An aggregated statistical approach for network flood detection using Gamma-Normal mixture modeling

Hosseinzadeh, Sajjad; Amirmazlaghani, Maryam; Shajari, Mehdi

doi:10.1016/j.comcom.2020.01.028

Cited by 6 publications

(2 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It can achieve high detection rates with known attacks but has a lower performance for new or unknown threats. The latter creates a profile representing the normal network behavior, and deviation on this pattern can be an anomaly [8] [28].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Artificial Immune Systems and Fuzzy Logic to Detect Flooding Attacks in Software-Defined Networks

et al. 2020

View full text Add to dashboard Cite

Software-defined Networking (SDN) has been discovered as an architecture that uses applications to make networks flexible and centrally controlled. Although SDN provides innovative management, it still susceptible to attacks daily. Traditional detection approaches may not be sufficient to contain these threats. In this paper, we present an Artificial Immune System based IDS named AIS-IDS, which is inspired by the human body's defense cells. AIS-IDS can detect variations in network behavior and identify attacks without prior knowledge about them. Along with AIS, the fuzzy logic is applied on detection to minimize the uncertainty when there is no clear boundary between anomalous and normal traffic behavior. We have simulated portscan and flooding attacks as well as used a public dataset with several types of DDoS attacks to assess our proposal. We compared the AIS-IDS performance with Naive Bayes, k-nearest neighbors, and the Local Outlier Factor. The AIS-IDS outperformed the compared algorithms, achieving f-measure rates 99.97% and 92.28% when submitted to a simulated and a public dataset, respectively.

show abstract

Section: Related Workmentioning

confidence: 99%

“…When an unusual traffic change is detected, the IDS raises the alarm to warn about the potential threat found. Alarms assist the network administrator in intervening as soon as possible, addressing the anomalies [8].…”

Section: Introductionmentioning

confidence: 99%