Automated Fast-flux Detection using Machine Learning and Genetic Algorithms

Rana, Sachin; Aksoy, Ahmet

doi:10.1109/infocomwkshps51825.2021.9484614

Cited by 2 publications

(4 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This outcome is attributed to the possibility that there is insufficient attack or software fingerprinting information within this header to provide a significant advantage over the other algorithms. In the case of MLP, we observe similar accuracy with and without GA, which can be linked to GA's capability to reduce noise and enhance the model's accuracy, as discussed in prior studies [29,73,74].…”

Section: Os Scanning Identificationsupporting

confidence: 80%

“…We used several machine learning algorithms and compared their results. In our previous work [29][30][31]71], we observed that rule-based algorithms generate a high classification accuracy. Therefore, we used four rule-based algorithms: Decision Trees (DT), Random Forest (RF), Gaussian Naive Bayes (GNB), and Multi-layer Perceptron (MLP), and compared our results.…”

Section: Machine Learning Classificationmentioning

confidence: 91%

“…Additionally, the GA requires specifying the number of generations (or iterations) to determine when to terminate. Our previous work [29] observed that using n_generations = 10 yields high classification accuracy. It is important to note that n_generations represents the number of GA iterations, not to be confused with n used earlier to represent the length of the solution vector.…”

Section: Fitness Function Implementationmentioning

confidence: 99%

“…We analyze packet headers and extract unique features associated with each TCP/IP stack and application layer, resulting in nearly 100% accuracy. As mentioned in our prior work [29][30][31], employing a GA for selectively identifying the most distinctive features in datasets offers numerous benefits.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Automated Network Incident Identification through Genetic Algorithm-Driven Feature Selection

Aksoy,

Valle,

Kar

2024

Electronics

Self Cite

View full text Add to dashboard Cite

The cybersecurity landscape presents daunting challenges, particularly in the face of Denial of Service (DoS) attacks such as DoS Http Unbearable Load King (HULK) attacks and DoS GoldenEye attacks. These malicious tactics are designed to disrupt critical services by overwhelming web servers with malicious requests. In contrast to DoS attacks, there exists nefarious Operating System (OS) scanning, which exploits vulnerabilities in target systems. To provide further context, it is essential to clarify that NMAP, a widely utilized tool for identifying host OSes and vulnerabilities, is not inherently malicious but a dual-use tool with legitimate applications, such as asset inventory services in company networks. Additionally, Domain Name System (DNS) botnets can be incredibly damaging as they harness numerous compromised devices to inundate a target with malicious DNS traffic. This can disrupt online services, leading to downtime, financial losses, and reputational damage. Furthermore, DNS botnets can be used for other malicious activities like data exfiltration, spreading malware, or launching other cyberattacks, making them a versatile tool for cybercriminals. As attackers continually adapt and modify specific attributes to evade detection, our paper introduces an automated detection method that requires no expert input. This innovative approach identifies the distinct characteristics of DNS botnet attacks, DoS HULK attacks, DoS GoldenEye attacks, and OS-Scanning, explicitly using the NMAP tool, even when attackers alter their tactics. By harnessing a representative dataset, our proposed method ensures robust detection of such attacks against varying attack parameters or behavioral shifts. This heightened resilience significantly raises the bar for attackers attempting to conceal their malicious activities. Significantly, our approach delivered outstanding outcomes, with a mid 95% accuracy in categorizing NMAP OS scanning and DNS botnet attacks, and 100% for DoS HULK attacks and DoS GoldenEye attacks, proficiently discerning between malevolent and harmless network packets. Our code and the dataset are made publicly available.

show abstract

Section: Os Scanning Identificationsupporting

confidence: 80%