Search

In fifth-generation (5G)-based vehicular networks, vehicles share information about the road's condition to make driving safer and alleviate traffic congestion. Given the public nature of the medium, addressing issues of confidentiality and security is of paramount importance. Existing systems are vulnerable to a distributed denial-of-service (DDoS) attack from an attacker or high traffic in a dense area because of the time-consuming and complex operations based on bilinear pair and elliptic curve cryptographies used. In order to protect vehicle-to-vehicle communication in 5G-based vehicular networks from DDoS attacks, a strategy based on the Chebyshev polynomial is proposed in this study. The semi-group and chaotic features of the Chebyshev polynomial are utilised in our proposal. Our solutions also meet all applicable standards for security and privacy, such as node authentication, message integrity, preserving identity privacy, traceability, unlinkability, and resistance to attacks. Finally, our innovation decreases the computational burden to produce a message signature by 66.67% and the burden to verify a signature by 33.33%. However, the size of the message-signature tuple is affected by the communication expenses of our work by 5.00%. [ABSTRACT FROM AUTHOR]

Mobile Health (m-Health) has become an integral part of modern healthcare, utilizing digital devices like laptops, smart phones, and tablets to facilitate the rapid exchange of real-time patient data through interconnected channels. However, the reliance on centralized cloud computing in m-health systems introduces potential security vulnerabilities. Among these threats, Distributed Denial of Service (DDoS) attacks pose a significant risk, capable of disrupting networks and compromising system reliability. The research paper addresses the vulnerability of m-healthcare systems to DDoS attacks and proposes a four-layered architecture to enhance security measures. The focus on recognizing and identifying DDoS attacks within the system is crucial for early detection and prevention of potential harm. Moreover, the exploration of different deterrence approaches in a virtualized cloud-based environment allows for a comprehensive assessment of their effectiveness. The analysis of performance metrics, particularly the maximum and mean values of DDoS attack success rates, provides valuable insights into the efficacy of the proposed architecture and defense mechanisms. This information will undoubtedly assist in refining and strengthening the system's security measures to mitigate the impact of potential DDoS attacks. Overall, the research paper delves into a critical aspect of m-healthcare system security, shedding light on the vulnerabilities and proposing feasible solutions. By adopting a proactive approach to counter DDoS attacks, the proposed architecture holds the potential to significantly enhance the reliability and privacy of m-health systems, ultimately benefiting patients and healthcare providers alike. The proposed approach taken is innovative and promising. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attacks constitute a formidable threat, obstructing access to legitimate internet services and disrupting the seamless provision of services by organizations. Despite extensive research dedicated to developing defense mechanisms against DDoS attacks, their persistence remains a challenge. The majority of research in DDoS defense can be categorized into attack detection, mitigation, and prevention. Notably, defense strategies falling within the purview of attack detection and mitigation are reactive in nature, often activated after some level of damage has already occurred. In addition, the terms "detection" and "mitigation," maintain consistent meanings in the literature. However, the term "prevention" in the context of DDoS attacks has been associated with varying interpretations in the literature. This paper undertakes a comprehensive review of techniques labeled as "prevention" in the realm of DDoS attacks. In addition, because prevention techniques do not have a standard meaning in the literature, we further classify these techniques into Ideal Prevention, True Prevention, and Partial Prevention. By scrutinizing these techniques and their implications, we shed light on the complexity of mitigating DDoS threats effectively. In particular, we advocate for increased focus on True Prevention techniques, emphasizing the need for dynamism, computational efficiency, scalability, and practical deployability. [ABSTRACT FROM AUTHOR]

In today's world, the banking sector, government organizations, and various users in the finance and insurance sectors have grown exponentially. In such situations, they become primary targets for attackers. The main focus of these attackers is to disrupt services for legitimate users. Recently, attackers have targeted banks in Ukraine during the Russia-Ukraine war, causing a shortage of money in banks and making it difficult for people to withdraw funds. These types of attacks fall under the category of Distributed Denial of Service (DDoS) attacks. The primary objectives of these DDoS attacks are to gain financial control and damage the reputation of the affected organization or country. The purpose of this paper is to detect DDoS attacks using various Decision Tree Classifiers in Machine Learning algorithms. We utilized the 'caret' package in R, which is well-known for its Classification and Regression Techniques. We split the KDD'99 dataset based on the outcome variable. We employed the 'rpart' method to classify the dataset using CART and C4.5 algorithms. Experimental results indicate that our classification methods achieve a better accuracy rate compared to other decision tree methods. [ABSTRACT FROM AUTHOR]

This study introduces an innovative approach for detecting Distributed Denial-of-Service (DDoS) attacks in Software-Defined Networks (SDNs) with a multi-controller setup, specifically tailored to secure Internet of Things (IoT) devices. Traditional DDoS detection techniques struggle with the dynamic and sophisticated nature of modern network threats, particularly in complex and scalable environments like SDNs. To address these challenges, our objective is to develop a methodology that integrates adaptive learning and feedback mechanisms to continuously evolve and improve detection accuracy. Our approach utilizes adaptive learning models that dynamically adjust to new data and emerging attack patterns, learning continuously from network behaviour to detect subtle and novel attack strategies effectively. By implementing a system of feedback loops, our detection algorithms receive real-time insights from the operational environment, allowing immediate adaptation to changing network conditions and attack techniques. Advanced feature selection methods are employed to identify the most relevant data points from network traffic. Through ROC curve analysis of various machine learning models--RNN, LSTM, GAN, and Auto Encoder--using Chi-Square, Decision Tree, and PCA feature selection methods, PCA consistently demonstrated superior performance. It achieved higher true positive rates across various false positive rates, indicating better classification accuracy. The Auto Encoder model, combined with PCA, exhibited the best results, highlighting its efficacy in balancing sensitivity and specificity for anomaly detection. Experimental evaluations conducted using the CICDDoS2019 dataset highlight the effectiveness of our approach. The proposed Auto Encoder model with PCA feature selection achieved the highest accuracy at 99.56%, surpassing other models such as LSTM with feature selection, which achieved 99.42%, and RNN LSTM, which had the lowest accuracy at 89.63%. These results demonstrate the effectiveness of our approach in enhancing the accuracy and reliability of network traffic anomaly detection, particularly for DDoS attacks involving IoT devices. Overall, our research combines adaptive learning and feedback loops to create a dynamic, intelligent DDoS detection system for SDNs, advancing network security in handling evolving threats. [ABSTRACT FROM AUTHOR]

