined Networking-based Mitigation Scheme (CRESOM-SDNMS) is proposed for ensuring the better rate of detection during the process of preventing DDoS attacks in clouds. This proposed CRESOM-SDNMS facilitates a predominant option in resolving the issue of vector quantization with enhanced topology preservation and the superior initialization mechanism during the process of SOM-based categorization of flooded data traffic flows into genuine and malicious. The simulation experiments and results of the proposed CRESOM-SDNMS confirmed a superior classification accuracy of around 21% when compared to the existing systems with minimized False Positive rate of 19% compared to the benchmarked DDoS mitigation schemes of the literature. [ABSTRACT FROM AUTHOR]

This paper applies an organized flow of feature engineering and machine learning to detect distributed denial-of-service (DDoS) attacks. Feature engineering has a focus to obtain the datasets of different dimensions with significant features, using feature selection methods of backward elimination, chi2, and information gain scores. Different supervised machine learning models are applied on the feature-engineered datasets to demonstrate the adaptability of datasets for machine learning under optimal tuning of parameters within given sets of values. The results show that substantial feature reduction is possible to make DDoS detection faster and optimized with minimal performance hit. The paper proposes a strategic-level framework which incorporates the necessary elements of feature engineering and machine learning with a defined flow of experimentation. The models are also validated with cross-validation and evaluated for area-under-curve analyses. It provides comprehensive solutions which can be trusted to avoid the overfitting and collinearity problems of data while detecting DDoS attacks. In the case study of DDoS datasets, K-nearest neighbors algorithm overall exhibits the best performance followed by support vector machine, whereas low-dimensional datasets of discrete feature types perform better under the Random Forest model as compared to high dimensions with numerical features. The accuracy scores of dataset with the lowest number of features remain competitive with other datasets under all machine learning models, leading to a substantially reduced processing overhead. The experiments show that approximately 68% reduction in the feature space is possible with an impact of only about 0.03% on accuracy. [ABSTRACT FROM AUTHOR]

Software Defined Networking (SDN) is an emerging paradigm, which brings the network innovation and attracts both the industries and researchers. SDN is a programmable network model that separates the control logic from the forwarding plane. The centralize control plane takes care of all networking resources. The attackers target the SDN controller, to paralyze the logic plane that is considered as the brain of the network which provides a lot of benefits. However, due to the characteristics the control plane becomes the attractive target of security attacks for the adversaries. One of the most known threats is Distributed Denial-of-Service (DDoS) attacks with the goal to exhausting network resources by sending heavy traffic to them, causing network congestion. Since SDN was proposed, DDoS attack has become a popular research field in SDN security and many researchers have been presented DDoS attacks detection, prevention and mitigation solutions in SDN environment using different methods. This paper surveys the previous researches in DDoS attacks detection and mitigation based methods available in SDN environment. [ABSTRACT FROM AUTHOR]

Technological advancements in the information systems and networks are the outcome of potential developments resulting in the networking and communications. The role of Critical Infrastructure is playing a vital role in imparting the condition of effective information systems management. However, with some of the negative developments like DDoS attacks that impact the operations of network application systems, there are adverse set of issues encountered. With the rising number of DDoS attacks phenomenon, researchers have focused on developing contemporary solutions that can support in thwarting such attacks. From the review of such models in the literature review, it is imperative that two distinct dimensions like the detection and mitigation accuracy levels has scope for improvement and profoundly majority of such models were tested on the static datasets which are not pragmatic. Considering such equations, the model proposed in this manuscript focused on a contemporary range of solution that can be high on accuracy rate and also is tested over the dynamic dataset to understand the efficacy of the system. Using the ensemble classifiers comprising drift detection features, at service request stream level, the proposed solution if implemented can lead to better levels of detection. Experimental study of the model carried out using the service request stream that is synthesized is tested based on statistical metrics like accuracy, prediction value and true negative rates. Significance of the model is imperative in terms of results generated and its comparative analysis to the other bench-mark models in the segment. [ABSTRACT FROM AUTHOR]

In this paper, we propose a method to detect network intrusions using anomaly detection technique based on probabilistic analysis. Victim’s computers under attack show various symptoms such as degradation of TCP throughput, increase in CPU usage, increased round trip time, frequent disconnection to the Web sites, etc. These symptoms can be used as components to construct the k-dimensional feature space of multivariate normal distribution, in which case an anomaly detection method can be applied for the detection of the attack on the distribution. These features are generally highly correlated. Thus we choose only a few of these features for the anomaly detection in multivariate normal distribution. We use Mahalanobis distance to detect the anomalies for each data, normal, and abnormal. Anomalies are identified when their square root of Mahalanobis distance exceeds certain threshold. A detailed description of the threshold setting and the various experiments are discussed in simulation results. [ABSTRACT FROM AUTHOR]