Poster Abstract: Real-Time DDoS Detection Based on Complex Event Processing for IoT

Deep learning techniques for DDoS attack detection: Concepts, analyses, challenges, and future directions

Distributed Denial of Service (DDoS) attack is a serious threat to commercial service network. DDoS attack has been studied for years. However, detecting and relieving DDoS attacks are still a problem. Especially, nowadays more and more DDoS attacks produce heavy network traffic, it is hard to response rapidly because that needs high processing performance to process massive traffic data. With big data technology, volumes of network traffic data can be processed much faster. Apache Spark can process a great amount of data in a reasonable time so that DDoS attack can be detected in time. Besides, it is difficult to modify the network configuration in traditional network. With Software-Defined Networking (SDN), a new paradigm in networking, networking can be controlled by programs, which makes modifying the network configuration easier. In this paper, a DDoS detection and mitigation system framework in SDN is introduced, a framework that can control network based on analyzing the network traffic data. Comparing to the traditional defense methods of DDoS attack, the framework can response to DDoS attack by rules automatically.

a serious nuisance for network security could be a Distributed Denial of Service (DDoS) attack. The advent of the technological era has also brought along the threat of DDoS attacks for a variety of services and applications that use the Internet. Firms can incur huge financial losses even if there is a disruption in services for a fraction of a period. Analogous to a DDoS attack is the Flash Crowd (FC), in which a particular service is assessed by many legitimate users concurrently, which results in the denial of service. Overloading of network resources is a common issue associated with both these events, which impact CPU, available bandwidth, and memory for legitimate users, thereby leading to limited accessibility. Many researchers have put effort to differentiate between these two kinds of traffic, but none could come up with an effective solution. In this study, we propose an adaptive agent-based model, known as an adaptive application layer flooding protection (AALFP) model, for DDoS and FC flooding attacks. The AALFP model is aimed to protect the network application layer (NAL) against such attacks. Importantly, the model distinguishes and separates normal from abnormal traffic, and then blocks illegitimate traffic. Note that, to operate two traffic filters, the agent relies on the following three parameters of normal traffic intensity, traffic attack behaviour, and IP address history log. An example scenario is provided to simulate the model's application.

A Distributed Denial of Service (DDoS) attack occurs when an attacker tries to disrupt a network, service or website by flooding huge numbers of packets on the internet traffic. Detecting DDoS attacks serves the goal of spotting and addressing them promptly to reduce their effects on the network, system or service being targeted. Detecting Distributed Denial of Service (DDoS) attacks is crucial, for people, companies and network managers. The detection of DDoS attacks has ranging uses in industries such as network security safeguarding websites, managing cloud services ensuring the security of online systems and services. Detecting DDoS attacks is essential for safeguarding infrastructure upholding service availability and guaranteeing the security of online systems and services. To achieve this objective, we proposed a framework to detect DDoS attacks including six steps. In step one, we start by gathering information, which includes network activity and system records, for operations as well as instances of DDoS attacks. Step two, we identify characteristics of the data collected such as patterns in network traffic, packet details, IP addresses, types of protocols used and more. Step three, we utilize algorithms for feature selection such as Salp Swarm Algorithm (SSA), Gray Wolf Algorithm (GWA), Particle Swarm Algorithm (PSO) to pinpoint the features that can distinguish between normal activities and DDoS attack patterns. After that in step four, we divide the processed dataset into sections for training and testing purposes to develop and assess the machine learning models such as SVM (support vector machine), and KNN (K-nearest neighbor). Step five we develop a classification model using machine learning techniques like decision trees, forests, support vector machines (SVM) logistic regression models or neural networks. Finally, we assess the effectiveness of models through metrics such as accuracy rates, precision levels, recall rates, and F1 scores. The results show that the proposed models achieve high results (99.9%). In summary detecting DDoS attacks is crucial for protecting networks, systems and online services against disruptions.