With the growth in services supplied over the internet, network infrastructure has become more exposed to cyber-attacks, particularly Distributed Denial of Service (DDoS) attacks, which can easily cause the disruption of services. The key factor for fighting against these attacks is the earlier separation and detection of the traffic in networks. In this paper, a novel approach, named Half Autoencoder-Stacked DNNs (HAE-SDNN) model, is proposed. We suggest using a Stacked Deep Neural Networks (SDNN) model. as a deep learning model, in order to detect DDoS attacks. Our approach allows feature selection from a preprocessed dataset using a Half AutoEncoder (HAE), resulting in a final set of important features. These features are subsequently used to train the DNNs that are stacked together by applying Softmax layer to combine their outputs. Experiments were performed on a benchmark cybersecurity dataset, named CICDDoS2017, containing various DDoS attack types. The experimental results demonstrate that the introduced model attained an overall accuracy rate of 99.95%. Moreover, the HAE-SDNN model outperformed existing models, highlighting its superiority in accurately classifying attacks. [ABSTRACT FROM AUTHOR]

In the world of connected devices, there is huge growth of less secure Internet of Things (IoT) devices, and the ease of performing sophisticated cyberattacks using these devices has posed a serious threat to the security of Internet-based services or networks. Distributed Denial of Service (DDoS) attack is one of the most significant cyberattacks. It aims to damage or exhaust victims' resources, services, or networks and make them unavailable to legitimate users. Several solutions are available in the literature to detect DDoS attacks. However, it is difficult to detect them in real-time due to today's high speed or high volume of attack traffic. Therefore, this paper proposes an Apache Storm-based distributed detection approach for IoT network traffic-based DDoS attacks, namely SDDA-IoT. SDDA-IoT is composed of two primary modules: model development and model deployment. In the case of model development, we created five distributed detection models by utilizing a Hadoop cluster and the extremely scalable H2O.ai machine learning platform. In the case of model deployment, we deploy an efficient distributed detection model on the Apache Storm stream processing framework for analyzing ingress streaming data and classifying it into seven classes in near-real-time. To create new models or update existing ones, this module also saves the highly discriminating input features of each network flow along with the predicted outcome in the Hadoop Distributed File System (HDFS). The effectiveness of the SDDA-IoT approach has been examined using a variety of configured scenarios. The experimental results show that the SDDA-IoT approach detects DDoS attacks faster than recent state-of-the-art methods and more accurately with 99%+ accuracy. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attacks disrupt service availability, leading to significant financial setbacks for individuals and businesses. This paper introduces Eye-Net, a deep learning-based system optimized for DDoS attack detection that combines feature selection, balancing methods, Multilayer Perceptron (MLP), and quantization-aware training (QAT) techniques. An Analysis of Variance (ANOVA) algorithm is initially applied to the dataset to identify the most distinctive features. Subsequently, the Synthetic Minority Oversampling Technique (SMOTE) balances the dataset by augmenting samples for under-represented classes. Two distinct MLP models are developed: one for the binary classification of flow packets as regular or DDoS traffic and another for identifying six specific DDoS attack types. We store MLP model weights at 8-bit precision by incorporating the quantization-aware training technique. This adjustment slashes memory use by a factor of four and reduces computational cost similarly, making Eye-Net suitable for Internet of Things (IoT) devices. Both models are rigorously trained and assessed using the CICDDoS2019 dataset. Test results reveal that Eye-Net excels, surpassing contemporary DDoS detection techniques in accuracy, recall, precision, and F1 Score. The multiclass model achieves an impressive accuracy of 96.47% with an error rate of 8.78%, while the binary model showcases an outstanding 99.99% accuracy, maintaining a negligible error rate of 0.02%. [ABSTRACT FROM AUTHOR]

Software Defined Networking (SDN) is a technology that consolidates network management through a unified controller. However, it is vulnerable to attacks like distributed denial of service (DDoS) due to reliance on a single control plane. In order to address this, a new approach called Hybrid Particle Swarm Optimization (PSO) and Automated Modified Grey Wolf Optimizer Algorithm (AMGWOA) is proposed in this paper. We enhance the efficiency of detecting and preventing malicious requests in SDN frameworks by combining PSO and AMGWOA. Our PSOAMGWO method outperforms conventional grey wolf optimizer and particle swarm optimization techniques, achieving a remarkable 100% accuracy in detecting harmful requests within 0.5 seconds under the same sample size of traffic requests. This approach not only reduces detection time but also minimizes storage and computing resource utilization. [ABSTRACT FROM AUTHOR]

