Detecting Distributed Denial of Service in Network Traffic with Deep Learning

Rusyaidi, Muhammad; Jaf, Sardar; Ibrahim, Zunaidi

doi:10.14569/ijacsa.2022.0130105

Cited by 7 publications

(5 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The proposed hybrid model showed enhanced accuracy of up to 99%. Another similar work that utilized the NSL-KDD dataset is [23]. The authors used the LSTM RNN algorithm for detecting DDoS attacks.…”

Section: Related Workmentioning

confidence: 99%

“…We analyzed the classification results, computational efficiency, and robustness to different forms of DDoS attacks of the RNN, LSTM, and GRU models. This study also analyzed previous research studies to see how specific model components affect overall performance [22][23][24][25]. As shown in Figure 15, the performance of the LSTM, RNN, and GRU models is analyzed in the context of detecting DDoS attacks.…”

Section: Scenario Explanationmentioning

confidence: 99%

See 1 more Smart Citation

Distributed Denial of Service Attack Detection in Network Traffic Using Deep Learning Algorithm

Ramzan,

Shoaib,

Altaf

et al. 2023

Sensors

View full text Add to dashboard Cite

Internet security is a major concern these days due to the increasing demand for information technology (IT)-based platforms and cloud computing. With its expansion, the Internet has been facing various types of attacks. Viruses, denial of service (DoS) attacks, distributed DoS (DDoS) attacks, code injection attacks, and spoofing are the most common types of attacks in the modern era. Due to the expansion of IT, the volume and severity of network attacks have been increasing lately. DoS and DDoS are the most frequently reported network traffic attacks. Traditional solutions such as intrusion detection systems and firewalls cannot detect complex DDoS and DoS attacks. With the integration of artificial intelligence-based machine learning and deep learning methods, several novel approaches have been presented for DoS and DDoS detection. In particular, deep learning models have played a crucial role in detecting DDoS attacks due to their exceptional performance. This study adopts deep learning models including recurrent neural network (RNN), long short-term memory (LSTM), and gradient recurrent unit (GRU) to detect DDoS attacks on the most recent dataset, CICDDoS2019, and a comparative analysis is conducted with the CICIDS2017 dataset. The comparative analysis contributes to the development of a competent and accurate method for detecting DDoS attacks with reduced execution time and complexity. The experimental results demonstrate that models perform equally well on the CICDDoS2019 dataset with an accuracy score of 0.99, but there is a difference in execution time, with GRU showing less execution time than those of RNN and LSTM.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Scenario Explanationmentioning

confidence: 99%

Distributed Denial of Service Attack Detection in Network Traffic Using Deep Learning Algorithm

Ramzan,

Shoaib,

Altaf

et al. 2023

Sensors

View full text Add to dashboard Cite

show abstract

“…DDoS attacks are deliberate attempts to interrupt the normal traffic of a targeted server, service, or network by flooding the target or its surrounding infrastructure with Internet traffic [ 18 ]. A DDoS attack is similar to unanticipated traffic congestion that prevents regular traffic from reaching its target.…”

Section: Background and Related Workmentioning

confidence: 99%

Deep Learning Technique-Enabled Web Application Firewall for the Detection of Web Attacks

Dawadi

Adhikari

Srivastava

2023

Sensors

View full text Add to dashboard Cite

New techniques and tactics are being used to gain unauthorized access to the web that harm, steal, and destroy information. Protecting the system from many threats such as DDoS, SQL injection, cross-site scripting, etc., is always a challenging issue. This research work makes a comparative analysis between normal HTTP traffic and attack traffic that identifies attack-indicating parameters and features. Different features of standard datasets ISCX, CISC, and CICDDoS were analyzed and attack and normal traffic were compared by taking different parameters into consideration. A layered architecture model for DDoS, XSS, and SQL injection attack detection was developed using a dataset collected from the simulation environment. In the long short-term memory (LSTM)-based layered architecture, the first layer was the DDoS detection model designed with an accuracy of 97.57% and the second was the XSS and SQL injection layer with an obtained accuracy of 89.34%. The higher rate of HTTP traffic was investigated first and filtered out, and then passed to the second layer. The web application firewall (WAF) adds an extra layer of security to the web application by providing application-level filtering that cannot be achieved by the traditional network firewall system.

show abstract

“…This method achieves an accuracy of 87% in distinguishing normal flow, fast DDoS flow, and slow DDoS flow and an increase of 9% compared with other methods. In 2022, Rusyaidi et al [ 39 ] designed a high-precision DDoS attack detection system based on DNN and LSTM. It achieved an accuracy of 97.37% on the NSL-KDD dataset and excellent performance in identifying 22 traffic types.…”

Section: Related Workmentioning

confidence: 99%

GLD-Net: Deep Learning to Detect DDoS Attack via Topological and Traffic Feature Fusion

Guo¹,

Qiu²,

Liu³

et al. 2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

Distributed denial of service (DDoS) attacks are the most common means of cyberattacks against infrastructure, and detection is the first step in combating them. The current DDoS detection mainly uses the improvement or fusion of machine learning and deep learning methods to improve classification performance. However, most classifiers are trained with statistical flow features as input, ignoring topological connection changes. This one-sidedness affects the detection accuracy and cannot provide a basis for the distribution of attack sources for defense deployment. In this study, we propose a topological and flow feature-based deep learning method (GLD-Net), which simultaneously extracts flow and topological features from time-series flow data and exploits graph attention network (GAT) to mine correlations between non-Euclidean features to fuse flow and topological features. The long short-term memory (LSTM) network connected behind GAT obtains the node neighborhood relationship, and the fully connected layer is utilized to achieve feature dimension reduction and traffic type mapping. Experiments on the NSL-KDD2009 and CIC-IDS2017 datasets show that the detection accuracy of the GLD-Net method for two classifications (normal and DDoS flow) and three classifications (normal, fast DDoS flow, and slow DDoS flow) reaches 0.993 and 0.942, respectively. Compared with the existing DDoS attack detection methods, its average improvement is 0.11 and 0.081, respectively. In addition, the correlation coefficient between the detection accuracy of attack flow and the four source distribution indicators ranges from 0.7 to 0.83, which lays a foundation for the inference of attack source distribution. Notably, we are the first to fuse topology and flow features and achieve high-performance DDoS attack intrusion detection through graph-style neural networks. This study has important implications for related research and development of network security systems in other fields.

show abstract

Detecting Distributed Denial of Service in Network Traffic with Deep Learning

Cited by 7 publications

References 17 publications

Distributed Denial of Service Attack Detection in Network Traffic Using Deep Learning Algorithm

Distributed Denial of Service Attack Detection in Network Traffic Using Deep Learning Algorithm

Deep Learning Technique-Enabled Web Application Firewall for the Detection of Web Attacks

GLD-Net: Deep Learning to Detect DDoS Attack via Topological and Traffic Feature Fusion

Contact Info

Product

Resources

About