DDoS Attack Simulation and Machine Learning-Based Detection Approach in Internet of Things Experimental Environment

Software Defined Networking (SDN) is a dynamic architecture that employs a variety of applications for making networks more adaptable and centrally controlled. It is easy to attack the entire network in SDN because the control plane and data plane are separated. DDoS attack is major danger to SDN service providers because it can shut down the entire network and stop services to all customers at any time. One of the key flaws of most SDN architectures is lack of susceptibility to DDoS attacks with its types like TCP flooding, UDP flooding, SYN flooding, ICMP flooding and DHCP flooding for detecting those kinds of attacks. The machine learning algorithms are widely used in recent years to identify DDoS attacks. This research utilizes Decision Tree Classifier for detection and classification of DDoS attacks on SDN. The Forward Feature Selection technique is also used in the research to select the best features from the dataset and from that dataset the data are employed to train and test the model by Decision Tree Classifier Algorithm. The decision Tree Classifier technique is a supervised method used to forecast desired values of observations using rudimentary machine learning decision rules derived from training data. Based on the accuracy of decision tree techniques, in future, a hybrid learning model will be designed for detecting the Distributed Denial of Services in an SDN environment with high accuracy and a low false negative rate.

DDoS attacks have been the major threats for the Internet and can bring great loss to companies and governments. With the development of emerging technologies, such as cloud computing, Internet of things, artificial intelligence techniques, attackers can launch a huge volume of DDoS attacks with a lower cost, and it is much harder to detect and prevent DDoS attacks. Because DDoS traffic is similar to normal traffic. Some artificial intelligence techniques like machine learning algorithms have been used to classify DDoS attack traffic and detect DDoS attacks, such as Naive Bayes and Random forest tree. In the paper, we survey on the latest progress on the DDoS attack detection using artificial intelligence techniques and give recommendations on artificial intelligence techniques to be used in DDoS attack detection and prevention.

DDoS attacks often happen in cloud servers and cause a devastating problem. However, an increasing number of Internet of Things (IoT) devices makes us not ignore the influence of large-scale DDoS attacks from IoT devices. In this paper, we propose a machine learning-based on a multi-layer IoT DDoS attack detection system, including IoT devices, IoT gateways, SDN switches, and cloud servers. Firstly, we build eight smart poles with various sensors on our campus and collect sensor data as our datasets through wireless networks or wired networks. Next, we extract the features based on DDoS attack types. The feature selection can result in high accuracy DDoS attack detection in the real IoT environment. The experimental results show that our multi-layer DDoS detection system can accurately detect DDoS attacks. And the SDN controller can block venomous devices effectively according to blacklists from the results of our IoT DDoS attacks detection system.

Distributed Denial of Service (DDOS) attack is one of the most common network attacks. DDoS attacks are becoming more and more diverse, which makes it difficult for some DDoS attack detection methods based on single network flow characteristics to detect various types of DDoS attacks, while the detection methods of multi-feature DDoS attacks have a certain lag due to the complexity of the algorithm. Therefore, it is necessary and urgent to monitor the trend of traffic change and identify DDoS attacks timely and accurately. In this paper, a method of DDoS attack detection based on deep belief network feature extraction and LSTM model is proposed. This method uses deep belief network to extract the features of IP packets, and identifies DDoS attacks based on LSTM model. This scheme is suitable for DDoS attack detection technology. The model can accurately predict the trend of normal network traffic, identify the anomalies caused by DDoS attacks, and apply to solve more detection methods about DDoS attacks in the future.

In the face of constantly changing cyber threats, a variety of actions, tools, and regulations must be considered to safeguard information assets and guarantee the confidentiality, reliability, and availability of digital resources. The purpose of this research is to create an artificial intelligence (AI)-driven system to enhance sustainability for cyber threat detection in Internet of Things (IoT) environments. This study proposes a modern technique named Artificial Fish Swarm-driven Weight-normalized Adaboost (AF-WAdaBoost) for optimizing accuracy and sustainability in identifying attacks, thus contributing to heightening security in IoT environments. CICIDS2017, NSL-KDD, and UNSW-NB15 were used in this study. Min-max normalization is employed to pre-process the obtained raw information. The proposed model AF-WAdaBoost dynamically adjusts classifiers, enhancing accuracy and resilience against evolving threats. Python is used for model implementation. The effectiveness of the suggested AF-WAdaBoost model in identifying different kinds of cyber-threats in IoT systems is examined through evaluation metrics like accuracy (98.69%), F-measure (94.86%), and precision (95.72%). The experimental results unequivocally demonstrate that the recommended model performed better than other traditional approaches, showing essential enhancements in accuracy and strength, particularly in a dynamic environment. Integrating AI-driven detection balances offers sustainability in cybersecurity, ensuring the confidentiality, reliability, and availability of information assets, and also helps in optimizing the accuracy of systems.

