Detecting Target-Area Link-Flooding DDoS Attacks Using Traffic Analysis and Supervised Learning

Abstract

A novel class of extreme link-flooding DDoS (Distributed Denial of Service) attacks is designed to cut off entire geographical areas such as cities and even countries from the Internet by simultaneously targeting a selected set of network links. The Crossfire attack is a target-area link-flooding attack, which is orchestrated in three complex phases. The attack uses a massively distributed large-scale botnet to generate low-rate benign traffic aiming to congest selected network links, so-called target links. The adoption of benign traffic, while simultaneously targeting multiple network links, makes detecting the Crossfire attack a serious challenge. In this paper, we present analytical and emulated results showing hitherto unidentified vulnerabilities in the execution of the attack, such as a correlation between coordination of the botnet traffic and the quality of the attack, and a correlation between the attack distribution and detectability of the attack. Additionally, we identified a warm-up period due to the bot synchronization. For attack detection, we report results of using two supervised machine learning approaches: Support Vector Machine (SVM) and Random Forest (RF) for classification of network traffic to normal and abnormal traffic, i.e, attack traffic. These machine learning models have been trained in various scenarios using the link volume as the main feature set.

Machine and Deep Learning for IoT Security and Privacy: Applications, Challenges, and Future Directions

“…Though DDoS attacks have different flavors, they all have a similar objective. A variety of attacks in DDoS include SYN floods [67], in which a hacker dispatches a number of SYN appeals to a remarkable target; attacks in internet control message protocol (ICMP) [68] (in which several ICMP packets are being transmitted via a spoof-IP); crossfire attacks [69] in which an attacker is attacking a complex, massive botnet; and User data logs (User Datagram Protocol). Botnet attacks [70] are a form of DDoS attack occurring in IoT networks.…”

Towards Comparative Evaluation of DDoS Defences

“…In the example map on Figure 4, the row labels (to the left of the grid) indicate the type of protocol used in the attack, whereas the column headers at the top represent the attack strategy employed by the attacker. "Direct" in the column header refers to attacks that directly target a victim, whereas "indirect" attacks target the resources upon which a victim depends, such as link-flooding attacks [26], [27]. Reflection attacks are those where the attacking agents recruit unwitting accomplices to attack the target, whereas in unreflected attacks, the attacking agents attack the target without mobilizing assistance from unwitting accomplices.…”

Security and Privacy in IoT Using Machine Learning and Blockchain

“…Although there are different types of DDoS attacks, they all have the same objective. Few variants of DDoS attacks are SYN flooding [67] (in which an attacker sends successions of SYN requests to a target), Internet Control Message Protocol (ICMP) attacks [34] (in which large number of ICMP packets are broadcasted using the victim's spoofed IP), crossfire attacks [107] (using a complex and massively large-scale botnet for attack execution) and User Datagram Protocol (UDP) flooding attacks [71] (sending a large number of UDP packets to random ports on a remote victim). Botnet attack [96] is a type of DDoS attack in an IoT network.…”