Distributed Denial of Service (DDoS) attacks have emerged as one of the most pervasive and damaging threats to network security, disrupting services and incurring substantial financial costs. Machine learning (ML) has been widely explored as a potential solution to enhance DDoS detection and mitigation. This systematic review evaluates the effectiveness of ML techniques in detecting DDoS attacks, synthesizing findings from studies published between 2004 and 2024. The review analyzes models such as Random Forest, Support Vector Machines (SVM), and K-Nearest Neighbors (K-NN) based on key performance metrics like accuracy, precision, recall, and F1-score. A comprehensive search of multiple databases, including Web of Science, IEEE, Scopus, ScienceDirect, and Google Scholar, resulted in 19 studies that met inclusion criteria. The findings show that ensemble methods, particularly Random Forest, consistently outperformed other models in terms of detection rates, mainly due to their ability to handle large feature sets and reduce overfitting. Support Vector Machines also performed well in specific scenarios. However, their effectiveness was sometimes limited by computational complexity and the dataset size. K-Nearest Neighbors showed mixed results, depending on the nature of the attack patterns. This review emphasizes the potential of ensemble learning approaches for DDoS detection, demonstrating their robustness in dynamic environments. The review identifies key gaps in the existing research, including the need for better feature selection and exploring deep learning techniques to enhance DDoS detection accuracy and adaptability further. This study contributes valuable insights into the strengths and limitations of ML-based DDoS detection models, offering a foundation for future advancements in the field. It underscores the importance of continued research into hybrid and deep learning models to address the evolving and increasingly sophisticated nature of DDoS attacks in real-world applications.

Internet of Things (IoT) security is becoming important with the growing popularity of IoT devices and their wide applications. Recent network security reports revealed a sharp increase in the type, frequency, sophistication, and impact of distributed denial of service (DDoS) attacks on IoT systems, making DDoS one of the most challenging threats. DDoS is used to commit actual, effective, and profitable cybercrimes. The current machine learning-based IoT DDoS attack detection systems use batch learning techniques, and hence are unable to maintain their performance over time in a dynamic environment. The dynamicity of heterogeneous IoT data causes concept drift issues that result in performance degradation and automation difficulties in detecting DDoS. In this study, we propose an adaptive online DDoS attack detection framework that detects and adapts to concept drifts in streaming data using a number of features often used in DDoS attack detection. This paper also proposes a novel accuracy update weighted probability averaging ensemble (AUWPAE) approach to detect concept drift and optimize zero-day DDoS detection. We evaluated the proposed framework using IoTID20 and CICIoT2023 dataset containing benign and DDoS traffic data. The results show that the proposed adaptive online DDoS attack detection framework is able to detect DDoS attacks with an accuracy of 99.54% and 99.33% for the respective datasets.

Cloud computing facilitates the users with on-demand services over the Internet. The services are accessible from anywhere at any time. Despite the valuable services, the paradigm is, also, prone to security issues. A Distributed Denial of Service (DDoS) attack affects the availability of cloud services and causes security threats to cloud computing. Detection of DDoS attacks is necessary for the availability of services for legitimate users. The topic has been studied by many researchers, with better accuracy for different datasets. This article presents a method for DDoS attack detection in cloud computing. The primary objective of this article is to reduce misclassification error in DDoS detection. In the proposed work, we select the most relevant features, by applying two feature selection techniques, i.e., the Mutual Information (MI) and Random Forest Feature Importance (RFFI) methods. Random Forest (RF), Gradient Boosting (GB), Weighted Voting Ensemble (WVE), K Nearest Neighbor (KNN), and Logistic Regression (LR) are applied to selected features. The experimental results show that the accuracy of RF, GB, WVE, and KNN with 19 features is 0.99. To further study these methods, misclassifications of the methods are analyzed, which lead to more accurate measurements. Extensive experiments conclude that the RF performed well in DDoS attack detection and misclassified only one attack as normal. Comparative results are presented to validate the proposed method.

