Detecting distributed denial of service attacks in IPv6 by using artificial intelligence techniques

Hybridizing flower pollination algorithm with particle swarm optimization for enhancing the performance of IPv6 intrusion detection system

Internet Protocol version six (IPv6) is equipped with new protocols, such as the Neighbor Discovery Protocol (NDP). NDP is a stateless protocol without authentication that makes it vulnerable to many types of attacks, such as Router Advertisement (RA) and Neighbour Solicitation (NS) DoS flooding attacks. In these types of attacks, attackers send an enormous volume of abnormal NDP traffic, which causes congestion that degrades network performance. The expected behavior among these attacks is the existence of NDP traffic abnormalities. Thus, this research aims to propose a flow-based approach to detect abnormal NDP traffic behavior, which is considered an indicator of the presence of NDP-based attacks, such as RA and NS DoS flooding attacks. Also, the proposed approach relies on flow-based network traffic representation and adoption of the Entropy algorithm to detect the randomness in the network traffic. The proposed approach is evaluated in terms of detection accuracy, precision, recall, and F1-Score using a simulated dataset. The experimental result shows that the proposed approach obtained 98.1%, 55%, 100%, and 70.96% for average accuracy, precision, recall, and F1-Score, respectively, in detecting abnormal NDP traffic behavior caused by the RA DoS flooding attack. Meanwhile, the proposed approach obtained 99%, 91.3%, 100%, and 95.45% for average accuracy, precision, recall, and F1-Score, respectively, in detecting the abnormal NDP traffic behavior caused by the NS DoS flooding attack. Also, the proposed approach shows better results compared to other existing approaches.

Internet Protocol version 6 (IPv6) is the current generation Internet protocol developed by the Internet Engineering Task Force (IETF) to handle the shortage of IP addresses in IPV4. The transition from IPv4 to IPv6 is gradually being done not happening as anticipated. It is unavoidable to have both IPv4 and IPv6 networks during the transition period, but unfortunately they are not compatible in nature. It is essential to maintain the IPv4 and IPv6 coexistence. The inter-communication ability of IPv4 and IPv6 is the dire need of network community. Many transition techniques are proposed in the recent years. This paper discussed the key difficulties in IPv4-IPv6 transition, and introduced the hybrid approach for coexistence of IPv4 and IPv6. It hybrid the advantages of weightage and tunneling translation techniques for providing inter-communication ability of IPv4 and IPv6. The proposed algorithm has been simulated and the performance metrics; transmission latency, throughput, jitter and delay have been analyzed from end to end host, through various scenarios includes IPv4 only, IPv6 Only, Dual stack, GRE tunneling. The performance of the proposed algorithm is analyzed and the future scope is discussed.

Security and privacy have become important issues when dealing with Internet Protocol version 6 (IPv6) networks. On one hand, anonymity, which is related to privacy, makes it hard for current security systems to differentiate between legitimate users and illegitimate users, especially when the users need to be authenticated by those systems whose services they require. On the other hand, a lack of privacy exposes legitimate users to abuse, which can result from the information gained from privacy-related attacks. The current problems inherent within IPv6-enabled networks are due, in part, to the fact that there is no standard available telling companies about the current deficiencies that exist within IPv6 networks. The purpose of this chapter is to show a balance between the use of privacy and security, and to describe a framework that can offer the minimum standard requirement needed for providing security and privacy to IPv6 networks.

The deployment of Internet Protocol version 6 (IPv6) has raised security concerns among the network administrators. Thus, in strengthening the network security, administrator requires an appropriate method to assess the possible risks that occur in their networks. Aware of the needs to calculate risk in IPv6 network, it is essential to an organization to have an equation that is flexible and consider the requirements of the network. However, the existing risk assessment equations do not consider the requirement of the network. Therefore, this paper presents the adaptation of grounded theory to search for elements that are needed to develop IPv6 risk assessment (IRA6) equation. The attack scenarios’ experiments; UDP Flooding, TCP Flooding and Multicast attacks were carried out in different network environment to show how the IPv6 risk assessment equation being used. The result shows that the IRA6 equation is more flexible to be used regardless the network sizes and easier to calculate the risk value compared to the existing risk assessment equations. Hence, network administrators can have a proper decision making and strategic planning for a robust network security.

