DDoS Attack Detection by Hybrid Deep Learning Methodologies

Throughout the past few years, the Internet of Things (IoT) has grown in popularity because of its ease of use and flexibility. Cyber criminals are interested in IoT because it offers a variety of benefits for users, but it still poses many types of threats. The most common form of attack against IoT is Distributed Denial of Service (DDoS). The growth of preventive processes against DDoS attacks has prompted IoT professionals and security experts to focus on this topic. Due to the increasing prevalence of DDoS attacks, some methods for distinguishing different types of DDoS attacks based on individual network features have become hard to implement. Additionally, monitoring traffic pattern changes and detecting DDoS attacks with accuracy are urgent and necessary. In this paper, using Modified Whale Optimization Algorithm (MWOA) feature extraction and Hybrid Long Short Term Memory (LSTM), shown that DDoS attack detection methods can be developed and tested on various datasets. The MWOA technique, which is used to optimize the weights of the LSTM neural network to reduce prediction errors in the hybrid LSTM algorithm, is used. Additionally, MWOA can optimally extract IP packet features and identify DDoS attacks with the support of MWOA-LSTM model. The proposed MWOA-LSTM framework outperforms standard support vector machines (SVM) and Genetic Algorithm (GA) as well as standard methods for detecting attacks based on precision, recall and accuracy measurements.

The rapid advancements in network technologies, along with the increasing volume and scope of data transmitted over networks, have led to a rise in both the intensity and complexity of cyber threats and attacks. One of the most prominent and destructive types of cyberattacks threatening network and system security is the Distributed Denial of Service (DDoS) attack. This study examines the use of deep learning techniques to develop an effective detection mechanism against the growing number of DDoS attacks today. For this purpose, a dataset called DDoSGedik30K, which includes real-world attack scenarios, was created. Using this dataset, a total of 12 models were developed based on Feedforward Neural Network (FFNN) and Long Short-Term Memory (LSTM) deep learning architectures. The fact that all models exceeded a 99.9% accuracy rate proves that the proposed dataset is highly effective in detecting DDoS attacks. Additionally, cross-validation (CV) was employed in the model evaluation, and the experimental results are consistent with the obtained performance metrics, demonstrating the reliability and robustness of the proposed approach. This study introduces the DDoSGedik30K dataset and deep learning models that significantly improve DDoS attack detection. These contributions enhance cybersecurity research and provide actionable insights for future advancements.

A novel approach for accurate detection of the DDoS attacks in SDN-based SCADA systems based on deep recurrent neural networks

a serious nuisance for network security could be a Distributed Denial of Service (DDoS) attack. The advent of the technological era has also brought along the threat of DDoS attacks for a variety of services and applications that use the Internet. Firms can incur huge financial losses even if there is a disruption in services for a fraction of a period. Analogous to a DDoS attack is the Flash Crowd (FC), in which a particular service is assessed by many legitimate users concurrently, which results in the denial of service. Overloading of network resources is a common issue associated with both these events, which impact CPU, available bandwidth, and memory for legitimate users, thereby leading to limited accessibility. Many researchers have put effort to differentiate between these two kinds of traffic, but none could come up with an effective solution. In this study, we propose an adaptive agent-based model, known as an adaptive application layer flooding protection (AALFP) model, for DDoS and FC flooding attacks. The AALFP model is aimed to protect the network application layer (NAL) against such attacks. Importantly, the model distinguishes and separates normal from abnormal traffic, and then blocks illegitimate traffic. Note that, to operate two traffic filters, the agent relies on the following three parameters of normal traffic intensity, traffic attack behaviour, and IP address history log. An example scenario is provided to simulate the model's application.

Abstract: DDoS attacks also known as distributed denial of service (DDoS) attacks have emerged as one of the most serious and fastest-growing threats on the Internet. Denial-of-service (DDoS) attacks are an example of cyber-attacks that target a specific system or network in an attempt to render it inaccessible or unusable for a period of time. As a result improving the detection of diverse types of DDoS cyber threats with better algorithms and higher accuracy while keeping the computational cost under control has become the most significant component of detecting DDoS cyber threats. DDoS (distributed denial-of-service) attack originates from many sources scattered over multiple network locations. DoS attacks are primarily motivated by the desire to significantly degrade the performance or completely consume a certain resource and a process to exploit a machine defect and cause failure of a processing or exhausting the system resources by exploiting a system flaw. Yet another method of assaulting the target system is to flood the network and monopolies it so preventing anyone else from utilizing it. DDoS attack has a high impact on crashing the network resources making the target servers unable to support the valid users.

