Boosting Algorithms to Identify Distributed Denial-of-Service Attacks

Abstract

In the current pandemic situation, much work became automated using Internet of Things (IoT) devices. The security of IoT devices is a major issue because they can easily be hacked by third parties. Attackers cause interruptions in vital ongoing operations through these hacked devices. Thus, the demand for an efficient attack identification system has increased in the last few years. The present research aims to identify modern distributed denial-of-service (DDoS) attacks. To provide a solution to the problem of DDoS attacks, an openly available dataset (CICDDoS 2019) has recently been introduced and implemented. The attacks currently occurring in the dataset were identified using two machine learning methods, i.e. the light gradient boosting method (LGBM) and extreme gradient boosting (XGBoost). These methods have been selected because of their superior prediction ability in high volumes of data in less time than other methods require. The accuracy achieved by LGBM and XGBoost were 94.88% and 94.89% in 30 and 229 seconds(s), respectively.

Distributed denial of service attacks classification system using features selection and ensemble techniques

“…Contrary to the bagging algorithms which are parallel trained, the boosting technique, mostly homogeneous, trains a sequence of models on a weighted training set. Boosting works by sequentially adding models to the Indonesian J Elec Eng & Comp Sci ISSN: 2502-4752  Distributed denial of service attacks classification system using features selection and … (Leila Bagdadi) 1871 ensemble, each new model corrects the errors made by the previous models [37] until the performance is satisfactory or other stopping conditions are met. In contrast, stacking is an ensemble learning framework where a distinct machine learning algorithm is trained to merge the predictions of multiple ensemble members [35].…”

Detection of DDoS Attack using Machine Learning Algorithms

“…In this methodology Random Forest and MLP as a single model RF-MLP which analyses and evaluate the network traffic and establishes a security prediction model that accurately identifies DoS attack. The authors of research paper [4], uses 10-fold cross validation and found the accuracy drastically increases from 94.88% to 99.2% in just 0.48 minutes by LGBM. A limitation was found that in their work all instances present in the dataset cannot be processed.In [5], the models logistic regression, Gradient Boosting and Naive Bayes gives best evaluation metric values, used cross-Fold validation and log loss methods to identify the better models.…”

“…These attributes can be divided into two groups: categorical and numerical. The categorical attributes primarily consist of destination address, source address, and utilized protocols and the remaining features are numerical type which are analyzed based on various visualization methods as shown in below figures [3][4][5][6][7][8][9][10][11][12]. error-checked delivery of data between applications over a network.…”