An enhanced mechanism for detection of Domain Name System‐based distributed reflection denial of service attacks depending on modified metaheuristic algorithms and adaptive thresholding techniques

Abstract

The rapid growth of the number of devices connected to the Internet and the increasing demand for electronic services have led to a huge growth in the number of cyberattacks targeting cyberspace and the development of their methodology. Therefore, there must be mechanisms, laws, and rules regulating the work of these applications and protecting them from electronic attacks. The Domain Name System (DNS) has several vulnerabilities that can be exploited by cyber attackers to launch their attacks, and the most important one of these vulnerabilities is that the response size is always greater than the size of the request. According to reports published by numerous security companies, distributed reflection denial of service (DRDoS) attacks against DNS are regarded as one of the most hazardous and rapidly spreading threats in recent years. An enhanced mechanism that is able to detect DNS-based DRDoS attacks that exploit the DNS responses to launch their attacks is proposed. The proposed mechanism was designed based on modified metaheuristic optimization algorithms and an adaptive threshold. This mechanism consists of two models and four stages. The first model is called 'Proactive Feature Selection,' and the second model is called 'Evolving Dynamic Fuzzy Clustering.' The four stages of the proposed mechanism are: the preprocessing stage, feature selection stage, detection stage, and enhancement stage. The new mechanism has been implemented on the CICDDoS2019 standard dataset and achieves a detection accuracy of 95.44% with a false-positive rate of 0.22%. The results show that the new mechanism is better than others depending on the detection accuracy and false positives. | INTRODUCTIONWith the increase in the number of Internet-connected assets, the effect of distributed denial of service (DDoS) attacks increases proportionately. Due to the nature of this extremely disruptive attack, the level to which its service quality is disrupted and degraded is uncertain [1]. As a result of the widespread use of these services, cyberattacks on the infrastructure of the systems that utilise them become an attractive target [2,3].DDoS Attack is the most frequently used type of cyberattack to disrupt these services [4]. Recent years have seen an explosion in the growth of information security infrastructure and services, such as payment gateways, search engines, banks, and social media websites. This has resulted in an exponential increase in network traffic, increasing Internet misuse. In addition to, security and privacy concerns instil fear in end users, preventing them from using online services [5]. Although proposals and implementations for information security management haveThis is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

Enhanced PSO Algorithm for Detecting DRDoS Attacks on LDAP Servers

“…A feature selection algorithm plays a crucial role in minimizing the number of attributes, reducing learning time, and improving the classification performance of algorithms by eliminating unnecessary and redundant features. Thus, feature selection becomes an essential process in identifying the most consistent, non-redundant, and relevant attributes for model creation [18]. With the increasing number and diversity of datasets, it becomes imperative to systematically reduce them.…”

Data Collected and Analysis of COVID-19 Infection Status: Case Study of Iraqi Hospital Patients in Diwaniyah and Najaf Governorates

“…has been employed in the medical field to design programs for data analysis, diagnostic tools, and remotely guided surgery devices. Machine learning algorithms have been used to analyze data related to COVID-19, predict infections, identify causes of death, and aid healthcare professionals in disease management [25], [26].…”

The Reality of Internet Infrastructure and Services Defacement: A Second Look at Characterizing Web-Based Vulnerabilities

“…Therefore, there have to be systems, laws, and guidelines governing how these applications operate and shielding them from electronic assaults. Numerous flaws in the Domain Name System (DNS) can be used by online attackers to start their attacks [37].…”