Detection of Unknown DDoS Attack Using Reconstruct Error and One-Class SVM Featuring Stochastic Gradient Descent

Shieh, Chin‐Shiuh; Nguyen, Thanh-Tuan; Chen, Chun-Yueh; Horng, Mong-Fong

doi:10.3390/math11010108

Cited by 10 publications

(5 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…After conducting a thorough examination of the results presented in Table 11, it becomes apparent that the CNN-Geo method demonstrates a well-balanced performance in detecting unknown DDoS attacks when compared to existing state-of-the-art approaches. While the 1D-DHRNet-OCSVM [27] method achieves the highest precision of 0.999, its accuracy and recall values are slightly lower than those of the CNN-Geo method. Specifically, the CNN-Geo achieves an accuracy of 0.996, a precision of 0.997, and a recall of 0.996, surpassing the overall performance of GMM [26], GMM-BiLSTM [34], DBSCAN-RF [28], and DBSCAN-SVM [28].…”

Section: Comparative Analysis Of the Proposed Methods And Existing Ap...mentioning

confidence: 86%

“…In order to further demonstrate the efficacy of the CNN-Geo method in handling not only conventional DDoS attacks but also effectively addressing out-of-sample or unknown attacks, we have conducted a comparative analysis of the performance of CNN-Geo against state-of-the-art approaches, including the Gaussian Mixture Model (GMM) [26], GMM-Bidirectional Long Short-Term Memory (GMM-BiLSTM) [34], Density-Based Spatial Clustering of Applications with Noise-Random Forest (DBSCAN-RF) [28], Density-Based Spatial Clustering of Applications with Noise-Support Vector Machine (DBSCAN-SVM) [28], and One-Dimensional Deep High-Resolution Network-One-Class Support Vector Machine (1D-DHRNet-OCSVM) [27]. These comparison models are all trained on the original CI-CIDS2017 dataset and subsequently tested on a distinct dataset that differs from the original training set.…”

Section: Comparative Analysis Of the Proposed Methods And Existing Ap...mentioning

confidence: 99%

See 1 more Smart Citation

Detection of Unknown DDoS Attack Using Convolutional Neural Networks Featuring Geometrical Metric

2023

Self Cite

View full text Add to dashboard Cite

DDoS attacks remain a persistent cybersecurity threat, blocking services to legitimate users and causing significant damage to reputation, finances, and potential customers. For the detection of DDoS attacks, machine learning techniques such as supervised learning have been extensively employed, but their effectiveness declines when the framework confronts patterns exterior to the dataset. In addition, DDoS attack schemes continue to improve, rendering conventional data model-based training ineffectual. We have developed a novelty open-set recognition framework for DDoS attack detection to overcome the challenges of traditional methods. Our framework is built on a Convolutional Neural Network (CNN) construction featuring geometrical metric (CNN-Geo), which utilizes deep learning techniques to enhance accuracy. In addition, we have integrated an incremental learning module that can efficiently incorporate novel unknown traffic identified by telecommunication experts through the monitoring process. This unique approach provides an effective solution for identifying and alleviating DDoS. The module continuously improves the model’s performance by incorporating new knowledge and adapting to new attack patterns. The proposed model can detect unknown DDoS attacks with a detection rate of over 99% on conventional attacks from CICIDS2017. The model’s accuracy is further enhanced by 99.8% toward unknown attacks with the open datasets CICDDoS2019.

show abstract

Section: Comparative Analysis Of the Proposed Methods And Existing Ap...mentioning

confidence: 86%

Section: Comparative Analysis Of the Proposed Methods And Existing Ap...mentioning

confidence: 99%

Detection of Unknown DDoS Attack Using Convolutional Neural Networks Featuring Geometrical Metric

2023

Self Cite

View full text Add to dashboard Cite

show abstract

“…The effectiveness of these algorithms is assessed on the same traditional dataset, CICIDS 2017 Wednesday. To better evaluate CNN-RPL, this research also compares experimental results with three recent methods designed to detect unknown DDoS attacks: DHR-Reconstruct error-OCSVM [25], AlexNet-FCM [36], and CNN-Geo [28]. These three models tailored for unknown DDoS attack recognition have exhibited notable performance.…”

Section: H Comparison With Others Resultsmentioning

confidence: 99%

“…These labeled instances are subsequently incorporated into the framework as additional training samples. In 2022, another novel framework was proposed [25], leveraging reconstruction error and distributing hidden layer characteristics to detect unknown DDoS attacks. The architecture employs DHRNet.…”

Section: Open-set Recognition On Unknown Ddos Detectionmentioning

confidence: 99%

Open-Set Recognition in Unknown DDoS Attacks Detection With Reciprocal Points Learning