Today Distributed Denial of Service (DDoS) attacks are causing major threat to perform online business over the Internet. Our previous work proposed an automated model with a new packet marking technique and agent design to counteract DDoS within a single ISP domain. Our approach has many features that are required to minimize the DDoS attacks. For example, our model is invoked only during attack times, identifies the approximate source of attack with a single packet even in case of spoofed source address, identifies different attack signatures for different attacking sources, prevents the attack nearest to the attacking source, has very fast response for any changes in attack traffic pattern, is simple in its implementation and can be incrementally deployed. Though the proposed model has several advantages, prevention of the attack is limited to a single ISP domain. In this paper we extend our model to prevent DDoS attacks in multiple ISP domains by retaining all the advantages achieved in our previous work. We also propose a practical implementation of the extended model with a presently working architecture.

The rising frequency of network-based attacks, such as Distributed Denial of Service (DDoS) and Port Scanning, underscores the critical need for advanced detection systems. This study presents a Long Short-Term Memory (LSTM)-based model tailored for the detection of network intrusions. Leveraging real-time sequential data, the proposed system identifies malicious activities by analysing network traffic patterns across key attributes. The dataset comprises four distinct classes: BENIGN, DDoS, PortScan, and DoS, with preprocessing steps that include correlation-based feature selection, scaling, and label encoding. The LSTM model architecture incorporates a 128-unit hidden layer with ReLU activation, dropout for overfitting mitigation, and dense layers for feature extraction. The model achieves an accuracy of 97%, with detailed evaluation metrics such as precision, recall, and F1-scores for all attack classes. This research demonstrates the efficacy of deep learning in network intrusion detection and provides a scalable approach for real-time deployment. Methods: The data has to be pre-processed to handle the missing values, label encoding, feature selection and data reshaping. The pre-processed data will be used for training and testing purposes. The proposed model uses 10 epochs on the training dataset and the model is evaluated based on the test data. The input samples will be supplied to LSTM with 128 units and RelU activation function by setting the dropout layer to zero and 32 neurons at dense layer to produce the four possible classes at output layer. Results: The proposed system performance is evaluated based on the classification report which includes precision, recall and F1-score which showcase the accuracy of 97%. Conclusion: The LSTM offers a reliable method to enhance the network threat detection capabilities. With these enhanced capabilities, the proposed system can handle various attacks in real time environments.

Distributed Denial-of-Service (DDoS) attacks are widespread for Internet of Things (IoT) systems that aim to disrupt the availability of a system completely (high-rate DDoS) or partially (low-rate DDoS). Design and placement of intrusion detection systems (IDSs) for DDoS attacks on IoT systems are challenging due to the low power and lossy nature of networks. Existing IDSs are designed to handle either high-rate or low-rate DDoS but cannot handle both with good accuracy. Existing IDS placement techniques are mostly nontransparent, making malicious nodes aware of the presence of IDS nodes. Most of the IDS placement strategies are nonoptimal, making them energy inefficient. Accordingly, this work proposes a transparent, optimally placed, distributed IDS solution, namely, OPTIMIST, which can handle both high-rate and low-rate DDoS attacks with good accuracy. The placement problem is formulated as the weighted minimum vertex cover problem of a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${K}$ </tex-math></inline-formula> -uniform hypergraph and solved with an approximation algorithm. The IDS module is based on a long short-term memory (LSTM) model where a novel offline training method for LSTM is proposed using Wasserstein GAN-generated artificial flows. Extensive experimentation on simulation and testbed shows that the OPTIMIST can best achieve the balance between DDoS detection and energy overhead.