The pervasive interconnection of heterogeneous routing devices forms the fundamental infrastructure of modern Internet communication, making accurate router vendor identification a critical capability for multiple domains including network topology mapping, intelligent traffic engineering, and proactive cybersecurity defense. While Internet Protocol version 6 (IPv6) has achieved widespread global deployment as the next-generation Internet protocol, the opaque nature of its addressing mechanisms and protocol behaviors has created significant challenges in router attribute detection across IPv6 networks, leaving a crucial gap in network visibility and security analytics. To address this pressing challenge, we present IPv6 Router FingerPrinting (6RFP), an innovative lightweight fingerprinting methodology that establishes a new paradigm for IPv6 router vendor identification by systematically combining two complementary analytical dimensions: (i) comprehensive EUI-64 interface identifier analysis that captures vendor-specific hardware encoding patterns embedded in IPv6 addresses, and (ii) sophisticated IPv6 Identification Field characteristic profiling that reveals distinctive vendor implementations. Through extensive evaluation across diverse network environments, 6RFP demonstrates highly effective detection capabilities, achieving 85.79% accuracy—representing a remarkable 86.01% improvement over current state-of-the-art techniques—while maintaining minimal computational overhead suitable for real-time deployment.

Explicit Multicast-Unicast (XCAST) is a complementary protocol of multicast that supports a very large number of small multicast sessions by specifies the destinations as the lust of unicast address explicitly. The usage of the IPv6 protocol creates new challenges such as the quality of service (QoS) mechanisms that are currently supported for the Internet Protocol version 6 (IPv6) in most implementations are fewer compared to IPv4 and in addition the whole network's behavior is different. By considering IPv6 role in QoS and review the QoS routing mechanisms using by multicast as well as unicast, this paper tries to investigate a proper model for Xcast QoS and proposes protocols on IPv6-based Xcast QoS.

Internet Protocol Version six (IPv6) is an ultimate solution for the Internet address depletion problem. It is developed not only to solve the addressing problem but also introduce some improvements on networking infrastructure. One of the improvements is the availability of Neighbor Discovery Protocol (NDP). Duplicate address detection (DAD) is one of the functions of NDP to make sure a generated IPv6 address is unique. However, since the NDP is not supported by a security mechanism, the DAD is vulnerable to DoS attack. Attacker can fail the detection process that causes on failing of IPv6 address configuration. The NDP standard suggested using IPSec or SeND to protect the NDP. However, the two security mechanisms introduced high computation due to the usage of cryptography algorithm. Further, its implementation in IPv6 local network is not trivial. This paper proposes a lightweight security mechanism based on distributed trust management that integrates hard security and soft security to secure the DAD in IPv6 called Trust-ND. The experimental result showed it could save the processing time of SeND mechanism up to 65.44 ms in sender and 23.53 ms in receiver. It also saves the available bandwidth up to 21.504 Kbps from the SeND mechanism.

<span lang="EN-US">The rapid development of information and communication technologies has increased the demand for internet-facing devices that require publicly accessible internet protocol (IP) addresses, resulting in the depletion of internet protocol version 4 (IPv4) address space. As a result, internet protocol version 6 (IPv6) was designed to address this issue. However, IPv6 is still not widely used because of security concerns. An intrusion detection system (IDS) is one example of a security mechanism used to secure networks. Lately, the use of machine learning (ML) or deep learning (DL) detection models in IDSs is gaining popularity due to their ability to detect threats on IPv6 networks accurately. However, there is an apparent lack of studies that review ML and DL in IDS. Even the existing reviews of ML and DL fail to compare those techniques. Thus, this paper comprehensively elucidates ML and DL techniques and IPv6-based distributed denial of service (DDoS) attacks. Additionally, this paper includes a qualitative comparison with other related works. Moreover, this work also thoroughly reviews the existing ML and DL-based IDSs for detecting IPv6 and IPv4 attacks. Lastly, researchers could use this review as a guide in the future to improve their work on DL and ML-based IDS.</span>

A considerable amount of time will be needed before each system in the Internet can convert from Internet Protocol version 4 (IPv4) to Internet Protocol version 6 (IPv6). Three strategies have been proposed by the Internet Engineer Task Force (IETF) to help the transition from IPv4 to IPv6 which are dual stack, header translation and tunneling. Tunneling is used when two computers using IPv6 want to communicate with each other and the packet will travel through a region that uses IPv4. To pass through this region, IPv6 packet must be encapsulated in IPv4 packet to have an IPv4 address in order to make it IPv4 routing compatible. Internet Protocol security (IPsec) in transport mode carries the payload of the encapsulating packet as a plain data without any mean of protection. That is, two nodes using IPsec in transport mode to secure the tunnel can spoof the inner payload; the packet will be de-capsulated successfully and accepted. IETF mentioned this problem in many RFCs. According to RFC 3964 there is no simple way to prevent spoofing attack in IPv6 over IPv4 tunnel and longer term solutions would have to be deployed in both IPv4 and IPv6 networks to help identify the source of the attack, a total prevention is likely impossible. This study proposed a new spoofing defense mechanism based on IPsec’s protocol Encapsulated Security Payload (ESP). ESP’s padding area had been used to write the IPv6 source address of the encapsulated packet. Simulation is conducted based on two scenarios, one with spoofing attack and one without. The outcome proved that proposed mechanism has managed to eliminate spoofing threat in IPv6 over IPv4 tunnel.

