Optimized multiclass classification of DDoS attacks in IoT networks with hybrid feature selection technique

Background. With the proliferation of Internet of Things (IoT) networks in the digital age, the risk of cyberattacks, especially DDoS attacks, is also increasing. IoT devices such as smart refrigerators, thermostats, webcams and other Internet-connected home appliances are being targeted by attackers who can use them as part of a botnet to conduct DDoS attacks. These devices often have inadequate network security and are rarely updated, making them vulnerable. DDoS attacks can result in significant losses such as lost revenue, reputational damage and costs to restore services. So, the vulnerability of IoT networks to DDoS attacks and the need to develop effective protection measures is a pressing issue. Objective. The purpose of the paper is to analyse software that supports DDoS attacks in IoT networks. Provide general recommendations to help improve approaches to defence measures in IoT networks against DDoS-enabled malware. Methods. Five main DDoS attack models are considered: agent-handler model, reflexive model, IRC-based model, web-based model, and P2P-based model. Three most dangerous software capable of DDoS attacks on IoT networks are analyzed: Mirai, XOR.DDoS and Linux.Hydra. Results. There are many models and methods of DDoS attacks on IoT networks. The most dangerous are Mirai, XOR.DDoS and Linux.Hydra. Each of these software has its own specific characteristics and methods of carrying out attacks. The study also showed that there are several effective measures to counter these attacks, including setting strong passwords, regularly updating software, setting up traffic filters and restricting network access. Conclusions. Key aspects of DDoS attacks, their models and process steps are considered. The paper focuses on the three most dangerous software used to conduct such attacks and provides recommendations on how to counteract them.

Ensemble classification using traffic flow metrics to predict distributed denial of service scope in the Internet of Things (IoT) networks

Software Defined Networking (SDN) is a dynamic architecture that employs a variety of applications for making networks more adaptable and centrally controlled. It is easy to attack the entire network in SDN because the control plane and data plane are separated. DDoS attack is major danger to SDN service providers because it can shut down the entire network and stop services to all customers at any time. One of the key flaws of most SDN architectures is lack of susceptibility to DDoS attacks with its types like TCP flooding, UDP flooding, SYN flooding, ICMP flooding and DHCP flooding for detecting those kinds of attacks. The machine learning algorithms are widely used in recent years to identify DDoS attacks. This research utilizes Decision Tree Classifier for detection and classification of DDoS attacks on SDN. The Forward Feature Selection technique is also used in the research to select the best features from the dataset and from that dataset the data are employed to train and test the model by Decision Tree Classifier Algorithm. The decision Tree Classifier technique is a supervised method used to forecast desired values of observations using rudimentary machine learning decision rules derived from training data. Based on the accuracy of decision tree techniques, in future, a hybrid learning model will be designed for detecting the Distributed Denial of Services in an SDN environment with high accuracy and a low false negative rate.

The increase in the deployment of IOT networks has improved productivity of humans and organisations. However, IOT networks are increasingly becoming platforms for launching DDOS attacks due to inherent weaker security and resource-constrained nature of IOT devices. This paper focusses on detecting DDOS attack in IOT networks by classifying incoming network packets on the transport layer as either “Suspicious” or “Benign” using unsupervised machine learning algorithms. In this work, two deep learning algorithms and two clustering algorithms were independently trained for mitigating DDOS attacks. Emphasis was laid on exploitation based DDOS attacks which include Transmission Control Protocol SYN-Flood attacks and UDP-Lag attacks. Mirai, BASHLITE and CICDDOS2019 datasets were used in training the algorithms during the experimentation phase. The accuracy score and normalized-mutual-information score are used to quantify the classification performance of the four algorithms. Our results show that the autoencoder performed overall best with the highest accuracy across all the datasets.

DDoS attacks often happen in cloud servers and cause a devastating problem. However, an increasing number of Internet of Things (IoT) devices makes us not ignore the influence of large-scale DDoS attacks from IoT devices. In this paper, we propose a machine learning-based on a multi-layer IoT DDoS attack detection system, including IoT devices, IoT gateways, SDN switches, and cloud servers. Firstly, we build eight smart poles with various sensors on our campus and collect sensor data as our datasets through wireless networks or wired networks. Next, we extract the features based on DDoS attack types. The feature selection can result in high accuracy DDoS attack detection in the real IoT environment. The experimental results show that our multi-layer DDoS detection system can accurately detect DDoS attacks. And the SDN controller can block venomous devices effectively according to blacklists from the results of our IoT DDoS attacks detection system.

