Addressing the Effectiveness of DDoS-Attack Detection Methods Based on the Clustering Method Using an Ensemble Method

Zeinalpour, Alireza; Ahmed, Hassan A.

doi:10.3390/electronics11172736

Cited by 3 publications

(29 citation statements)

References 54 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We used the available CICIDS2017 network traffic dataset. This dataset contains information from benign and DDoS attack network data [5]. The independent variables were the wrapper method and the hybrid approach.…”

Section: Methodsmentioning

confidence: 99%

“…DDoS attack detection methods can be effective in recognizing and neutralizing DDoS events [5]. Intrusion detection systems (IDS) play a major role in distinguishing between normal and abnormal network traffic activity [6].…”

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…The clustering-based DDoS attack detection method is an unsupervised approach that suffers from the curse of dimensionality [5]. Here machine learning algorithms analyzing network traffic data are overwhelmed by the computational load due to the astronomically Electronics 2024, 13, 899 2 of 16 large number of features present in the data [9]. Various strategies to enhance feature selection have been proven to improve the performance of machine learning models through the elimination of irrelevant and duplicate data [10].…”

Section: Introductionmentioning

confidence: 99%

“…Zeinalpour and Ahmed [9] found that the addition of the filter method prior to applying the clustering algorithms did not lead to better detection of DDoS attacks, but that the addition of the wrapper method alone was shown to be a superior approach. In previous work, the addition of the wrapper method formed a hybrid approach through its incorporation into the process after the filter method.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Comparing Metaheuristic Search Techniques in Addressing the Effectiveness of Clustering-Based DDoS Attack Detection Methods

Zeinalpour,

McElroy

2024

Electronics

Self Cite

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks have increased in frequency and sophistication over the last ten years. Part of the challenge of defending against such attacks requires the analysis of very large volumes of data. Metaheuristic algorithms can assist in selecting relevant features from the network traffic data for use in DDoS detection models. By efficiently exploring different combinations of features, these methods can identify subsets that are informative for distinguishing between normal and attack traffic. However, identifying an optimized solution in this area is an open research question. Tuning the parameters of metaheuristic search techniques in the optimization process is critical. In this study, a switching approximation is used in a variety of metaheuristic search techniques. This approximation is used to find the best solution for the analysis of the network traffic features in either lower or upper values between 0 and 1. We compare the fine-tuning of this parameter against standard approaches and find that it is not substantially better than the BestFirst algorithm (a standard default approach for feature selection). This study contributes to the literature by testing and eliminating various fine-tuning strategies for the metaheuristic approach.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Comparing Metaheuristic Search Techniques in Addressing the Effectiveness of Clustering-Based DDoS Attack Detection Methods

Zeinalpour,

McElroy

2024

Electronics

Self Cite

View full text Add to dashboard Cite

show abstract

An Unsupervised Approach for the Detection of Zero-Day DDoS Attacks in IoT Networks

Roopak,

Parkinson,

Tian

et al. 2024

Preprint

View full text Add to dashboard Cite

In this article, an unsupervised IDS (Intrusion Detection System) is presented for the detection of zero-day DDoS (Distributed Denial of Service) attacks for IoT (Internet of Things) networks that can detect anomalies without the need for prior knowledge or training in attack information. Attackers exploit existing undiscovered vulnerabilities in the system to launch zero-day attacks. There exist many traditional deep learning and machine learning based attack detection systems that cannot deal with and detect new zero-day attacks and mostly misclassify those attacks. Zero-day attacks are often new unknown threats that have not been encountered before, in addition, labelling of data is a time-consuming task for security experts, So there exists a need for unsupervised methods that can detect unseen cyber-attacks on the zero-day. DDoS attacks have recently adversely affected many organisations in terms of finance and services, as these attacks have become more sophisticated and damaging. The growth of IoT networks has facilitated the launch of more DDoS attacks. In this work, an unsupervised approach-based algorithm is proposed for the detection of zero-day DDoS attacks in IoT networks by exploiting random projection for the feature selection process to reduce the dimensionality of the network data and ensemble model consisting of K-means, GMM and one-class SVM for the unsupervised classification of the data as attack and normal using the hard voting technique. The CIC-DDoS2019 datasets are used for an extensive evaluation of the proposed method. The proposed method has obtained an accuracy of 94.55%, which is better than the other state-of-the-art unsupervised learning-based methods.

show abstract

Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review

2023

View full text Add to dashboard Cite

The recent advancements in security approaches have significantly increased the ability to identify and mitigate any type of threat or attack in any network infrastructure, such as a software-defined network (SDN), and protect the internet security architecture against a variety of threats or attacks. Machine learning (ML) and deep learning (DL) are among the most popular techniques for preventing distributed denial-of-service (DDoS) attacks on any kind of network. The objective of this systematic review is to identify, evaluate, and discuss new efforts on ML/DL-based DDoS attack detection strategies in SDN networks. To reach our objective, we conducted a systematic review in which we looked for publications that used ML/DL approaches to identify DDoS attacks in SDN networks between 2018 and the beginning of November 2022. To search the contemporary literature, we have extensively utilized a number of digital libraries (including IEEE, ACM, Springer, and other digital libraries) and one academic search engine (Google Scholar). We have analyzed the relevant studies and categorized the results of the SLR into five areas: (i) The different types of DDoS attack detection in ML/DL approaches; (ii) the methodologies, strengths, and weaknesses of existing ML/DL approaches for DDoS attacks detection; (iii) benchmarked datasets and classes of attacks in datasets used in the existing literature; (iv) the preprocessing strategies, hyperparameter values, experimental setups, and performance metrics used in the existing literature; and (v) current research gaps and promising future directions.

show abstract

Addressing the Effectiveness of DDoS-Attack Detection Methods Based on the Clustering Method Using an Ensemble Method

Cited by 3 publications

References 54 publications

Comparing Metaheuristic Search Techniques in Addressing the Effectiveness of Clustering-Based DDoS Attack Detection Methods

Comparing Metaheuristic Search Techniques in Addressing the Effectiveness of Clustering-Based DDoS Attack Detection Methods

An Unsupervised Approach for the Detection of Zero-Day DDoS Attacks in IoT Networks

Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review

Contact Info

Product

Resources

About