Software-Defined Networking (SDN) has emerged as a transformative paradigm for network management, offering centralized control and programmability. However, with the proliferation of Distributed Denial of Service (DDoS) attacks that pose significant threats to network infrastructures, effective mitigation strategies are needed. The subject matter of this study is to explore the importance of datasets in the mitigation of DDoS attacks in SDN environments. The paper discusses the significance of datasets for training machine learning models, evaluating detection mechanisms, and enhancing the resilience of SDN-based defense systems. Goal of the paper is to assist researchers in effectively selecting and usage of datasets for DDoS mitigation in SDN, thereby maximizing benefits and overcoming challenges involved in dataset selection. This paper outlines the challenges associated with dataset collection, labeling, and management, along with potential solutions to address these challenges. Effective detection and mitigation of DDoS attacks in SDN require robust datasets that capture the diverse and evolving nature of attack scenarios. Characterization of tasks for each section is as follows: Importance of datasets in DDoS attack mitigation in SDN, challenges in dataset utilization in DDoS mitigation in SDN, Guidelines for dataset selection, comparison of datasets used and their results and different dataset usage according to the need. Methodology involves collecting results in tabular form based on prior research to analyze the characteristics of existing datasets, techniques for dataset augmentation and enhancement, and evaluating the effectiveness of different datasets in detecting and mitigating DDoS attacks through comprehensive experimentation. Results of our findings indicate that effective detection and mitigation of DDoS attacks in SDN require robust datasets that capture the diverse and evolving nature of attack scenarios. Our findings provide valuable insights into the importance of datasets in enhancing the resilience of SDN infrastructures against DDoS attacks. In conclusion, our findings provide valuable insights into the importance of datasets in enhancing the resilience of SDN infrastructures against DDoS attacks and highlight the need for further research in this critical area. Thorough guidelines for dataset selection and impacts of different datasets used in recent studies, provide research challenges and future directions in this area.

We live in an era when time is a precious resource. Thus, dealing with the vast amount of data collected from different resources for various purposes requires creating systems that can process the data in a reasonable time to make it worthwhile. Accessing big data in machine learning and artificial intelligence models creates efficient, robust models. In this work, we present a method to create a multi-class classification model using Apache-spark. The model is built and trained with the CIC-DDOS2019 dataset to build a DDoS Attack detection model. Ensemble modeling was used to improve the accuracy and robustness of the model. At the same time, Apache-spark was used to distribute the vast amount of training and testing data over the models used to create the intrusion detection model. The proposed model has achieved high accuracy (99.94\%) while reducing the execution time to almost the half when applied without Apache-spark. [JJCIT 2024; 10(2.000): 123-137]

The increasing reliance on internet-based services has heightened the vulnerability of network infrastructure to cyberattacks, particularly distributed denial of service (DDoS) attacks. These attacks can cause severe disruptions and significant financial losses. Early detection of malicious traffic is crucial in effectively combating such threats. This paper presents an innovative approach called the Encoder-Stacked deep neural networks (E-SDNN) model, which leverages Stacked/bagged multi-layer perceptrons (MLP) for accurate DDoS attack detection. The proposed method employs an encoder to select pertinent features from a preprocessed dataset, enabling precise attack detection. Extensive experiments were conducted on benchmark cybersecurity datasets, namely CICDS2017 and CICDDoS2019, encompassing various DDoS attack scenarios. The experimental results demonstrate the superiority of the E-SDNN model compared to state-of-the-art methods. The proposed E-SDNN model achieved an impressive overall accuracy rate of 99.94% and 98.86% for CICDDS2017 and CICDDoS2019, respectively. [ABSTRACT FROM AUTHOR]

Copyright of Jordanian Journal of Computers & Information Technology is the property of Jordanian Journal of Computers & Information Technology and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Distributed denial-of-service (DDoS) attacks are expanding threat to online services and websites. These attacks overwhelm targets with traffic from multiple sources to exhaust resources and make services unavailable. The frequency of DDoS attacks exhibits an ongoing upward trajectory over time. This persistent escalation highlights the need for effective countermeasures. While machine learning approaches have been extensively investigated for binary classification of DDoS attacks, multi-class classification has received comparatively less examination in the literature despite its greater practical utility. In this paper, we propose an intrusion detection system for detecting and classifying DDoS attacks, based on two main axes: feature selection for selecting the best relevant features and ensemble learning technique for improving performance by combining weak learners. The proposed model has been trained and evaluated on the CICDDoS2019 dataset. Experimental evaluation demonstrates improved performance using a subset of 16 relevant features identified, with a test accuracy of 82.35% attained for discriminating between the 12 classes represented in the dataset. By aggregating attacks sharing common characteristics resulting in 7 classes, the approach achieves surpassing 97% accuracy. Additionally, a binary classification delineating benign and DDoS attacks attain 99.90% accuracy. [ABSTRACT FROM AUTHOR]

Copyright of Journal of Shenyang Agricultural University is the property of Journal of Shenyang Agricultural University Editorial Department and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

With the proliferation of the Internet, the number of cyber-attacks has increased worldwide. To prevent cyber-attacks, network administrators need to use analytical tools to disclose six new critical statistics such as Internet Protocol (IP) authenticity and classification, IP ownership, frequency of attacks, time of day, day of the week, and country of attack. There are four SSH attack analysis tools available, but existing tools lack visualization and cannot provide the necessary attack statistics. This paper proposes SSHAA, the first open source PyPI analysis tool that meets the requirement. Text mining technology is used for extracting data from SSH log files, classifying IPs with identified country names and calculating a variety of statistics. PyPI allows SSHAA to run on Windows, MacOS, and Linux operating systems. This paper highlights how to debut a PyPI application using SSHAA which will be the world’s first tutorial in the security journals for maximum software dissemination. According to PePy, SSHAA has been downloaded 7668 times worldwide. The substantial number of downloads signifies the efficacy of the proposed tool. The proposed system offers ten functional statistics for SSH attack analysis. The six new functional statistics to information security are significant. [ABSTRACT FROM AUTHOR]

