Deep learning techniques for DDoS attack detection: Concepts, analyses, challenges, and future directions

DDoS (Distributed Denial of Service) attacks consist of a large number of compromised computer systems that launch joint attacks at a targeted victim, such as a server, website, or other network equipment, simultaneously. DDoS has become a widespread and severe threat to the integrity of computer networks. DDoS can lead to system paralysis, making it difficult to troubleshoot. As a key building block in the development of an integrated defense system, it is essential to detect DDoS attacks as early as possible. With the popularization of artificial intelligence, more and more researchers apply machine learning (ML) and deep learning (DL) to the detection of DDoS attacks and have achieved satisfactory accomplishments. The complexity and sophistication of DDoS attacks have kept increasing and evolving since the first DDoS attack was reported in 1996. Regarding the headways in this problem, a new type of DDoS attack, named adversarial DDoS attack, is investigated in this study. The generating adversarial DDoS traffic is carried out using a symmetric Generative Adversarial Networks (GAN) architecture called Cycle-GAN to demonstrate the severe impact of adversarial DDoS attacks. Experiment results reveal that the synthesized traffic can easily penetrate ML-based detection systems, including Random Forest, KNN (k-Nearest Neighbor), SVM (Support Vector Machine), and Naïve Bayes. These alarming results intimate the urgent need for countermeasures against adversary DDoS attacks.

The rapid advancements in network technologies, along with the increasing volume and scope of data transmitted over networks, have led to a rise in both the intensity and complexity of cyber threats and attacks. One of the most prominent and destructive types of cyberattacks threatening network and system security is the Distributed Denial of Service (DDoS) attack. This study examines the use of deep learning techniques to develop an effective detection mechanism against the growing number of DDoS attacks today. For this purpose, a dataset called DDoSGedik30K, which includes real-world attack scenarios, was created. Using this dataset, a total of 12 models were developed based on Feedforward Neural Network (FFNN) and Long Short-Term Memory (LSTM) deep learning architectures. The fact that all models exceeded a 99.9% accuracy rate proves that the proposed dataset is highly effective in detecting DDoS attacks. Additionally, cross-validation (CV) was employed in the model evaluation, and the experimental results are consistent with the obtained performance metrics, demonstrating the reliability and robustness of the proposed approach. This study introduces the DDoSGedik30K dataset and deep learning models that significantly improve DDoS attack detection. These contributions enhance cybersecurity research and provide actionable insights for future advancements.

A Distributed Denial of Service (DDoS) attack occurs when an attacker tries to disrupt a network, service or website by flooding huge numbers of packets on the internet traffic. Detecting DDoS attacks serves the goal of spotting and addressing them promptly to reduce their effects on the network, system or service being targeted. Detecting Distributed Denial of Service (DDoS) attacks is crucial, for people, companies and network managers. The detection of DDoS attacks has ranging uses in industries such as network security safeguarding websites, managing cloud services ensuring the security of online systems and services. Detecting DDoS attacks is essential for safeguarding infrastructure upholding service availability and guaranteeing the security of online systems and services. To achieve this objective, we proposed a framework to detect DDoS attacks including six steps. In step one, we start by gathering information, which includes network activity and system records, for operations as well as instances of DDoS attacks. Step two, we identify characteristics of the data collected such as patterns in network traffic, packet details, IP addresses, types of protocols used and more. Step three, we utilize algorithms for feature selection such as Salp Swarm Algorithm (SSA), Gray Wolf Algorithm (GWA), Particle Swarm Algorithm (PSO) to pinpoint the features that can distinguish between normal activities and DDoS attack patterns. After that in step four, we divide the processed dataset into sections for training and testing purposes to develop and assess the machine learning models such as SVM (support vector machine), and KNN (K-nearest neighbor). Step five we develop a classification model using machine learning techniques like decision trees, forests, support vector machines (SVM) logistic regression models or neural networks. Finally, we assess the effectiveness of models through metrics such as accuracy rates, precision levels, recall rates, and F1 scores. The results show that the proposed models achieve high results (99.9%). In summary detecting DDoS attacks is crucial for protecting networks, systems and online services against disruptions.