The increase in the deployment of IOT networks has improved productivity of humans and organisations. However, IOT networks are increasingly becoming platforms for launching DDOS attacks due to inherent weaker security and resource-constrained nature of IOT devices. This paper focusses on detecting DDOS attack in IOT networks by classifying incoming network packets on the transport layer as either “Suspicious” or “Benign” using unsupervised machine learning algorithms. In this work, two deep learning algorithms and two clustering algorithms were independently trained for mitigating DDOS attacks. Emphasis was laid on exploitation based DDOS attacks which include Transmission Control Protocol SYN-Flood attacks and UDP-Lag attacks. Mirai, BASHLITE and CICDDOS2019 datasets were used in training the algorithms during the experimentation phase. The accuracy score and normalized-mutual-information score are used to quantify the classification performance of the four algorithms. Our results show that the autoencoder performed overall best with the highest accuracy across all the datasets.

This article focuses on attack detection in Internet of Things (IoT) environments using the CICIoT2023 dataset. Both individual and hybrid machine learning models were evaluated. Base classifiers included XGBoost (XGB), Random Forest (RF), and LightGBM (LGBM). In hybrid structures, binary integrations such as XGB + RF, RF + LGBM, and LGBM + XGB were created. Among these, the XGB + RF model achieved the highest performance, achieving 96.55% accuracy and a macro F1 score of 0.8828. Model parameters were tuned using the GridSearchCV method, and class imbalance was addressed using the "Proportional Sampling" and "Minority Class Protection" strategies. Furthermore, the effect of extracting highly correlated features on detection accuracy was investigated. The findings suggest that hybrid learning models offer a promising solution for improving IDS performance in IoT networks.

Internet of things (IoT) is penetrating into every aspect of our lives including our body, our home and our living environment along with numerous security challenges. With rapidly growing number of connected devices in IoT, the scope for cyber-attack also increases exponentially. Therefore an effective intrusion detection system (IDS) is needed to efficiently detect the attack at faster rate in highly scalable and dynamic IoT environment. In this paper, a novel intrusion detection technique is proposed based on fog computing using Online Sequential Extreme Learning Machine (OS-ELM) which can intelligently interpret the attacks from the IoT traffic. In the proposed system, the existing centralized cloud intelligence in detecting the attack is distributed to local fog nodes to detect the attack at faster rate for IoT application. The distributed architecture of fog computing enables distributed intrusion detection mechanism with scalability, flexibility and interoperability. The analysis of the proposed system proves to be efficient in terms of response time and detection accuracy.

Purpose A proper understanding of malware characteristics is necessary to protect massive data generated because of the advances in Internet of Things (IoT), big data and the cloud. Because of the encryption techniques used by the attackers, network security experts struggle to develop an efficient malware detection technique. Though few machine learning-based techniques are used by researchers for malware detection, large amounts of data must be processed and detection accuracy needs to be improved for efficient malware detection. Deep learning-based methods have gained significant momentum in recent years for the accurate detection of malware. The purpose of this paper is to create an efficient malware detection system for the IoT using Siamese deep neural networks. Design/methodology/approach In this work, a novel Siamese deep neural network system with an embedding vector is proposed. Siamese systems have generated significant interest because of their capacity to pick up a significant portion of the input. The proposed method is efficient in malware detection in the IoT because it learns from a few records to improve forecasts. The goal is to determine the evolution of malware similarity in emerging domains of technology. Findings The cloud platform is used to perform experiments on the Malimg data set. ResNet50 was pretrained as a component of the subsystem that established embedding. Each system reviews a set of input documents to determine whether they belong to the same family. The results of the experiments show that the proposed method outperforms existing techniques in terms of accuracy and efficiency. Originality/value The proposed work generates an embedding for each input. Each system examined a collection of data files to determine whether they belonged to the same family. Cosine proximity is also used to estimate the vector similarity in a high-dimensional area.

The rapid development of Internet of Things (IoT) networks has significantly increased their vulnerability to cyberattacks, so it is essential to develop effective Intrusion Detection Systems (IDS). Traditional algorithms often struggle with a high false positive rate and scalability issues in dynamic IoT environments. For addressing these challenges, this article proposed Optimized Cascading Long Short-Term Memory with Latin Sampling Satin Bowerbird Optimization (OCLSTM-LSBO) algorithm to effectively identify intrusions. The deep cascading LSTM framework captures the deep temporal dependencies in network traffic and improves the identification of difficult intrusion patterns in IoT networks. Then, employed the LSBO algorithm to fine-tune the hyperparameters of the LSTM model, which improves classification accuracy and enhances the generalization ability of the model. In the pre-processing phase, the Min-Max normalization technique is used to normalise the features in a uniform range. The OCLSTM-LSBO algorithm obtained the highest accuracy of 98.97% using the CICIoT2023 dataset and 95.62% using ToNIoT dataset for multiclass classification when compared to existing algorithms like Federated Multi Layered Deep-Learning (Fed-MLDL).