Even though more customers are regularly coming to the Internet, IPv4 addresses have been reduced by the Internet Assigned Numbers Authority (IANA) and have been deactivated in domain name registries (RIRs). IPv6, being the sole important next-generation Internet protocol, has yet to be fully developed and deployed, owing to the lack of a scheme that might address the transfer of IPv4 resources to IPv6 networks as well as collective communication between the two incompatible protocols. The Transmission Control Protocol/Internet protocol version 4 (TCP/IPv4) addresses have been reported as being on the verge of collapsing, while the next generation Internet Protocol version 6 (IPv6) is being identified on a regular basis. Among other advantages, IPv6 provides a significantly wider address space, better address design, and more security. IPv6 distribution necessitates a thorough and meticulous setup in order to avoid network disturbance and reap the benefits of IPv6. Because of the problems with IPv4, IPv6 is currently becoming increasingly popular among organizations, businesses, and Internet Service Providers (ISP). This paper we will explores the evolution of Internet Protocol version 4 (IPv4), its key features, challenges, and limitations, and examines how Internet Protocol version 6 (IPv6) addresses these issues. Additionally, we will highlight the key differences between the two protocols and discuss the transition process from IPv4 to IPv6.

2 - IPv6 Multicasting

The adoption of Internet Protocol version 6 (IPv6) has increased due to the requirements for a larger address space and better suitability for modern networks, such as Internet of Things (IoT) networks, but it also introduces new security challenges. The Neighbor Discovery Protocol (NDP) that supports features like the router discovery and address resolution, is not secured due to its stateless and trust-based feature. The most notable one is the NDP Table Exhaustion attack that consists of overwhelming the network with forged Neighbor Solicitation (NS) and Neighbor Advertisement (NA) packets, inducing neighbor cache overload and denial-of-service (DoS). Current defenses, such as Secure Neighbor Discovery (SEND) or machine learning-based detection models, have significant computational overheads and cannot be adapted to resource-constrained networks, creating a gap in the overall security of IPv6. To address this problem, this research paper suggests a lightweight, flow-based detection framework that integrates an entropy-based analysis with rule-based thresholds to detect NS and NA flooding attacks. The system gathers traffic into flows, entropy checks on key fields such as source Internet Protocol (IP) and network prefix, and alerts on anomalies when the traffic moves out of the normal operation range. It had the average precision of 0.91, average recall of 0.88, and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$F 1$</tex>-score of 0.87, but with minimal overhead and highly deployable in both enterprise and IoT networks.

Internet and telecom service providers worldwide are facing financial sustainability issues in migrating their existing legacy IPv4 networking system due to backward compatibility issues with the latest generation networking paradigms viz. Internet protocol version 6 (IPv6) and software-defined networking (SDN). Bench marking of existing networking devices is required to identify their status whether the existing running devices are upgradable or need replacement to make them operable with SDN and IPv6 networking so that internet and telecom service providers can properly plan their network migration to optimize capital and operational expenditures for future sustainability. In this paper, we implement “adaptive neuro fuzzy inference system (ANFIS)”, a well-known intelligent approach for network device status identification to classify whether a network device is upgradable or requires replacement. Similarly, we establish a knowledge base (KB) system to store the information of device internetwork operating system (IoS)/firmware version, its SDN, and IPv6 support with end-of-life and end-of-support. For input to ANFIS, device performance metrics such as average CPU utilization, throughput, and memory capacity are retrieved and mapped with data from KB. We run the experiment with other well-known classification methods, for example, support vector machine (SVM), fine tree, and liner regression to compare performance results with ANFIS. The comparative results show that the ANFIS-based classification approach is more accurate and optimal than other methods. For service providers with a large number of network devices, this approach assists them to properly classify the device and make a decision for the smooth transitioning to SDN-enabled IPv6 networks.

Endpoint-agnostic address hopping communication — a network-based design by fully exploiting IPv6 huge space superiority