a serious nuisance for network security could be a Distributed Denial of Service (DDoS) attack. The advent of the technological era has also brought along the threat of DDoS attacks for a variety of services and applications that use the Internet. Firms can incur huge financial losses even if there is a disruption in services for a fraction of a period. Analogous to a DDoS attack is the Flash Crowd (FC), in which a particular service is assessed by many legitimate users concurrently, which results in the denial of service. Overloading of network resources is a common issue associated with both these events, which impact CPU, available bandwidth, and memory for legitimate users, thereby leading to limited accessibility. Many researchers have put effort to differentiate between these two kinds of traffic, but none could come up with an effective solution. In this study, we propose an adaptive agent-based model, known as an adaptive application layer flooding protection (AALFP) model, for DDoS and FC flooding attacks. The AALFP model is aimed to protect the network application layer (NAL) against such attacks. Importantly, the model distinguishes and separates normal from abnormal traffic, and then blocks illegitimate traffic. Note that, to operate two traffic filters, the agent relies on the following three parameters of normal traffic intensity, traffic attack behaviour, and IP address history log. An example scenario is provided to simulate the model's application.

Throughout the past few years, the Internet of Things (IoT) has grown in popularity because of its ease of use and flexibility. Cyber criminals are interested in IoT because it offers a variety of benefits for users, but it still poses many types of threats. The most common form of attack against IoT is Distributed Denial of Service (DDoS). The growth of preventive processes against DDoS attacks has prompted IoT professionals and security experts to focus on this topic. Due to the increasing prevalence of DDoS attacks, some methods for distinguishing different types of DDoS attacks based on individual network features have become hard to implement. Additionally, monitoring traffic pattern changes and detecting DDoS attacks with accuracy are urgent and necessary. In this paper, using Modified Whale Optimization Algorithm (MWOA) feature extraction and Hybrid Long Short Term Memory (LSTM), shown that DDoS attack detection methods can be developed and tested on various datasets. The MWOA technique, which is used to optimize the weights of the LSTM neural network to reduce prediction errors in the hybrid LSTM algorithm, is used. Additionally, MWOA can optimally extract IP packet features and identify DDoS attacks with the support of MWOA-LSTM model. The proposed MWOA-LSTM framework outperforms standard support vector machines (SVM) and Genetic Algorithm (GA) as well as standard methods for detecting attacks based on precision, recall and accuracy measurements.

The popularization of the Internet of Vehicles (IoV) technology has not only brought many conveniences but also caused security issues such as distributed denial of service (DDoS) attacks. Using deep learning methods to deal with DDoS attacks has achieved remarkable results. However, to improve the effectiveness of the model, a large amount of high-quality data is needed. This data is often scattered among different vehicle operating companies or organizations, making it difficult to train effective attack detection models by centralizing the data. To solve this problem, this paper proposes a DDoS attack detection method based on reinforced federated learning in the IoV environment. This method applies reinforcement learning to the aggregation process of federated learning to optimize the DDoS attack detection algorithm. In this method, the fog node server of the IoV serves as a participant in learning, uses local data to conduct reinforcement learning, and uploads the trained model parameters to the edge server of the IoV for aggregation. By learning the adaptability of the fog node model to the environment, reinforced federated learning can improve the accuracy of the DDoS attack detection model in terms of unbalanced data distribution and model convergence efficiency. Experiments were carried out using the public DDoS attack dataset. The experimental results showed that the proposed method exhibited excellent performance in the IoV environment, providing new ideas and methods for the research of IoV security.