In the Internet of Things (IoT) technology, there are several issues to overcome, including network security. New attacks have been developed to target vulnerabilities in IoT devices, and the Internet of Things on a huge scale will exacerbate present network threats. Machine learning is becoming increasingly used in applications such as traffic classification and intrusion detection. This paper offers a technique for detecting network fault severity and identifying Internet of Things (IoT) devices based on several attributes. By pushing information to the network area, the proposed framework captures different features from each network flow in order to identify the source of traffic and the type of traffic generated is used to detect different network attacks. Different machine learning algorithms are tested to find the better suited algorithm that deliver best results. The following are some of the examples: Random Forest (RF) algorithm, decision tree, SVM, etc. After completing the experimentation, it was found that the random forest classifier and decision tree are the best performing ML algorithms to classify the network severity with an accuracy of about 96.98% and GNB is found as the least performing machine learning model with an accuracy of about 54.41%.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

Vehicular ad hoc networks (VANETs) are a group of nodes that remain dynamically and randomly situated. VANETs are considered as one of the most prominent technologies for improving the efficiency and safety of modern transportation systems. However, the VANET is also subjected to attacks that will weaken the performance of vehicular communication. To enable communication inside the VANET system, a routing protocol helps to determine directions among nodes. VANET network nodes move very quickly from one place to another, and in that time DDoS attacks will occur in the VANET network. Therefore, it is important to implement DDoS attack detection-based communication level on the entire VANET system. The source node will send data or information to the destination using intermediate nodes, whenever a DDoS attack happens in the node. In this paper, an approach is proposed for detection of a DDoS attack in a VANET network by using the adapted stream region scheme. Once the attack occurs in the VANET network, all the data will be damaged or hacked by another attacker. To minimize the DDoS attack and optimize the assigned problem, the author is using packet marking based on adapted stream region (PMBASR) techniques on the network. The PMBASR techniques are used to trace back to the source node, then the node of origin used in RSU server for data request, and at the same time the data will receive a response in the network. Nevertheless, an analytical approach will use PMBASR to detect the DDoS attack and further improve the network performance. Finally, the Ns2 simulation result proves it to be a better result-oriented approach.

Even though the organisation uses various security measures the attacks over the internet are increasing day by day. This paper proposes a hybrid feature selection model for the detection of a DDoS attack. In this paper, the two-step hybrid feature selection method is used. The CICIDS2017 dataset with 84 features is used for the implementation. Information gain, gain ratio, and correlation filter-based algorithms are used for the ranking of features and then the forward selection approach is used to reduce the features up to 32. The system gives higher accuracy of 88.7373% for the correctly classifying DDoS attack.

DDoS attacks have been the major threats for the Internet and can bring great loss to companies and governments. With the development of emerging technologies, such as cloud computing, Internet of things, artificial intelligence techniques, attackers can launch a huge volume of DDoS attacks with a lower cost, and it is much harder to detect and prevent DDoS attacks. Because DDoS traffic is similar to normal traffic. Some artificial intelligence techniques like machine learning algorithms have been used to classify DDoS attack traffic and detect DDoS attacks, such as Naive Bayes and Random forest tree. In the paper, we survey on the latest progress on the DDoS attack detection using artificial intelligence techniques and give recommendations on artificial intelligence techniques to be used in DDoS attack detection and prevention.

The paper aims to provide a summary with a reference to the Internet of Things (IoT) of the distributed denial of service (DDoS). The network research community has known about the denial of service (DoS), which is intended to stop legitimate users from accessing a particular network tool since the early 1980s. The aim of the paper is to define DDoS scope, classifications and opportunities for assailants who use IoT to conduct such operations and to use IoT in healthcare. The research approach is to analyze DDoS, IoT and the use of IoT literature in the health sector. The study found that DDOS attacks on IoT-specific devices have become a very easy phenomenon because network attacks are much simpler due to limited security protocols. IOT distribution companies have made limited efforts to enable security of these devices and protecting the data, thus making them susceptible to vulnerabilities. Due to weak security layers, the confidentiality, authenticity and integrity of private data collected by IoT devices are threatened by attackers. The current research identified the gap and importance for further research to provide a mechanism for detection and prevention of DDOS attack in the application layer of IoT healthcare devices in India. Considering the major challenges in IOTs in defending against external attacks and hacking, it is important that they have inherent frameworks warding off such attacks.