Deep learning (DL) is an emerging technology that is being used in many areas due to its effectiveness. One of its major applications is attack detection and prevention of backdoor attacks. Sampling-based measurement approaches in the software-defined network of an Internet of Things (IoT) network often result in low accuracy, high overhead, higher memory consumption, and low attack detection. This study aims to review and analyse papers on DL-based network prediction techniques against the problem of Distributed Denial of service attack (DDoS) in a secure software network. Techniques and approaches have been studied, that can effectively predict network traffic and detect DDoS attacks. Based on this review, major components are identified in each work from which an overall system architecture is suggested showing the basic processes needed. Major findings are that the DL is effective against DDoS attacks more than other state of the art approaches.

The paper aims to provide a summary with a reference to the Internet of Things (IoT) of the distributed denial of service (DDoS). The network research community has known about the denial of service (DoS), which is intended to stop legitimate users from accessing a particular network tool since the early 1980s. The aim of the paper is to define DDoS scope, classifications and opportunities for assailants who use IoT to conduct such operations and to use IoT in healthcare. The research approach is to analyze DDoS, IoT and the use of IoT literature in the health sector. The study found that DDOS attacks on IoT-specific devices have become a very easy phenomenon because network attacks are much simpler due to limited security protocols. IOT distribution companies have made limited efforts to enable security of these devices and protecting the data, thus making them susceptible to vulnerabilities. Due to weak security layers, the confidentiality, authenticity and integrity of private data collected by IoT devices are threatened by attackers. The current research identified the gap and importance for further research to provide a mechanism for detection and prevention of DDOS attack in the application layer of IoT healthcare devices in India. Considering the major challenges in IOTs in defending against external attacks and hacking, it is important that they have inherent frameworks warding off such attacks.

Software Defined Networking (SDN) is a new type of network architecture, which provides an important way to implement automated network deployment and flexible management. However, security problems in SDN are also inevitable. DDoS attack belongs to one of the most serious attack types, which is fairly common for today’s Internet. In SDN security fields, DDoS attack detection research has been received more and more attention. In this paper, a DDoS attack detection method based on one-class SVM in SDN is proposed, which provides a better detection accuracy. Furthermore, two new feature vectors, including middle value of flow table item’s duration and protocol data traffic percentage, are extracted to integrate into the item of 11 feature vectors. Additionally, basing on selection and construction method of the 11 feature vectors, a DDoS attack behavior model is established by using one-class SVM algorithm, and the self-adaptation genetic algorithm is designed to optimize the corresponding parameters of the Gaussian kernel of one-class SVM. The experimental results in SDN show that, the proposed new feature vectors are shown to more better detection accuracy, and the proposed method is more feasible by comparing with the BP neural network and RBF neural network algorithms under the same 11 features vectors.

Recent advances in Internet of Things (IoT) technologies require a new type of IoT security environment. Various heterogeneous smart devices have easy access to IoT environment, and as the number of users increases, they are exposed to various threats such as malicious attacks on IoT devices and IoT infrastructure, and data tampering by malicious code. Malware detection in IoT requires data and models for continuous and changing learning of smart devices. Methods/Statistical analysis: To minimize these security threats, various malware detection techniques in the field of IoT security have been studied. Malware detection in IoT environment is important for data derivation and learning model required for continuous and changing learning of smart devices. The metadata of malware detection can be normalized by the value of device id, time, behavior, location and state. This paper proposes behavior-based malware detection using deep learning (BMD-DL). Findings: BMD-DL was able to collect metadata about behavior-based malicious behavior and learn and detect malicious codes through deep learning. In addition, through the learned model, IoT Security is provided by disconnecting malicious devices that cause malicious behavior in the IoT environment. Improvements/Applications: BMD-DL collects behavioral data generated from multiple devices in the IoT and applies the results learned through deep learning to detect persistent malware.

The primary aim of this study was to explore cybersecurity threats in agriculture 4.0 and 5.0, as well as possible mitigation strategies. A secondary method was employed involving narrative review in which many studies on cybersecurity were sampled and analyzed. The study showed that the main risks that increase cybersecurity threats to agricultural organizations include poor cybersecurity practices, lack of regulations and policies on cybersecurity, and outdated IT software. Moreover, the review indicated that the main cybersecurity threat in agriculture 4.0 and 5.0 involves denial of service attacks that target servers and disrupt the functioning of relevant smart technologies, including equipment for livestock tracking, climate monitoring, logistics and warehousing, and crop monitoring. The analysis also revealed that malware attacks occur when hackers change the code of a system application to access sensitive farm-related data and may alter the operations of the digitized systems. Some of the impacts of cybersecurity breaches were noted to include data loss, reduced efficiency of digitized systems, and reduced food security. A crucial mitigation strategy against cybersecurity threats includes using advanced technologies such as artificial intelligence (AI), blockchain, and quantum computing to improve malware detection in Internet of Things (IoT) digital equipment and ensure faster response to any threats. The other mitigation measures include training employees on best cybersecurity practices and creating guidelines and regulatory standards on best cybersecurity practices.