The Internet of Things (IoT) is a network of sensors that helps collect data 24/7 without human intervention. However, the network may suffer from problems such as the low battery, heterogeneity, and connectivity issues due to the lack of standards. Even though these problems can cause several performance hiccups, security issues need immediate attention because hackers access vital personal and financial information and then misuse it. These security issues can allow hackers to hijack IoT devices and then use them to establish a Botnet to launch a Distributed Denial of Service (DDoS) attack. Blockchain technology can provide security to IoT devices by providing secure authentication using public keys. Similarly, Smart Contracts (SCs) can improve the performance of the IoT–blockchain network through automation. However, surveyed work shows that the blockchain and SCs do not provide foolproof security; sometimes, attackers defeat these security mechanisms and initiate DDoS attacks. Thus, developers and security software engineers must be aware of different techniques to detect DDoS attacks. In this survey paper, we highlight different techniques to detect DDoS attacks. The novelty of our work is to classify the DDoS detection techniques according to blockchain technology. As a result, researchers can enhance their systems by using blockchain-based support for detecting threats. In addition, we provide general information about the studied systems and their workings. However, we cannot neglect the recent surveys. To that end, we compare the state-of-the-art DDoS surveys based on their data collection techniques and the discussed DDoS attacks on the IoT subsystems. The study of different IoT subsystems tells us that DDoS attacks also impact other computing systems, such as SCs, networking devices, and power grids. Hence, our work briefly describes DDoS attacks and their impacts on the above subsystems and IoT. For instance, due to DDoS attacks, the targeted computing systems suffer delays which cause tremendous financial and utility losses to the subscribers. Hence, we discuss the impacts of DDoS attacks in the context of associated systems. Finally, we discuss Machine-Learning algorithms, performance metrics, and the underlying technology of IoT systems so that the readers can grasp the detection techniques and the attack vectors. Moreover, associated systems such as Software-Defined Networking (SDN) and Field-Programmable Gate Arrays (FPGA) are a source of good security enhancement for IoT Networks. Thus, we include a detailed discussion of future development encompassing all major IoT subsystems.

With the fast development of 5G networks, the need to ensure that these networks are secured against cyber threats, which are advanced and constantly evolving, is of immense importance. In this paper, an intrusion detection system based on deep learning using a hybrid Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) architecture is introduced to meet the security requirements of 5G wireless networks. The model also showed high accuracy, precision, and recall when training and testing on various publicly available datasets (CICIDS 2017 and NSL-KDD) by identifying different types of attacks, namely Distributed Denial of Service (DDoS), SQL Injection, and Advanced Persistent Threats (APT). Findings reveal that the CNN-LSTM model performs better compared to standard machine learning models such as Support Vector Machines (SVM) and Decision Tree, scoring high with regard to detection abilities and optimizing computing requirements. The model is an effective intrusion detection method in real-time despite training time and latency issues, it is a very useful solution to the fast-developing intrusion detection scenario involving the dynamic 5G network. The study offers an insight into the possibility of deep learning methods in boosting cybersecurity in 5G networks and lays the foundation for newer advances in network security systems. Keywords: 5G Networks, Intrusion Detection System (Ids), Deep Learning, Cnn, Lstm, Hybrid Model, Cybersecurity, Real-Time Detection, Network Security, Machine Learning, Ddos, Apt, Attack Detection.

The rising frequency and complexity of Distributed Denial of Service (DDoS) attacks pose a severe threat to network security. This study aims to develop an effective and interpretable DDoS detection framework using a hybrid deep learning approach. The proposed method integrates Convolutional Neural Networks (CNN) to capture local traffic patterns and Long Short-Term Memory (LSTM) networks to model temporal dependencies. The CICIDS 2017 dataset, after preprocessing steps including data cleaning, standardization, and class balancing with SMOTE, was used to train and evaluate the model. Experimental results show that the framework achieved 99.98% accuracy and a 99.83% F1-Score, with minimal false positive and false negative rates. This study integrates SHAP to improve model interpretability, aligning feature importance with network security expertise. Future research will focus on real-time deployment, cross-dataset validation, and exploring alternative explainable AI techniques for improved scalability.