DDoS (Distributed Denial of Service) attacks consist of a large number of compromised computer systems that launch joint attacks at a targeted victim, such as a server, website, or other network equipment, simultaneously. DDoS has become a widespread and severe threat to the integrity of computer networks. DDoS can lead to system paralysis, making it difficult to troubleshoot. As a key building block in the development of an integrated defense system, it is essential to detect DDoS attacks as early as possible. With the popularization of artificial intelligence, more and more researchers apply machine learning (ML) and deep learning (DL) to the detection of DDoS attacks and have achieved satisfactory accomplishments. The complexity and sophistication of DDoS attacks have kept increasing and evolving since the first DDoS attack was reported in 1996. Regarding the headways in this problem, a new type of DDoS attack, named adversarial DDoS attack, is investigated in this study. The generating adversarial DDoS traffic is carried out using a symmetric Generative Adversarial Networks (GAN) architecture called Cycle-GAN to demonstrate the severe impact of adversarial DDoS attacks. Experiment results reveal that the synthesized traffic can easily penetrate ML-based detection systems, including Random Forest, KNN (k-Nearest Neighbor), SVM (Support Vector Machine), and Naïve Bayes. These alarming results intimate the urgent need for countermeasures against adversary DDoS attacks.

The popularization of the Internet of Vehicles (IoV) technology has not only brought many conveniences but also caused security issues such as distributed denial of service (DDoS) attacks. Using deep learning methods to deal with DDoS attacks has achieved remarkable results. However, to improve the effectiveness of the model, a large amount of high-quality data is needed. This data is often scattered among different vehicle operating companies or organizations, making it difficult to train effective attack detection models by centralizing the data. To solve this problem, this paper proposes a DDoS attack detection method based on reinforced federated learning in the IoV environment. This method applies reinforcement learning to the aggregation process of federated learning to optimize the DDoS attack detection algorithm. In this method, the fog node server of the IoV serves as a participant in learning, uses local data to conduct reinforcement learning, and uploads the trained model parameters to the edge server of the IoV for aggregation. By learning the adaptability of the fog node model to the environment, reinforced federated learning can improve the accuracy of the DDoS attack detection model in terms of unbalanced data distribution and model convergence efficiency. Experiments were carried out using the public DDoS attack dataset. The experimental results showed that the proposed method exhibited excellent performance in the IoV environment, providing new ideas and methods for the research of IoV security.

The existing methods for backbone networks only analyze coarse-grained network traffic characteristic parameters.Thus,they cannot guarantee both the premise of abnormal flow identification and the real-time detection for DoS(Denial of Service) DDoS(Distributed Denial of Service,DDoS) attacks.Concerning this problem,a DoSDDoS attack detection and abnormal flow identification method for backbone networks was proposed.First,it analyzed coarse-grained network traffic characteristic parameters to determine the time points that abnormal behaviors occur;then,fine-grained traffic behavior characteristic parameters were analyzed in these time points to find the destination IP addresses that correspond to abnormal behaviors;finally,comprehensive analysis was conducted for extracted traffic that correspond to abnormal behaviors to determine DoS and DDoS attacks.The simulation results show that,the proposed method can effectively detect DoS attacks and DDoS attacks in backbone networks.Meanwhile,it could accurately identify the abnormal traffic,while real-time detection is ensured.

The internet network is mostly victimized to the Distributed Denial of Service (DDOS) attack, which is one that intentionally occupies the computing resources and bandwidth in order to deny that services to potential users. The attack scenario is to flood the packets immensely. If the attack source is single, then the attack is referred as denial of service (DOS) and if attack is sourced from divergent servers, then it is referred as DDOS. Over a decade many of the researchers considered the detection and prevention of DDOS attack as research objective and succeeded to deliver few significant DDOS detection and prevention strategies. How fast and early detection of DDOS attack is done in streaming network transactions is still a significant research objective in present level of internet usage. Unfortunately the current benchmarking DDOS attack detection strategies are failing to justify the objective called “fast and early detection of DDOS attack”. In order to this, in this paper we devised a Bio-Inspired Anomaly based application layer DDoS attack (App-DDOS Attack) detection that is in the aim of achieving fast and early detection. The proposed model is a bio-inspired bat algorithm that used to achieve the fast and early detection of the App-DDOS by HTTP flood. The experiments were carried out on bench marking CAIDA dataset and the results delivered are boosting the significance of the proposed model to achieve the objective of the paper.