The need for robust and efficient Distributed Denial of Service (DDoS) attack detection methods has become increasingly evident in today's networked world. Existing approaches, while commendable, often exhibit limitations that hinder their effectiveness. This paper introduces an innovative approach that leverages Local Outlier Factor (LOF) in conjunction with Principal Component Analysis (PCA) for unsupervised DDoS attack detection. Existing methods often fall short in addressing the evolving nature of DDoS attacks, struggling to maintain precision, accuracy, and recall rates. Our proposed model addresses these limitations by harnessing the power of LOF and PCA, offering a more adaptive and dynamic detection framework. LOF enables the identification of outliers in network traffic patterns, while PCA reduces the dimensionality of the data, enhancing the model's efficiency and speed. The advantages of our approach are manifold. It not only achieves superior performance in terms of precision, accuracy, recall, speed, and Area Under the ROC Curve (AUC) when compared to existing methods but also ensures a higher level of adaptability in detecting emerging DDoS attack vectors & sets. This adaptability is critical in today's ever-evolving threat landscape. The impact of this work extends beyond the realm of academia. In practical terms, our model offers network administrators a potent tool for safeguarding their infrastructures against DDoS attacks. By improving detection rates and reducing false positives, it contributes to the overall security posture of networks, ensuring uninterrupted services and enhanced user experience levels.

A novel approach for accurate detection of the DDoS attacks in SDN-based SCADA systems based on deep recurrent neural networks

Internet of Things (IoT) security is becoming important with the growing popularity of IoT devices and their wide applications. Recent network security reports revealed a sharp increase in the type, frequency, sophistication, and impact of distributed denial of service (DDoS) attacks on IoT systems, making DDoS one of the most challenging threats. DDoS is used to commit actual, effective, and profitable cybercrimes. The current machine learning-based IoT DDoS attack detection systems use batch learning techniques, and hence are unable to maintain their performance over time in a dynamic environment. The dynamicity of heterogeneous IoT data causes concept drift issues that result in performance degradation and automation difficulties in detecting DDoS. In this study, we propose an adaptive online DDoS attack detection framework that detects and adapts to concept drifts in streaming data using a number of features often used in DDoS attack detection. This paper also proposes a novel accuracy update weighted probability averaging ensemble (AUWPAE) approach to detect concept drift and optimize zero-day DDoS detection. We evaluated the proposed framework using IoTID20 and CICIoT2023 dataset containing benign and DDoS traffic data. The results show that the proposed adaptive online DDoS attack detection framework is able to detect DDoS attacks with an accuracy of 99.54% and 99.33% for the respective datasets.

With the increasing number of Internet users, cybersecurity is becoming more and more critical. Denial of service (DoS) and distributed denial of service (DDoS) attacks are two of the most common types of attacks that can severely affect a website or a server and make them unavailable to other users. The number of DDoS attacks increased by 55% between the period January 2020 and March 2021. Some approaches for detecting the DoS and DDoS attacks employing different machine learning and deep learning techniques are reported in the literature. Recently, it is also observed that the attackers have started leveraging state-of-the-art AI tools such as generative models for generating synthetic attacks which fool the standard detectors. No concrete approach is reported for developing and training the models which are not only robust in the detection of standard DDoS attacks but which can also detect adversarial attacks which are created synthetically by the attackers with harmful intentions. To that end, in this work, we employ a generative adversarial network (GAN) to develop such a robust detector. The proposed framework can generate and classify the synthetic benign (normal) and malignant (DDoS) instances which are very similar to the corresponding real instances as evaluated by similarity scores. The GAN-based model also demonstrates how effectively the malicious actors can generate adversarial DDoS network traffic instances which look like normal instances using feature modification which are very difficult for the classifier to detect. An approach on how to make the classifiers robust enough to detect such kinds of deliberate adversarial attacks via modifying some specific attack features manually is also proposed. This work provides the first step towards developing a generic and robust detector for DDoS attacks originating from various sources.

