Detection of DDoS attack via deep packet analysis in real time systems

Özer, Erman; İskefiyeli, Murat

doi:10.1109/ubmk.2017.8093526

Cited by 9 publications

(3 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Not only does it improve detection rates by monitoring scanners that indicate that an attack will happen, but it detects the protocol ports and identifies the different types of attacks. Özer and ˙Iskefiyeli [19] performed deep packet analysis in real-time systems to detect a DDoS attack. Firstly, their algorithm reads the packets and establishes a threshold value for the number of packets received from the same address.…”

Section: Related Work and Existing Toolsmentioning

confidence: 99%

DDoS Cyber-Incident Detection in Smart Grids

2022

View full text Add to dashboard Cite

The smart grid (SG) offers potential benefits for utilities, electric generators, and customers alike. However, the prevalence of cyber-attacks targeting the SG emphasizes its dark side. In particular, distributed denial-of-service (DDoS) attacks can affect the communication of different devices, interrupting the SG’s operation. This could have profound implications for the power system, including area blackouts. The problem is that few operational technology tools provide reflective DDoS protection. Furthermore, such tools often fail to classify the types of attacks that have occurred. Defensive capabilities are necessary to identify the footprints of attacks in a timely manner, as they occur, and to make these systems sustainable for delivery of the services as expected. To meet this need for defensive capabilities, we developed a situational awareness tool to detect system compromise by monitoring the indicators of compromise (IOCs) of amplification DDoS attacks. We achieved this aim by finding IOCs and exploring attack footprints to understand the nature of such attacks and their cyber behavior. Finally, an evaluation of our approach against a real dataset of DDoS attack instances indicated that our tool can distinguish and detect different types of amplification DDoS attacks.

show abstract

Section: Related Work and Existing Toolsmentioning

confidence: 99%

DDoS Cyber-Incident Detection in Smart Grids

2022

View full text Add to dashboard Cite

show abstract

“…However, RADAR can only detect 50% of attack data within 60 seconds of operation, and struggles to create an IoT defense system with accurate real-time classifications. Many other DPI systems [13]- [15] suffer from the same slow-down and lack of efficiency. To deal with the performance costs, periphery hardware for DPI acceleration or reduced efficiency is required.…”

Section: Related Workmentioning

confidence: 99%

Securing Smart Homes via Software-Defined Networking and Low-Cost Traffic Classification

Gordon

Batula

Tushir

et al. 2021

Preprint

View full text Add to dashboard Cite

IoT devices have become popular targets for various network attacks due to their lack of industry-wide security standards. In this work, we focus on smart home IoT device identification and defending them against Distributed Denial of Service (DDoS) attacks. The proposed framework protects smart homes by using VLAN-based network isolation. This architecture has two VLANs: one with non-verified devices and the other with verified devices, both of which are managed by the SDN controller. Lightweight stateless flow-based features, including ICMP, TCP, and UDP protocol percentage, packet count and size, and IP diversity ratio, are proposed for efficient feature collections. Further analysis is performed to minimize training data to run on resource-constrained edge devices in smart home networks. Three popular machine learning algorithms, including K-Nearest-Neighbors, Random Forest, and Support Vector Machines, are used to classify IoT devices and detect different types of DDoS attacks, including TCP-SYN, UDP, and ICMP. The system's effectiveness and efficiency are evaluated by emulating a network consisting of an Open vSwitch, Faucet SDN controller, and several IoT device traces from two different testbeds.

show abstract

“…The challenges being faced are in the areas of standardization, lack of agility, economic considerations, competing set of standards, lack of awareness. Various solutions based on packet-level analyses, flowlevel analyses, behavioral analyses, traffic mining and deep packet inspection of network traffic, have been proposed by researchers for combating DDoS attacks [6]- [11]. Recent advances in machine learning and deep learning techniques have also been employed for detection of DDoS attacks [12]- [14].…”

Section: Introductionmentioning

confidence: 99%

Hyperband Tuned Deep Neural Network With Well Posed Stacked Sparse AutoEncoder for Detection of DDoS Attacks in Cloud

2020

View full text Add to dashboard Cite

Cloud computing has very attractive features like elastic, on demand and fully managed computer system resources and services. However, due to its distributed and dynamic nature as well as vulnerabilities in virtualization implementation, the cloud environment is prone to various cyber-attacks and security issues related to cloud model. Some of them are inability to access data coming to and from cloud service, theft and misuse of data hosted, no control over sensitive data access, advance threats like malware injection attack, wrapping attacks, virtual machine escape, distributed denial of service attack (DDoS) etc. DDoS is one of the notorious attack. Despite a number of available potential solutions for the detection of DDoS attacks, the increasing frequency and potency of recent attacks and the constantly evolving attack vectors, necessitate the development of improved detection approaches. This paper proposes a novel architecture that combines a well posed stacked sparse AutoEncoder (AE) for feature learning with a Deep Neural Network (DNN) for classification of network traffic into benign traffic and DDoS attack traffic. AE and DNN are optimized for detection of DDoS attacks by tuning the parameters using appropriately designed techniques. The improvements suggested in this paper lead to low reconstruction error, prevent exploding and vanishing gradients, and lead to smaller network which avoids overfitting. A comparative analysis of the proposed approach with ten state-of-the-art approaches using performance metrics-detection accuracy, precision, recall and F1-Score, has been conducted. Experiments have been performed on CICIDS2017 and NSL-KDD standard datasets for validation. Proposed approach outperforms existing approaches over the NSL-KDD dataset and yields competitive results over the CICIDS2017 dataset.

show abstract

Detection of DDoS attack via deep packet analysis in real time systems

Cited by 9 publications

References 10 publications

DDoS Cyber-Incident Detection in Smart Grids

DDoS Cyber-Incident Detection in Smart Grids

Securing Smart Homes via Software-Defined Networking and Low-Cost Traffic Classification

Hyperband Tuned Deep Neural Network With Well Posed Stacked Sparse AutoEncoder for Detection of DDoS Attacks in Cloud

Contact Info

Product

Resources

About