The early and accurate detection of Distributed Denial of Service (DDoS) attacks is a fundamental area of research to safeguard the integrity and functionality of organizations' digital ecosystems. Despite the growing importance of neural networks in recent years, the use of classical techniques remains relevant due to their interpretability, speed, resource efficiency, and satisfactory performance. This article presents the results of a comparative analysis of six machine learning techniques, namely, Random Forest (RF), Decision Tree (DT), AdaBoost (ADA), Extreme Gradient Boosting (XGB), Multilayer Perceptron (MLP), and Dense Neural Network (DNN), for classifying DDoS attacks. The CICDDoS2019 dataset was used, which underwent data preprocessing to remove outliers, and 22 features were selected using the Pearson correlation coefficient. The RF classifier achieved the best accuracy rate (99.97%), outperforming other classifiers and even previously published neural network-based techniques. These findings underscore the feasibility and effectiveness of machine learning algorithms in the field of DDoS attack detection, reaffirming their relevance as a valuable tool in advanced cyber defense. [ABSTRACT FROM AUTHOR]

Application-layer distributed denial-of-service (DDoS) attacks incapacitate systems by using up their resources, causing service interruptions, financial losses, and more. Consequently, advanced deep-learning techniques are used to detect and mitigate these attacks in cloud infrastructures. However, in mobile edge computing (MEC), it becomes economically impractical to equip each node with defensive resources, as these resources may largely remain unused in edge devices. Furthermore, current methods are mainly concentrated on improving the accuracy of DDoS attack detection and saving CPU resources, neglecting the effective allocation of computational power for benign tasks under DDoS attacks. To address these issues, this paper introduces SecEG, a secure and efficient strategy against DDoS attacks for MEC that integrates container-based task isolation with lightweight online anomaly detection on edge nodes. More specifically, a new model is proposed to analyze resource contention dynamics between DDoS attacks and benign tasks. Subsequently, by employing periodic packet sampling and real-time attack intensity predicting, an autoencoder-based method is proposed to detect DDoS attacks. We leverage an efficient scheduling method to optimize the edge resource allocation and the service quality for benign users during DDoS attacks. When executed in the real-world edge environment, our experimental findings validate the efficacy of the proposed SecEG strategy. Compared to conventional methods, the service rate of benign requests increases by 23% under intense DDoS attacks, and the CPU resource is saved up to 35%. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) has shown incredible adaptability in recent years and has become an integral part of human life. The proliferation of IoT technology has made IoT devices more prone to severe security threats, such as Distributed Denial of Service (DDoS) attacks, which are dangerous threats to public systems and networks. Further, the frequency and complexity of IoT traffic-based DDoS attacks are increasing year-by-year. This article proposes an IoT traffic-based DDoS attack detection approach for classifying incoming IoT network traffic into 11 classes using multiclass machine learning techniques. The proposed approach comprises two phases: (i) designing and (ii) detection. In the designing phase, we employ the embedded feature reduction technique to create cost-effective and efficient classification models with a high feature reduction rate. Further, we evaluate these models using the K-fold cross-validation technique. While in the detection phase, we evaluate the performance of an efficient model by executing four different IoT traffic-based scenarios. A publicly available Bot-IoT dataset is employed to design and validate the proposed multiclass classification approach. The results show that the proposed approach provides an 84.4% feature reduction rate and approximately 5.19% higher classification accuracy than the existing approaches. [ABSTRACT FROM AUTHOR]

Software-Defined Networking (SDN) has emerged as a transformative paradigm for network management, offering centralized control and programmability. However, with the proliferation of Distributed Denial of Service (DDoS) attacks that pose significant threats to network infrastructures, effective mitigation strategies are needed. The subject matter of this study is to explore the importance of datasets in the mitigation of DDoS attacks in SDN environments. The paper discusses the significance of datasets for training machine learning models, evaluating detection mechanisms, and enhancing the resilience of SDN-based defense systems. Goal of the paper is to assist researchers in effectively selecting and usage of datasets for DDoS mitigation in SDN, thereby maximizing benefits and overcoming challenges involved in dataset selection. This paper outlines the challenges associated with dataset collection, labeling, and management, along with potential solutions to address these challenges. Effective detection and mitigation of DDoS attacks in SDN require robust datasets that capture the diverse and evolving nature of attack scenarios. Characterization of tasks for each section is as follows: Importance of datasets in DDoS attack mitigation in SDN, challenges in dataset utilization in DDoS mitigation in SDN, Guidelines for dataset selection, comparison of datasets used and their results and different dataset usage according to the need. Methodology involves collecting results in tabular form based on prior research to analyze the characteristics of existing datasets, techniques for dataset augmentation and enhancement, and evaluating the effectiveness of different datasets in detecting and mitigating DDoS attacks through comprehensive experimentation. Results of our findings indicate that effective detection and mitigation of DDoS attacks in SDN require robust datasets that capture the diverse and evolving nature of attack scenarios. Our findings provide valuable insights into the importance of datasets in enhancing the resilience of SDN infrastructures against DDoS attacks. In conclusion, ourfindings provide valuable insights into the importance of datasets in enhancing the resilience of SDN infrastructures against DDoS attacks and highlight the need for further research in this critical area. Thorough guidelines for dataset selection and impacts of different datasets used in recent studies, provide research challenges and future directions in this area. [ABSTRACT FROM AUTHOR]

This comprehensive study examines cutting-edge strategies for combating Distributed Denial of Service (DDoS) attacks in cloud environments, addressing a critical gap in recent literature. Through a systematic review of the latest advancements, we propose a framework for identifying, preventing, and mitigating DDoS threats specifically tailored to cloud infrastructures. Our research highlights the urgent need for robust defense mechanisms to enhance cloud security, minimize service disruptions, and safeguard against data breaches. By analyzing the strengths and limitations of current models, we underscore the importance of continued innovation in this rapidly evolving field. This study provides essential insights for academics and industry professionals aiming to enhance the resilience of cloud infrastructure against the ongoing and adaptive menace of DDoS attacks.

