A Spatiotemporal-Oriented Deep Ensemble Learning Model to Defend Link Flooding Attacks in IoT Network

Abstract

(1) Background: Link flooding attacks (LFA) are a spatiotemporal attack pattern of distributed denial-of-service (DDoS) that arranges bots to send low-speed traffic to backbone links and paralyze servers in the target area. (2) Problem: The traditional methods to defend against LFA are heuristic and cannot reflect the changing characteristics of LFA over time; the AI-based methods only detect the presence of LFA without considering the spatiotemporal series attack pattern and defense suggestion. (3) Methods: This study designs a deep ensemble learning model (Stacking-based integrated Convolutional neural network–Long short term memory model, SCL) to defend against LFA: (a) combining continuous network status as an input to represent “continuous/combination attacking action” and to help CNN operation to extract features of spatiotemporal attack pattern; (b) applying LSTM to periodically review the current evolved LFA patterns and drop the obsolete ones to ensure decision accuracy and confidence; (c) stacking System Detector and LFA Mitigator module instead of only one module to couple with LFA detection and mediation at the same time. (4) Results: The simulation results show that the accuracy rate of SCL successfully blocking LFA is 92.95%, which is 60.81% higher than the traditional method. (5) Outcomes: This study demonstrates the potential and suggested development trait of deep ensemble learning on network security.

Internet of Things Applications, Security Challenges, Attacks, Intrusion Detection, and Future Visions: A Systematic Review

“…Bots are utilized to send traffic to the victim at comparatively lower speed in link-flooding attacks. These attacks are defended by Chen et al [164] using an ensemble of CNN and LSTM models. The link-flooding DDoS attacks are difficult to mitigate; LSTM is utilized in this work to review the attack patterns periodically.…”

CyberPulse++: A machine learning‐based security framework for detecting link flooding attacks in software defined networks

“…More recently researchers are focusing on the detection and mitigation of LFA in the network of the Internet of Things (IoT). Chen et al 36 use a model based on convolutional neural networks to learn the changing patterns in time and space of LFA attacks targeting sensor devices in IoT networks. Long short‐term memory (LSTM) is used for storing samples allowing constant review of LFA patterns and removal of obsolete patterns to improve decision accuracy.…”