Distributed Denial of Service (DDoS) attacks have become an important threat to internet security with the hasty growth of the global digital population. These attacks aim to overwhelm target systems by flooding them with large network traffic, rendering them inaccessible to legitimate users. To address this challenge, this research paper proposes a machine learning-based approach for detecting and mitigating DDoS attacks. The study investigates the effectiveness of various machine learning techniques, including Long Short-Term Memory (LSTM), Support Vector Machines (SVM), and Logistic Regression, in accurately identifying DDoS attacks within network traffic. The outcomes demonstrate that the LSTM model attains the highest accuracy, with an accuracy score of 99.04%, outperforming traditional methods such as SVM and Logistic Regression. The proposed result leverages the unique capabilities of deep learning to capture complex patterns and long-term

Dealing with network security has always been a challenging task, particularly in the prevention and detection of distributed denial of service (DDoS) attacks. Attacks such as DDoS pose hazards to the system by compromising its accessibility to individuals who need to use a specific server. This type of cyberattack occurs when a system is overloaded with a massive amount of traffic, causing the network to become unavailable. This attack type focuses on engaging the service with correct operators without breaching safety parameters. Responsible artificial intelligence (AI) refers to the ethical development and deployment of AI systems that prioritise fairness, transparency, privacy, and accountability. Currently, the deep learning method is very effective in distinguishing DDoS traffic from harmless traffic by removing the representation of higher-level features from lower-level traffic. The study presented in this paper proposes a responsible artificial intelligence-based hybridisation framework for attack detection using recursive feature elimination (RAIHFAD-RFE) for cybersecurity systems. The study aimed to analyse and propose efficient cybersecurity tactics for preventing, mitigating and detecting DDoS attacks using advanced methods. As a primary step, the RAIHFAD-RFE technique utilises the Z-score standardisation method for the data pre-processing phase to clean, transform and organise raw data into a structured format. Furthermore, the recursive feature elimination (RFE) model is employed for feature selection (FS) to identify and retain the most essential features, thereby improving model performance and reducing model complexity. Moreover, the hybridisation of long short-term memory and bidirectional gated recurrent unit (LSTM-BiGRU) models was employed for classification. To optimise model performance, the improved orca predation algorithm (IOPA) is utilised for hyperparameter tuning to select the optimal parameters for enhanced accuracy. A comprehensive experimental analysis of the RAIHFAD-RFE approach was performed under the CIC-IDS-2017 and Edge-industrial internet of things (IIoT) datasets. A comparison study of the RAIHFAD-RFE approach provided superior accuracy values of 99.35% and 99.39%, respectively, compared to existing models on the dual dataset.

One of the major threats to cyber security is distributed denial of service (DDoS) attacks. In this paper, we reveal the non-negative and cumulative increment effect of DDoS traffic throughput that is the feature accurately distinguished DDoS attacking traffic from normal flash crowd traffic. Our scheme can detect a DDoS attack in its early stages based on these feature. It can differentiate DDoS from flash crowd traffic effectively even if DDoS is potential. This scheme detects DDoS attacks with on-line and distributed characteristics. Simulation shows the algorithm's validity and accuracy.

Distributed denial of service (DDoS) attacks pose a significant security risk, particularly with the increasing reliance on cloud computing and information technology (IT). These attacks not only allow unauthorized users to access services but also deny legitimate users the ability to utilize them. Traditional antivirus solutions and firewalls prove insufficient in detecting DDoS attacks within large networks. Intrusion detection systems (IDS) are essential for detecting unauthorized or malicious activities and ensuring the confidentiality, integrity, and availability of services. However, traditional IDS often rely on predefined signatures and patterns, making them susceptible to evasion tactics. In response, this research introduces a deep learning (DL)-based IDS that integrates convolutional neural networks (CNN) with principal component analysis (PCA) and explores the application of vision transformers (ViT). The proposed hybrid model was tested on the CICDDoS2019 dataset, achieving a notable improvement in detection accuracy. Specifically, the CNN-based model initially identified DDoS attacks with an accuracy of 99.72%. Upon integrating ViT, the model’s accuracy further improved to 99.99%. This innovative approach signifies a considerable advancement in the detection capabilities for DDoS attacks and underscores the potential for integrating more sophisticated DL models into cybersecurity defenses.