An Adaptive Model for Detection and Prevention of DDoS and Flash Crowd Flooding Attacks

Khalaf, Bashar Ahmed; Mostafa, Salama A.; Abdullah, Noryusliza

doi:10.1109/isamsr.2018.8540546

Cited by 15 publications

(10 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• Software agent technique covers various roles in DDoS attack and defense methods. It provides various mechanisms of communication and decision-making to (1) compare current traffic with the normal traffic in realtime in order to control network traffic and mitigate DDoS attack as in [72], [73]; (2) defense against DDoS attack as in [74] and (3) make a distributed defensive scheme against DDoS attacks in the ISP domains as in [75].…”

Section: Analysis and Discussionmentioning

confidence: 99%

See 1 more Smart Citation

Comprehensive Review of Artificial Intelligence and Statistical Approaches in Distributed Denial of Service Attack and Defense Methods

et al. 2019

Self Cite

View full text Add to dashboard Cite

Until now, an effective defense method against Distributed Denial of Service (DDoS) attacks is yet to be offered by security systems. Incidents of serious damage due to DDoS attacks have been increasing, thereby leading to an urgent need for new attack identification, mitigation, and prevention mechanisms. To prevent DDoS attacks, the basic features of the attacks need to be dynamically analyzed because their patterns, ports, and protocols or operation mechanisms are rapidly changed and manipulated. Most of the proposed DDoS defense methods have different types of drawbacks and limitations. Some of these methods have signature-based defense mechanisms that fail to identify new attacks and others have anomaly-based defense mechanisms that are limited to specific types of DDoS attacks and yet to be applied in open environments. Subsequently, extensive research on applying artificial intelligence and statistical techniques in the defense methods has been conducted in order to identify, mitigate, and prevent these attacks. However, the most appropriate and effective defense features, mechanisms, techniques, and methods for handling such attacks remain to be an open question. This review paper focuses on the most common defense methods against DDoS attacks that adopt artificial intelligence and statistical approaches. Additionally, the review classifies and illustrates the attack types, the testing properties, the evaluation methods and the testing datasets that are utilized in the methodology of the proposed defense methods. Finally, this review provides a guideline and possible points of encampments for developing improved solution models of defense methods against DDoS attacks. INDEX TERMS DDoS attack, DDoS defense, artificial intelligence technique, statistical technique.

show abstract

Section: Analysis and Discussionmentioning

confidence: 99%

“…An agent is a software entity or a mixture of software and hardware entities that can be executed in parallel on behalf of its users. It includes many useful features, such as learning capability, cooperation, reactivity, and effectiveness [72].…”

Section: ) Software Agentmentioning

confidence: 99%

Comprehensive Review of Artificial Intelligence and Statistical Approaches in Distributed Denial of Service Attack and Defense Methods

et al. 2019

Self Cite

View full text Add to dashboard Cite

show abstract

“…Irregular or random process of the RF has a low characteristic error, in contrast to some other classification algorithms [18]. There are many random forests to choose from and each of which produces various selected subtrees in the preparation part [19]. In IDS, RFs are classifiers used to organize and retrieve research information related to identity interference and intrusion.…”

Section: Machine Learning Algorithmsmentioning

confidence: 99%

A Machine Learning Approach for Improving the Performance of Network Intrusion Detection Systems

Azizan¹,

Mostafa²,

Foozy³

et al. 2021

AETiC

Self Cite

View full text Add to dashboard Cite

Intrusion detection systems (IDS) are used in analyzing huge data and diagnose anomaly traffic such as DDoS attack; thus, an efficient traffic classification method is necessary for the IDS. The IDS models attempt to decrease false alarm and increase true alarm rates in order to improve the performance accuracy of the system. To resolve this concern, three machine learning algorithms have been tested and evaluated in this research which are decision jungle (DJ), random forest (RF) and support vector machine (SVM). The main objective is to propose a ML-based network intrusion detection system (ML-based NIDS) model that compares the performance of the three algorithms based on their accuracy and precision of anomaly traffics. The knowledge discovery in databases (KDD) methodology and intrusion detection evaluation dataset (CIC-IDS2017) are used in the testing which both are considered as a benchmark in the evaluation of IDS. The average accuracy results of the SVM is 98.18%, RF is 96.76% and DJ is 96.50% in which the highest accuracy is achieved by the SVM. The average precision results of the SVM is 98.74, RF is 97.96 and DJ is 97.82 in which the SVM got a higher average precision compared with the other two algorithms. The average recall results of the SVM is 95.63, RF is 97.62 and DJ is 95.77 in which the RF achieves the highest average of recall than SVM and DJ. In overall, the SVM algorithm is found to be the best algorithm that can be used to detect an intrusion in the system.

show abstract

“…e FC closely resembles the DDoS attack, whereby enormous legitimate clients simultaneously access a specific processing asset (e.g., a website). For instance, important news created worldwide, the distribution of the Olympic timetable, or organizations like Apple, Sony, and Samsung initiating a novel item brings about an unexpected flood in authentic traffic [10]. ese outcomes of the ill-timed and undue conveyance of reactions by the web administration require prompt action.…”

Section: Introductionmentioning

confidence: 99%

An Adaptive Protection of Flooding Attacks Model for Complex Network Environments

Khalaf

Mostafa

Mohammed

et al. 2021

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

Currently, online organizational resources and assets are potential targets of several types of attack, the most common being flooding attacks. We consider the Distributed Denial of Service (DDoS) as the most dangerous type of flooding attack that could target those resources. The DDoS attack consumes network available resources such as bandwidth, processing power, and memory, thereby limiting or withholding accessibility to users. The Flash Crowd (FC) is quite similar to the DDoS attack whereby many legitimate users concurrently access a particular service, the number of which results in the denial of service. Researchers have proposed many different models to eliminate the risk of DDoS attacks, but only few efforts have been made to differentiate it from FC flooding as FC flooding also causes the denial of service and usually misleads the detection of the DDoS attacks. In this paper, an adaptive agent-based model, known as an Adaptive Protection of Flooding Attacks (APFA) model, is proposed to protect the Network Application Layer (NAL) against DDoS flooding attacks and FC flooding traffics. The APFA model, with the aid of an adaptive analyst agent, distinguishes between DDoS and FC abnormal traffics. It then separates DDoS botnet from Demons and Zombies to apply suitable attack handling methodology. There are three parameters on which the agent relies, normal traffic intensity, traffic attack behavior, and IP address history log, to decide on the operation of two traffic filters. We test and evaluate the APFA model via a simulation system using CIDDS as a standard dataset. The model successfully adapts to the simulated attack scenarios’ changes and determines 303,024 request conditions for the tested 135,583 IP addresses. It achieves an accuracy of 0.9964, a precision of 0.9962, and a sensitivity of 0.9996, and outperforms three tested similar models. In addition, the APFA model contributes to identifying and handling the actual trigger of DDoS attack and differentiates it from FC flooding, which is rarely implemented in one model.

show abstract

An Adaptive Model for Detection and Prevention of DDoS and Flash Crowd Flooding Attacks

Cited by 15 publications

References 23 publications

Comprehensive Review of Artificial Intelligence and Statistical Approaches in Distributed Denial of Service Attack and Defense Methods

Comprehensive Review of Artificial Intelligence and Statistical Approaches in Distributed Denial of Service Attack and Defense Methods

A Machine Learning Approach for Improving the Performance of Network Intrusion Detection Systems

An Adaptive Protection of Flooding Attacks Model for Complex Network Environments

Contact Info

Product

Resources

About