Recently, D/DoS attacks have been launched by zombie IoT devices in smart home networks. They pose a great threat to network systems with Application Layer DDoS attacks being especially hard to detect due to their stealth and seemingly legitimacy. In this paper, we propose ForChaos, a lightweight detection algorithm for IoT devices, which is based on forecasting and chaos theory to identify flooding and DDoS attacks. For every time-series behaviour collected, a forecasting-technique prediction is generated, based on a number of features, and the error between the two values is calculated. In order to assess the error of the forecasting from the actual value, the Lyapunov exponent is used to detect potential malicious behaviour. In NS-3 we evaluate our detection algorithm through a series of experiments in flooding and slow-rate DDoS attacks. The results are presented and discussed in detail and compared with related studies, demonstrating its effectiveness and robustness.

No abstract

No abstract

Malicious software [1] is one of the main threats to networks and its assets, as well as individual users. As we approach the Internet of Things and Cyber-Physical Systems era, network traffic becomes more complex and heterogeneous. In recent years, the number of devices connected to the Internet is increased exponentially as well as big data that is produced from them. Also, each device comes with its own protocols and standards. Furthermore, computing devices operate with different protocols and standards and effective traffic monitoring becomes harder. Hence, adversaries conduct more sophisticated attacks against networks so the malicious behaviour can be more difficult to be detected. Simplistic and one-dimensional security countermeasures are likely to fail under such circumstances. Artificial intelligence and particularly learning algorithms seems to be appropriate for detecting cyber attacks. Using machine learning, fast and accurate detection of malicious behaviour is more achievable than ever. A special branch of machine learning algorithms includes nature and bio inspired algorithms. Such algorithms followed models from nature, biology, social systems and life sciences. Some examples include genetic algorithms, swarm intelligence, artificial immune systems, evolutionary algorithms, artificial neural networks, fractal geometry, chaos theory and so on [2]. Nature/Bio-inspired algorithms have an advantage against traditional machine learning algorithms, they focus on optimisation. In detail, nature acts as a method of making something as perfect as possible or choosing the most fitted samples from a population. In practice, this family of algorithms applies these principles in the form of optimisation and finding the best solution to the problem assigned. In anomaly detection, the main objective is to identify the malicious behaviour so these algorithms use their best-fit mechanisms to detect malicious abnormalities. Another beneficial usage of nature/bio inspired algorithms is to optimise the potential features used in attacks detection. An optimal set of features is selected for efficient malware detec