CPSS LR-DDoS Detection and Defense in Edge Computing Utilizing DCNN Q-Learning

Abstract

Existing intrusion detection and defense models for CPSS (Cyber-Physical-Social Systems) are based on analyzing the static intrusion characteristics, which cannot effectively detect large-scale Low-Rate Denial-of-Service (LR-DDoS) attacks, especially in the edge environment. In this paper, we firstly explore and enhance Mirai botnet to a sophisticated multi-targets low-rate TCP attack network, which makes edge LR-DDoS more powerful and obfuscates their activity. And then, we develop a novel intrusion detection and defense hybrid method for above CPSS LR-DDoS scenario in edge environment, which takes advantage of locality sensitive features extraction and Deep Convolution Neural Network (DCNN) to auto learn the optimal features of the original data distribution and employs deep reinforcement learning Q-network as the powerful decision maker to defend attacks. The experimental results in detection phase prove the proposed method can distinguish abnormal network attack flows with higher detection accuracy and faster response time than kinds of Support Vector Machines (SVM), K-means and Surface Learning Neural Network etc. Even more, it has a certain detection rate for unknown new attacks, which means the method is effective and suitable for the actual network environment. The experimental results in defense phase prove it can defense LR-DDoS attacks smoothly. INDEX TERMSDeep convolution neural network, Q learning, deep reinforcement learning, edge computing, LR-DDoS, CPSS.

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

“…For example, an attacker can fool detection systems to gradually accept malicious traffic as normal [7]. We also observe that most anomaly-based approaches for LR-DDoS detection are based on thresholds [8], and one challenge associated with such an approach is the computation of an optimal value for such parameters.…”

“…Liu et al [8] explained that traffic volume analysis cannot detect current stealthy low-rate DoS attacks. They then proposed a deep convolution neural network (DCNN) to extract available features automatically, and a Q-Network method (a reinforcement learning algorithm) to detect edge low-rate DoS attacks.…”

“…It is also challenging to deploy effective LR-DDoS attack mitigation solutions, in practice [8]. For example, existing solutions may require updating of the router's firmware, which may not be practical in a number of situations.…”

Machine Learning Approaches for Combating Distributed Denial of Service Attacks in Modern Networking Environments

“…However, the proposed approach is limited to specific types of DDoS attacks, and only one dataset was used to test the model. Liu et al [57] proposed a novel mitigation approach in the edge environment to detect large-scale, low-rate DDoS attacks. A deep convolution neural network (DCNN) is used to automatically learn the optimal features of the dataset.…”

Security in edge-assisted Internet of Things: challenges and solutions

“…To protect edge-assisted IoT against the aforementioned threats, various security schemes have been proposed [9]. Most of the state-of-art schemes [10][11][12] are based on machine learning techniques to detect malicious behaviors of attackers from normal activities in an autonomous and self-evolving way. Despite the powerful characteristics of machine learning techniques in detecting security threats, their high computational cost is still a serious concern when deployed in edge-assisted IoT.…”