Android OS based applications offer services in various aspects of our daily lives such as banking, personal, professional, social, etc. Increased usage of Android applications makes them extremely vulnerable to various malware threats. A resilient and attack resistant machine learning based Android malware detector is desired to achieve a safe working environment. This work employs feature selection on static and dynamic features and proposes a hybrid feature selection method that can identify most informative features while eliminating the irrelevant ones. Information gain from filter and recursive feature elimination from wrapper feature selection methods outperform other evaluated feature selection techniques. Thereafter, different classification algorithms are trained on the features selected through hybrid feature selection technique and experimental results showed that XGBoost obtained maximum accuracy i.e., 98% and 89% for binary and multiclass classification respectively using only 50 features.

A distributed denial of service attack is coordinated and synchronized set of comprehensive attacks on a sophisticated network and its services that hampers the network infrastructure thereby bringing down its performance. Its effects are characterized by the uninformed delays and interruptions accompanied by undue losses. Since no optimal methodology exists, the internet continues to remain susceptible to DDoS attacks. The PacketScore scheme is a practical DDoS defense mechanism, which approximates the authenticity of the packets concerning its attribute values and discards selective attack packets. This paper extends the PacketScore scheme and implements a new two-level filtering mechanism using leaky bucket that can lessen the losses created by the attacks. The proposed scheme validates the data signatures of the packets complementing the check performed on the packet header. This two-level scrutiny enhances the correctness of detection of DDoS attacks. A standard model to review the efficiency of the two-level filtering has been proposed and the scheme has been deployed and tested in ANTS active network tool kit. The implementation of the proposed scheme is easy let alone efficient and effective in DDoS attack detection with an accurate response to varying DDoS attacks.

Aiming at the problem of DDoS attack detection in internet of things (IoT) environment, statistical and machine-learning algorithms are proposed to model and analyze the network traffic of DDoS attack. Docker-based virtualization platform is designed and configured to collect IoT network traffic data. Then the packet-level, flow-level, and second-level network traffic datasets are generated, and the importance of features in different traffic datasets are sorted. By SKlearn and TensorFlow machine-learning software framework, different machine learning algorithms are researched and compared. In packet-level DDoS attack detection, KNN algorithm achieves the best results; the accuracy is 92.8%. In flow-level DDoS attack detection, the voting algorithm achieves the best results; the accuracy is 99.8%. In second-level DDoS attack detection, the RNN algorithm behaves best results; the accuracy is 97.1%. The DDoS attack detection method combined with statistical analysis and machine-learning can effectively detect large-scale DDoS attacks on the internet of things simulation experimental environment.

Modern IoT devices are expanding digital interconnectivity at a very fast rate and, at the same time, intensifying the risks of possible device malfunctions and DDoS attacks. Classical intrusion detection systems (IDS), dependent on static rules and old datasets, are incapable of keeping up with the changing traffic behavior of modern IoT networks. This paper proposes an innovative Hybrid Machine Learning – Deep Learning (ML-DL) model which autonomously detects IoT anomalies by combining the interpretability of ML algorithms and the representational strength of DL architectures. The proposed framework combines Random Forest (RF) and Support Vector Machine (SVM) models with a two-stage fusion process involving a Convolutional Neural Network (CNN) on the CICIoT2023 dataset, collected through traffic network data from 105 IoT devices and 33 categories of diverse attacks. Evaluation of the model included accuracy, precision, recall, and F1-Score and was marked as a through-and-through rigorous experiment. The hybrid model achieved an accuracy of 99.1%, with precision and F1-Score also valued at 0.99, thus outperforming standalone ML and DL models. The hybridization, then, does enhance detection reliability and generalization while being computationally inexpensive for IoT edge deployment. Thus, this work lays down a practically implementable and scalable basis for real-time automation of malfunctioning and intrusion detection in the IoT space.