With the continuous development of transportation electrification, Electric Vehicle Charging Stations (EVCS) have become pivotal components, necessitating robust cybersecurity frameworks to mitigate potential threats. This work explores the complex dynamics of Distributed Denial of Service (DDoS) attacks aimed at EVCS, highlighting the multifaceted interplay between the generation of attack traffic and its implications on grid stability. Introducing a novel mathematical model for extensive DDoS attacks on EVCS, this work simulates the attack methodology through a time-variant Poisson process, encapsulating the behaviors of attacks bots and their cumulative impact on the targeted EVCS. The model further incorporates the variability of attack intensity, utilizing the Ornstein-Uhlenbeck process to reflect on the temporal evolution and traceability of the attacks. Moreover, by integrating queueing theory, the model facilitates a detailed examination of traffic dynamics under DDoS conditions, providing insights into potential delays and service interruptions. The study also investigates the impact of DDoS attacks on both the dynamic and steady-state operation of the grid, offering a comprehensive perspective on the cybersecurity threat landscape. Simulation outcomes confirm that successful disruptions in EVCS due to DDoS attacks can lead to significant disturbances, underscoring the need for robust cybersecurity protocols.

The combination of Software-Defined Networking (SDN) with Unmanned Aerial Vehicles (UAVs) has transformed wireless communication and data transmission. However, this advancement introduces new security challenges, specifically Distributed Denial of Service (DDoS) attacks, which can significantly disrupt network operations. Existing solutions often rely on single-model detection methods that may not adequately address these evolving threats. These methods may struggle with new and sophisticated attack patterns, leading to higher false positives and negatives. This work presents a new network architecture and novel approach that combines Ensemble learning with honeypot UAV to detect and mitigate DDoS attacks within SDN-UAV networks effectively. The initial phase involves detecting DDoS attacks from network traffic. Instead of relying on a single model, we use two models combined through a bagging-based ensemble method to integrate their results. In this setup, the detected attacks are promptly relayed to subordinate SDN controllers for the implementation of proactive security measures. A honeypot UAV is integrated into the architecture to enhance the system’s effectiveness. This honeypot UAV collects data on potential threats, allowing constant updates and refinement of the ensemble learning model. Furthermore, the system can proactively block traffic from these sources with this data, strengthening the defense mechanisms against DDoS attacks within the SDN-UAV network. To assess the effectiveness of our approach, we conducted training and testing experiments using the InSDN dataset. Experimental results are evaluated using various metrics, demonstrating that the proposed method consistently outperforms the state-of-the-art methods.

Recent advancements in communication technology have transformed the way the industrial system works. This digitalization has improved the way of communication between different actors involved in cyber physical production systems (CPPS), such as users, suppliers, and manufacturers, thus making the whole process transparent. The utilization of emerging new technologies in CPPS can cause vulnerable spots that can be exploited by attackers to launch sophisticated distributed denial of service (DDoS) attacks, hence threatening the availability of the production systems. Existing machine learning based intrusion detection systems (IDS) often rely on unrealistic datasets for training and validation, thus missing the crucial testing phase with real-time scenarios. The results generated by the ML models are based on predictions at each flow level and cannot provide summarized information about malicious entities. To address this limitation, this study proposed an efficient IDS system that uses both rule-based detection and ML-based approaches to detect DDoS attacks damaging the infrastructure of CPPS. For training and validation of the system, we use real-time network traffic extracted from a real industrial scenario, referred to as Farm-to-Fork (F2F) supply chain system. Both, attacks and normal traffic were captured, and bidirectional features were extracted through CIC-FLOWMETER. We make use of 8 ML supervised and unsupervised approaches to detect the malicious flows; and then a rule-based detection mechanism is used to calculate the frequency of the malicious flows and to assign different severity levels based on the computed frequency. The overall results show that supervised models outperform unsupervised approaches and achieve an accuracy 99.97% and TPR 99.96%. Overall, the weighted accuracy when tested and deployed in a real-time scenario is around 98.71%. The results prove that the system works better when considering real-time scenarios and provides comprehensive information about the detected results that can be used to take different mitigation actions.

DDoS attacks pose serious threats to the availability and reliability of computer networks. With the increasing complexity of DDoS attacks, the accurate detection and classification of these attacks is essential to ensure the protection of network systems. In this paper, we leverage the power of the LSTM model for DDoS attack classification and its ability to automatically learn complex patterns and select features from raw traffic at the packet level. LSTM models have remarkable performance in network traffic classification, however explaining the internal workings of them remains challenging, which hinders their wider adoption in real-world applications. To address this limitation, we propose the SHAP with Pattern Dependency (SHAPPD) approach to explain the predictions of the LSTM model. The results demonstrate significant performance in classifying the DDoS attacks from raw traffic using the LSTM model. SHAPPD effectively explains the predictions of the LSTM model, highlighting the underlying packet traffic fields that drive the LSTM to make its true and false positive predictions and finding the common fields between the DDoS attacks. The results of the comparison between the SHAPPD and the original SHAP emphasize that the SHAPPD is superior to the original SHAP in providing more elaborative justifications for DDoS attacks classification results. The SHAPPD, by quantifying the contribution of each input feature and considering the interdependencies between the features as well as the continued traffic packets, enables security analysts to gain insights into the decision-making process of the LSTM model and identify critical indicators about the DDoS attacks.

Software-defined networking (SDN) architecture enables flexible and centralized network management from the controller, making it increasingly attractive in deploying telecommunications services. However, despite the many benefits of SDN, the vulnerabilities inherent in its architecture must be considered, and potential attacks must be discarded. When this occurs, not only the technical areas are interested in the source of the problem, but also the organizational areas, since attacks can violate terms of service and lead to legal actions. Despite the shared interest in cybersecurity event information, forensics and incident response processes often operate independently, impacting the root cause determination. Considering this concern, an architectural evolution for digital forensics and incident response (DFIR) management is introduced. This paper presents an event filtering model that serves as a trigger for initialing the DFIR process, which involves the detection of unusual traffic and unexpected behavior of SDN elements. The proposal applies artificial intelligence technology and showcases the performance of the model and the presentation of a proprietary dataset obtained from OpenFlow traffic.