Distributed denial of service (DDoS) attacks pose a significant security risk, particularly with the increasing reliance on cloud computing and information technology (IT). These attacks not only allow unauthorized users to access services but also deny legitimate users the ability to utilize them. Traditional antivirus solutions and firewalls prove insufficient in detecting DDoS attacks within large networks. Intrusion detection systems (IDS) are essential for detecting unauthorized or malicious activities and ensuring the confidentiality, integrity, and availability of services. However, traditional IDS often rely on predefined signatures and patterns, making them susceptible to evasion tactics. In response, this research introduces a deep learning (DL)-based IDS that integrates convolutional neural networks (CNN) with principal component analysis (PCA) and explores the application of vision transformers (ViT). The proposed hybrid model was tested on the CICDDoS2019 dataset, achieving a notable improvement in detection accuracy. Specifically, the CNN-based model initially identified DDoS attacks with an accuracy of 99.72%. Upon integrating ViT, the model’s accuracy further improved to 99.99%. This innovative approach signifies a considerable advancement in the detection capabilities for DDoS attacks and underscores the potential for integrating more sophisticated DL models into cybersecurity defenses.

Dealing with network security has always been a challenging task, particularly in the prevention and detection of distributed denial of service (DDoS) attacks. Attacks such as DDoS pose hazards to the system by compromising its accessibility to individuals who need to use a specific server. This type of cyberattack occurs when a system is overloaded with a massive amount of traffic, causing the network to become unavailable. This attack type focuses on engaging the service with correct operators without breaching safety parameters. Responsible artificial intelligence (AI) refers to the ethical development and deployment of AI systems that prioritise fairness, transparency, privacy, and accountability. Currently, the deep learning method is very effective in distinguishing DDoS traffic from harmless traffic by removing the representation of higher-level features from lower-level traffic. The study presented in this paper proposes a responsible artificial intelligence-based hybridisation framework for attack detection using recursive feature elimination (RAIHFAD-RFE) for cybersecurity systems. The study aimed to analyse and propose efficient cybersecurity tactics for preventing, mitigating and detecting DDoS attacks using advanced methods. As a primary step, the RAIHFAD-RFE technique utilises the Z-score standardisation method for the data pre-processing phase to clean, transform and organise raw data into a structured format. Furthermore, the recursive feature elimination (RFE) model is employed for feature selection (FS) to identify and retain the most essential features, thereby improving model performance and reducing model complexity. Moreover, the hybridisation of long short-term memory and bidirectional gated recurrent unit (LSTM-BiGRU) models was employed for classification. To optimise model performance, the improved orca predation algorithm (IOPA) is utilised for hyperparameter tuning to select the optimal parameters for enhanced accuracy. A comprehensive experimental analysis of the RAIHFAD-RFE approach was performed under the CIC-IDS-2017 and Edge-industrial internet of things (IIoT) datasets. A comparison study of the RAIHFAD-RFE approach provided superior accuracy values of 99.35% and 99.39%, respectively, compared to existing models on the dual dataset.

One of the major threats to cyber security is distributed denial of service (DDoS) attacks. In this paper, we reveal the non-negative and cumulative increment effect of DDoS traffic throughput that is the feature accurately distinguished DDoS attacking traffic from normal flash crowd traffic. Our scheme can detect a DDoS attack in its early stages based on these feature. It can differentiate DDoS from flash crowd traffic effectively even if DDoS is potential. This scheme detects DDoS attacks with on-line and distributed characteristics. Simulation shows the algorithm's validity and accuracy.

As DDoS (distributed denial of service) attack becomes more diversified, the conventional detection methods based on single source router can't detect the attack efficiently. In order to combat this problem, centralized control is required to analyze and collect traffic generated in several source routers. This paper presents defense/detection scenario to protect against DDoS attack in centralized control network. A destination address monitoring scheme is also proposed to detect DDoS attacks in real-time. It measures the number of packets with same destination IP address by using modified Bloom filter. Because the modified Bloom filter uses extra table that manages relation among each address fields of destination IP address, it can reduce wrong detection rate. Simulation result shows the proposed scheme reduces the wrong detection rate than the conventional one

Prevention and detection of DDOS attack in virtual cloud computing environment using Naive Bayes algorithm of machine learning