The exponential growth of interconnected systems across the Internet of Things (IoT), Software-Defined Networks (SDN), and cloud environments has led to a drastic increase in the scale and advancement of Distributed Denial of Service (DDoS) attacks. Conventional defences based on machine learning are often static, traffic-centric, and lack adaptivity to dynamic network behaviour, resulting in high false-positive rates and delay in mitigation responses. To address these challenges, this paper presents a conceptual framework for an AI-driven, context-aware DDoS detection and mitigation system. The proposed approach employs a optimized Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) model for efficient, real-time detection of DDoS attacks. The model captures spatial and temporal correlations in traffic while incorporating contextual parameters such as Quality of Service (QoS), Service Level Agreement (SLA) priority, and workload telemetry. These contextual attributes enable the model to distinguish legitimate network fluctuations from malicious activities, so that the false positive rate will be reduced without compromising accuracy. For adaptive response, a Reinforcement Learning (RL)-based mitigation layer—exploiting Deep Q-Network (DQN) and Actor–Critic (AC) variants—continuously learns optimal mitigation actions based on real-time feedback. The interaction between detection and mitigation components forms a context-aware feedback loop, enabling dynamic policy refinement and continuous system improvement. Comprehensive literature analysis reveals that existing AI-based DDoS defense mechanisms lack integration between detection and mitigation, and often overlook contextual intelligence. The proposed framework bridges this gap by introducing a self-adaptive, feedback-driven defense system capable of maintaining detection precision, low latency, and QoS preservation in heterogeneous environments.

Various types of routing attacks and their corresponding countermeasures for mobile ad hoc networks (MANETs) have been identified in the literature study. However problems of computational complexity and false alarms have not yet been reduced. In this paper, we have proposed a proactive detection mechanism for distributed denial of service (DDoS) which considers feature extraction, reduction of entropy, clustering technique and feature ranking. These techniques are approached by statistical analysis and involved for XOR marking to classify legitimate and malicious data packets. Our system applies detection methodologies on each packet, finds abnormalities during the pre-attack phase itself and filters them. Experiments are done with the 2000 DARPA intrusion detection scenario specific dataset to assess detection time, ratio of false alarms, and complexity. The experimental results show the efficiency of proposed system in detection of DDoS attack with larger reduction of false positive and computational complexity.

With the increasing number of Internet users, cybersecurity is becoming more and more critical. Denial of service (DoS) and distributed denial of service (DDoS) attacks are two of the most common types of attacks that can severely affect a website or a server and make them unavailable to other users. The number of DDoS attacks increased by 55% between the period January 2020 and March 2021. Some approaches for detecting the DoS and DDoS attacks employing different machine learning and deep learning techniques are reported in the literature. Recently, it is also observed that the attackers have started leveraging state-of-the-art AI tools such as generative models for generating synthetic attacks which fool the standard detectors. No concrete approach is reported for developing and training the models which are not only robust in the detection of standard DDoS attacks but which can also detect adversarial attacks which are created synthetically by the attackers with harmful intentions. To that end, in this work, we employ a generative adversarial network (GAN) to develop such a robust detector. The proposed framework can generate and classify the synthetic benign (normal) and malignant (DDoS) instances which are very similar to the corresponding real instances as evaluated by similarity scores. The GAN-based model also demonstrates how effectively the malicious actors can generate adversarial DDoS network traffic instances which look like normal instances using feature modification which are very difficult for the classifier to detect. An approach on how to make the classifiers robust enough to detect such kinds of deliberate adversarial attacks via modifying some specific attack features manually is also proposed. This work provides the first step towards developing a generic and robust detector for DDoS attacks originating from various sources.

A novel approach for accurate detection of the DDoS attacks in SDN-based SCADA systems based on deep recurrent neural networks