Software Defined Networks (SDN) offer dynamic reconfigurability and scalability, revolutionizing traditional networking. However, countering Distributed Denial of Service (DDoS) attacks remains a formidable challenge for both traditional and SDN-based networks. The integration of Machine Learning (ML) into SDN holds promise for addressing these threats. While recent research demonstrates ML’s accuracy in distinguishing legitimate from malicious traffic, it faces difficulties in handling emerging, low-rate, and zero-day DDoS attacks due to limited feature scope for training. The ever-evolving DDoS landscape, driven by new protocols, necessitates continuous ML model retraining. In response to these challenges, we propose an ensemble online machine-learning model designed to enhance DDoS detection and mitigation. This approach utilizes online learning to adapt the model with expected attack patterns. The model is trained and evaluated using SDN simulation (Mininet and Ryu). Its dynamic feature selection capability overcomes conventional limitations, resulting in improved accuracy across diverse DDoS attack types. Experimental results demonstrate a remarkable 99.2% detection rate, outperforming comparable models on our custom dataset as well as various benchmark datasets, including CICDDoS2019, InSDN, and slow-read-DDoS. Moreover, the proposed model undergoes comparison with industry-standard commercial solutions. This work establishes a strong foundation for proactive DDoS threat identification and mitigation in SDN environments, reinforcing network security against evolving cyber risks.

This study conducts analysis of cybersecurity events from 2013 to 2023, concentrating on major incidents associated with Distributed Denial of Service (DDoS), and malware attacks. Deriving data from the Center for Strategic & International Studies (CSIS) report, it examines 925 major incidents to discern evolving cyber threat trends. A key finding is the escalation in the frequency and sophistication of attacks, with a marked increase in DDoS incidents in 2022 and a steady rise in malware attacks, peaking in 2023. This trend indicates growing threat actors’ capabilities and vulnerabilities in digital infrastructures. Additionally, the aggregate of other attack methods, such as phishing and zero-day exploits, surpasses the incidence of DDoS and malware attacks, illustrating the broad spectrum of cyber threats. Employing the ARIMA model, the study projects future DDoS and malware attack trends, factoring in historical data and assumptions of minimal technological advancement and unchanged geopolitical tensions. The forecast suggests a consistent pattern of cyber attacks over the next five years. This study also correlates the nature of cyber attacks with financial motives and geopolitical dynamics, applying reliability and validity testing to affirm the robustness of these findings. Despite ARIMA providing reliable historical-based forecasts, the dynamic nature of cyber threats necessitates cautious interpretation of future trends. In conclusion, the study emphasizes the necessity for dynamic, multifaceted cybersecurity strategies. Nations and organizations must adopt adaptive approaches, bolstered by data analysis and forecasts - crucial in combating the diverse cyber threats, highlighting the need for a proactive and collaborative global cybersecurity framework.

This comprehensive study investigates the trends, impacts, and global distribution of major Distributed Denial of Service (DDoS) attacks from 2019 to 2023, aiming to understand their evolution and predict future trends. Over the past five years, we have observed a significant escalation in both the frequency and severity of major cybersecurity incidents associated with DDoS attacks, underscoring their evolution from sporadic disruptions to more persistent and globally distributed threats. This study meticulously analyzes data from major incidents reported by reputable institutions, providing a focused insight into impactful cyberattacks. This approach highlights the increasing sophistication of threat actors and the expanding scope of targets, including critical national infrastructures and key economic sectors. The impact analysis reveals that these attacks not only cause immediate operational disruptions but also lead to substantial economic and reputational damages, reflecting the growing dependency of modern societies on digital infrastructure. Additionally, this study explores the correlation between these cyberattacks and geopolitical tensions, suggesting their use as strategic tools in broader political and economic conflicts. To predict future trends, the study employs ARIMA and Exponential Smoothing State Space (ETS) models, offering a quantitative forecast for 2024-2026. These models provide valuable insights, although they also exhibit limitations due to the dynamic nature of cyber threats and technological advancements. The study, contributed by authors with over 40 years of combined experience in cybersecurity, underscores the need for adaptive and resilient cybersecurity strategies. It highlights the importance of continuous monitoring and evolving defense mechanisms to counter the unpredictable nature of DDoS attacks in an increasingly interconnected world.

The most significant threat that networks established in IoT may encounter is cyber attacks. The most commonly encountered attacks among these threats are DDoS attacks. After attacks, the communication traffic of the network can be disrupted, and the energy of sensor nodes can quickly deplete. Therefore, the detection of occurring attacks is of great importance. Considering numerous sensor nodes in the established network, analyzing the network traffic data through traditional methods can become impossible. Analyzing this network traffic in a big data environment is necessary. This study aims to analyze the obtained network traffic dataset in a big data environment and detect attacks in the network using a deep learning algorithm. This study is conducted using PySpark with Apache Spark in the Google Colaboratory (Colab) environment. Keras and Scikit-Learn libraries are utilized in the study. 'CICIoT2023' and 'TON_IoT' datasets are used for training and testing the model. The features in the datasets are reduced using the correlation method, ensuring the inclusion of significant features in the tests. A hybrid deep learning algorithm is designed using one-dimensional CNN and LSTM. The developed method was compared with ten machine learning and deep learning algorithms. The model's performance was evaluated using accuracy, precision, recall, and F1 parameters. Following the study, an accuracy rate of 99.995% for binary classification and 99.96% for multiclassification is achieved in the 'CICIoT2023' dataset. In the 'TON_IoT' dataset, a binary classification success rate of 98.75% is reached. [ABSTRACT FROM AUTHOR]