Shieh,

Ho,

Horng

et al. 2024

IEEE Access

Self Cite

View full text Add to dashboard Cite

The internet, a cornerstone of modern life, has profound implications across personal, business, and society. However, its widespread use has posed challenges, especially concerning privacy and cybersecurity. Besides, the threats on the internet are increasing in terms of danger, intensity, and complexity. Distributed denial-of-service (DDoS) attacks have emerged as a common and dangerous cybersecurity threat capable of disabling the network systems of targeted organizations and services. Therefore, various security strategies, such as firewalls and intrusion detection systems (IDS), are employed to protect against DDoS attacks. Enhancing the defensive capabilities of IDS systems through machine learning (ML) and deep learning (DL) technologies is a significant trend nowadays. However, despite notable successes, detecting DDoS attacks using ML and DL technologies still faces challenges, especially with Unknown DDoS Attacks. In this research, the primary goal is to address the unknown DDoS detection problem through efficient and advanced techniques. Our proposed method, CNN-RPL, integrates Convolutional Neural Network (CNN) with Residual Point Learning (RPL), a novel Open-Set Recognition (OSR) technology. This model can effectively handle both known and unknown attacks. The CNN-RPL model demonstrates excellent results, achieving an accuracy exceeding 99.93% against known attacks in the CICIDS2017 dataset. Simultaneously, the model achieves a commendable average accuracy of up to 98.51% against unknown attacks in the CICD-DoS2019 dataset. In particular, the CNN-RPL model simplifies the architecture of the deep neural network by significantly reducing the number of training parameters without compromising defense capabilities. Therefore, our proposed method is genuinely efficient, particularly flexible, and lightweight compared to traditional methods. This can equip organizations and businesses with a highly applicable yet powerful security approach against the evolving complexities in the network space.

show abstract

“…To identify unknown DDoS attacks, Shieh et al [29] created a method that employed reconstruction error and distributed hidden layer features. The deep hierarchical reconstruction nets (DHRNet) structure was used in this research to recompile it with a 1D interconnected neural network using a spatial location constraint prototype loss function.…”

Section: Literature Reviewmentioning

confidence: 99%

Explainable Lightweight Block Attention Module Framework for Network-Based IoT Attack Detection

Safarov,

Basak,

Nasimov

et al. 2023

Future Internet

View full text Add to dashboard Cite

In the rapidly evolving landscape of internet usage, ensuring robust cybersecurity measures has become a paramount concern across diverse fields. Among the numerous cyber threats, denial of service (DoS) and distributed denial of service (DDoS) attacks pose significant risks, as they can render websites and servers inaccessible to their intended users. Conventional intrusion detection methods encounter substantial challenges in effectively identifying and mitigating these attacks due to their widespread nature, intricate patterns, and computational complexities. However, by harnessing the power of deep learning-based techniques, our proposed dense channel-spatial attention model exhibits exceptional accuracy in detecting and classifying DoS and DDoS attacks. The successful implementation of our proposed framework addresses the challenges posed by imbalanced data and exhibits its potential for real-world applications. By leveraging the dense channel-spatial attention mechanism, our model can precisely identify and classify DoS and DDoS attacks, bolstering the cybersecurity defenses of websites and servers. The high accuracy rates achieved across different datasets reinforce the robustness of our approach, underscoring its efficacy in enhancing intrusion detection capabilities. As a result, our framework holds promise in bolstering cybersecurity measures in real-world scenarios, contributing to the ongoing efforts to safeguard against cyber threats in an increasingly interconnected digital landscape. Comparative analysis with current intrusion detection methods reveals the superior performance of our model. We achieved accuracy rates of 99.38%, 99.26%, and 99.43% for Bot-IoT, CICIDS2017, and UNSW_NB15 datasets, respectively. These remarkable results demonstrate the capability of our approach to accurately detect and classify various types of DoS and DDoS assaults. By leveraging the inherent strengths of deep learning, such as pattern recognition and feature extraction, our model effectively overcomes the limitations of traditional methods, enhancing the accuracy and efficiency of intrusion detection systems.

show abstract

Detection of Unknown DDoS Attack Using Reconstruct Error and One-Class SVM Featuring Stochastic Gradient Descent

Cited by 10 publications

References 25 publications

Detection of Unknown DDoS Attack Using Convolutional Neural Networks Featuring Geometrical Metric

Detection of Unknown DDoS Attack Using Convolutional Neural Networks Featuring Geometrical Metric

Open-Set Recognition in Unknown DDoS Attacks Detection With Reciprocal Points Learning

Explainable Lightweight Block Attention Module Framework for Network-Based IoT Attack Detection

Contact Info

Product

Resources

About