A generalized machine learning‐based model for the detection of DDoS attacks

Abstract

As time is progressing, the number and the complexity of methods adopted for launching distributed denial of service (DDoS) attacks are changing. Therefore, we propose a methodology for the development of a generalized machine learning (ML)-based model for the detection of DDoS attacks. After exploring various attributes of the dataset chosen for this study, we propose an integrated feature selection (IFS) method which consists of three stages and integration of two different methods, that is, filter and embedded methods to select features which highly contribute to the detection of various types of DDoS attacks. We use light gradient boosting machine (LGBM) algorithm for training of the model for classification of benign and malicious flows. For ensuring satisfactory performance and generalized behavior of the developed model, we test it by passing records of unseen DDoS attack types. Several performance metrics are employed for the evaluation of the model. By comparing the performance of developed model against state-of-the-art models, we state an improvement of around 20% for almost all the reported metrics. We also show that the performance of the model improves if feature space is reduced by 77%. Furthermore, the generalized behavior of the developed model is justified by demonstrating a trade-off between high variance and high bias ML models.

Enhancing the Efficiency of Gaussian Naïve Bayes Machine Learning Classifier in the Detection of DDOS in Cloud Computing

“…Many efforts have been made to help prevent DDOS by detecting them using machine learning techniques. Marvie et al [21], aimed to enhance detection models in ML by plummeting the number of features used in the model using two feature selection techniques, including filter and embedded. They reduced the features to 20 features of the CICDDoS2019 through the f-test and random forest and trained the model using light gradient boosting algorithms (LGBM).…”

“…This method encompasses the benefits of both the wrapper and filter methods and maintains reasonable computational costs examples include Random Forest Feature Importance (RFFI) and LASSO Regularization (L1) [41] [42] [24] [26]. As stated in the literature review section, authors in [21] [22] [24] [29] highlighted that the use of more than one approach results in better accuracy and reliable classification. As mentioned in our previous research [29] we used the same iterative approach.…”

Research on the Characteristics and Detection Methods of DDoS Attacks on Wireless Sensor Networks for Vehicle Networking

“…Currently there are more monitoring methods proposed for DDoS attacks on wireless sensor networks at home and abroad, With the wide application of wireless sensors in Vehicular Ad hoc Networks (VANET), the network topology composed of wireless sensors within VANET shows dynamic changes because the vehicle itself is in a driving and moving state. In the future ITS, network security will be the most important part, Batchu et al [2][3][4] used Semi-supervised machine learning obtaining subsets of unlabeled or partially labeled dataset based on the applicable metrics of dissimilarity. Singh et al [5][6][7] used two stages model that the optimal features were subjected to classification using the Deep Convolutional Neural Network (CNN) model, in which the presence of network attacks can be detected.…”

Deep Learning-based Attack Detector for Bilateral Teleoperation Systems

“…In [26], the implementation of an intelligent system using deep learning for network control and monitoring was a focus of this work, with the end objective of improving the level of precision inside the network and its applications. In [27], authors proposed a methodology for developing a generalized machine learning-based model for detecting DDoS attacks where the generalized behavior of the developed model is justified by demonstrating a trade-off between high variance and high bias ML models. In this study, the authors claimed that they achieved an improvement of around 20% compared to the previously achieved metrics.…”