In recent days, with the rapid advancement of technology in informatics systems, the Internet of Things (IoT) becomes crucial in many aspects of daily life. IoT applications have gained popularity due to the availability of various IoT enabler gadgets, such as smartwatches, smartphones, and so on. However, the vulnerability of IoT devices has led to security challenges, including Distributed Denial-of-Service (DDoS) attacks. These limitations result from the dynamic communication between IoT devices due to their limited data storage and processing resources. The primary research challenge is to create a model that can recognize legitimate traffic while effectively protecting the network against various classes of DDoS attacks. This article proposes a CNN-BiLSTM DDoS detection model by combining three deep-learning algorithms. The models are evaluated using the CICIDS2017 dataset against commonly used performance criteria which the models perform well, achieving an accuracy of around 99.76%, except for the CNN model, which achieves an accuracy of 98.82%. The proposed model performs best, achieving an accuracy of 99.9%. [ABSTRACT FROM AUTHOR]

Due to rising cyber threats, IoT devices' security vulnerabilities are expanding. However, these devices cannot run complicated security algorithms locally due to hardware restrictions. Data must be transferred to cloud nodes for processing, giving attackers an entry point. This research investigates distributed computing on the edge, using AI-enabled IoT devices and container orchestration tools to process data in real time at the network edge. The purpose is to identify and mitigate DDoS assaults while minimizing CPU usage to improve security. It compares typical IoT devices with and without AI-enabled chips, container orchestration, and assesses their performance in running machine learning models with different cluster settings. The proposed architecture aims to empower IoT devices to process data locally, minimizing the reliance on cloud transmission and bolstering security in IoT environments. The results correlate with the update in the architecture. With the addition of AI-enabled IoT device and container orchestration, there is a difference of 60% between the new architecture and traditional architecture where only Raspberry Pi were being used. [ABSTRACT FROM AUTHOR]

In today's digital landscape, Distributed Denial of Service (DDoS) attacks stand out as a formidable threat to organisations all over the world. As known technology gradually advances and the proliferation of mobile devices, cellular network operators face pressure to fortify their infrastructure against these risks. DDoS incursions into Cellular Long-Term Evolution (LTE) networks can wreak havoc, elevate packet loss, and suboptimal network performance. Managing the surges in traffic that afflict LTE networks is of paramount importance. Queue management algorithms emerge as a viable solution to wrest control over congestion at the Radio Link Control (RLC) layer within LTE networks. These algorithms work proactively, anticipating, and mitigating congestion by curtailing data transfer rates and fortifying defences against potential DDoS onslaughts. In the paper, we delve into a range of queue management methods Drop-Tail, Random Early Detection (RED), Controlled Delay (CoDel), Proportional Integral Controller Enhanced (PIE), and Packet Limited First In, First Out queue (pFIFO). Our rigorous evaluation of these queue management algorithms hinges on a multifaceted assessment that encompasses vital performance parameters. We gauge the LTE network's resilience against DDoS incursions, measuring performance based on end-to-end delay, throughput, packet delivery rate (PDF), and fairness index values. The crucible for this evaluation is none other than the NS3 simulator, a trusted platform for testing and analysis. The outcomes of our simulations provide illuminating insights. CoDel, RED, PIE, pFIFO, and Drop-Tail algorithms emerge as top performers in succession. These findings underscore the critical role of advanced queue management algorithms in fortifying LTE networks against DDoS attacks, offering robust defences and resilient network performance. [ABSTRACT FROM AUTHOR]

IoT networks are increasingly being connected to a wide range of devices, and the number of devices connected has significantly increased in recent years. As a consequence, the number of vulnerabilities to IoT networks has also been increasing tremendously. In IoT networks, botnet‐based Distributed Denial of Service attack is challenging due to its dynamic behavior. The sensors and actuators connected to IoT networks are low‐powered and have less memory. Because of their inherent vulnerability, IoT devices can always be compromised by an attacker and be used to form a large botnet. A detailed analysis of IoT botnet attacks is presented in this article, along with statistics and the architectures of the botnet. We also survey the existing literature on IoT botnet traffic analysis and present a taxonomy of attack detection methods. We particularly focus on deep learning‐based methods and conduct a comparative study to evaluate their performance on IoT traffic analysis. We identify the current issues and research challenges in this field, and we conclude by highlighting some future research directions. [ABSTRACT FROM AUTHOR]

Supervisory Control and Data Acquisition (SCADA) systems, which play a critical role in monitoring, managing, and controlling industrial processes, face flexibility, scalability, and management difficulties arising from traditional network structures. Software-defined networking (SDN) offers a new opportunity to overcome the challenges traditional SCADA networks face, based on the concept of separating the control and data plane. Although integrating the SDN architecture into SCADA systems offers many advantages, it cannot address security concerns against cyber-attacks such as a distributed denial of service (DDoS). The fact that SDN has centralized management and programmability features causes attackers to carry out attacks that specifically target the SDN controller and data plane. If DDoS attacks against the SDN-based SCADA network are not detected and precautions are not taken, they can cause chaos and have terrible consequences. By detecting a possible DDoS attack at an early stage, security measures that can reduce the impact of the attack can be taken immediately, and the likelihood of being a direct victim of the attack decreases. This study proposes a multi-stage learning model using a 1-dimensional convolutional neural network (1D-CNN) and decision tree-based classification to detect DDoS attacks in SDN-based SCADA systems effectively. A new dataset containing various attack scenarios on a specific experimental network topology was created to be used in the training and testing phases of this model. According to the experimental results of this study, the proposed model achieved a 97.8% accuracy rate in DDoS-attack detection. The proposed multi-stage learning model shows that high-performance results can be achieved in detecting DDoS attacks against SDN-based SCADA systems. [ABSTRACT FROM AUTHOR]

Summary: Software‐defined networking (SDN) is an advanced networking paradigm that decouples forwarding control logic from the data plane. Therefore, it provides a loosely‐coupled architecture between the control and data plane. This separation provides flexibility in the SDN environment for addressing any transformations. Further, it delivers a centralized way of managing networks due to control logic embedded in the SDN controller. However, this advanced networking paradigm has been facing several security issues, such as topology spoofing, exhausting bandwidth, flow table updating, and distributed denial of service (DDoS) attacks. A DDoS attack is one of the most powerful menaces to the SDN environment. Further, the central data controller of SDN becomes the primary target of DDoS attacks. In this article, we propose a Kafka‐based distributed DDoS attacks detection approach for protecting the SDN environment named K‐DDoS‐SDN. The K‐DDoS‐SDN consists of two modules: (i) Network traffic classification (NTClassification) module and (ii) Network traffic storage (NTStorage) module. The NTClassification module is the detection approach designed using scalable H2O ML techniques in a distributed manner and deployed an efficient model on the two‐nodes Kafka Streams cluster to classify incoming network traces in real‐time. The NTStorage module collects raw packets, network flows, and 21 essential attributes and then systematically stores them in the HDFS to re‐train existing models. The proposed K‐DDoS‐SDN designed and evaluated using the recent and publically available CICDDoS2019 dataset. The average classification accuracy of the proposed distributed K‐DDoS‐SDN for classifying network traces into legitimate and one of the most popular attacks, such as DDoS_UDP is 99.22%. Further, the outcomes demonstrate that proposed distributed K‐DDoS‐SDN classifies traffic traces into five categories with at least 81% classification accuracy. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT), considered an intriguing technology with substantial potential for tackling many societal concerns, has been developing into a significant component of the future. The foundation of IoT is the capacity to manipulate and track material objects over the Internet. The IoT network infrastructure is more vulnerable to attackers/hackers as additional features are accessible online. The complexity of cyberattacks has grown to pose a bigger threat to public and private sector organizations. They undermine Internet businesses, tarnish company branding, and restrict access to data and amenities. Enterprises and academics are contemplating using machine learning (ML) and deep learning (DL) for cyberattack avoidance because ML and DL show immense potential in several domains. Several DL teachings are implemented to extract various patterns from many annotated datasets. DL can be a helpful tool for detecting cyberattacks. Early network data segregation and detection thus become more essential than ever for mitigating cyberattacks. Numerous deep-learning model variants, including deep neural networks (DNNs), convolutional neural networks (CNNs), and recurrent neural networks (RNNs), are implemented in the study to detect cyberattacks on an assortment of network traffic streams. The Canadian Institute for Cybersecurity's CICDIoT2023 dataset is utilized to test the efficacy of the proposed approach. The proposed method includes data preprocessing, robust scalar and label encoding techniques for categorical variables, and model prediction using deep learning models. The experimental results demonstrate that the RNN model achieved the highest accuracy of 96.56%. The test results indicate that the proposed approach is efficient compared to other methods for identifying cyberattacks in a realistic IoT environment. [ABSTRACT FROM AUTHOR]

In the contemporary landscape, Distributed Denial of Service (DDoS) attacks have emerged as an exceedingly pernicious threat, particularly in the context of network management centered around technologies like Software-Defined Networking (SDN). With the increasing intricacy and sophistication of DDoS attacks, the need for effective countermeasures has led to the adoption of Machine Learning (ML) techniques. Nevertheless, despite substantial advancements in this field, challenges persist, adversely affecting the accuracy of ML-based DDoS-detection systems. This article introduces a model designed to detect DDoS attacks. This model leverages a combination of Multilayer Perceptron (MLP) and Convolutional Neural Network (CNN) to enhance the performance of ML-based DDoS-detection systems within SDN environments. We propose utilizing the SHapley Additive exPlanations (SHAP) feature-selection technique and employing a Bayesian optimizer for hyperparameter tuning to optimize our model. To further solidify the relevance of our approach within SDN environments, we evaluate our model by using an open-source SDN dataset known as InSDN. Furthermore, we apply our model to the CICDDoS-2019 dataset. Our experimental results highlight a remarkable overall accuracy of 99.95% with CICDDoS-2019 and an impressive 99.98% accuracy with the InSDN dataset. These outcomes underscore the effectiveness of our proposed DDoS-detection model within SDN environments compared to existing techniques.

Distributed Denial of Service (DDoS) attacks disrupt service availability, leading to significant financial setbacks for individuals and businesses. This paper introduces Eye-Net, a deep learning-based system optimized for DDoS attack detection that combines feature selection, balancing methods, Multilayer Perceptron (MLP), and quantization-aware training (QAT) techniques. An Analysis of Variance (ANOVA) algorithm is initially applied to the dataset to identify the most distinctive features. Subsequently, the Synthetic Minority Oversampling Technique (SMOTE) balances the dataset by augmenting samples for under-represented classes. Two distinct MLP models are developed: one for the binary classification of flow packets as regular or DDoS traffic and another for identifying six specific DDoS attack types. We store MLP model weights at 8-bit precision by incorporating the quantization-aware training technique. This adjustment slashes memory use by a factor of four and reduces computational cost similarly, making Eye-Net suitable for Internet of Things (IoT) devices. Both models are rigorously trained and assessed using the CICDDoS2019 dataset. Test results reveal that Eye-Net excels, surpassing contemporary DDoS detection techniques in accuracy, recall, precision, and F1 Score. The multiclass model achieves an impressive accuracy of 96.47% with an error rate of 8.78%, while the binary model showcases an outstanding 99.99% accuracy, maintaining a negligible error rate of 0.02%.