Detection of Unknown DDoS Attacks with Deep Learning and Gaussian Mixture Model

Shieh, Chin‐Shiuh; Lin, Wan-Wei; Nguyen, Thanh-Tuan; Chen, Chi-Hong; Horng, Mong-Fong; Miu, Denis

doi:10.3390/app11115213

Cited by 58 publications

(33 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It achieved the highest efficiency in the range of 90-95%. Bi-Directional Long Short-Term Memory (BI-LSTM), a Gaussian Mixture Model (GMM), and incremental learning are used in a novel DDoS detection system [2]. Unidentified traffic collected by the GMM is subjected to traffic analyst screening and tagging before being sent back into the system as new training examples.…”

Section: Related Workmentioning

confidence: 99%

“…DDoS (Distributed Denial of Service) [1] takes things a step further on a wider scale. Distributed Denial of Service (DDoS) attacks are DoS attacks that are executed in a distributed way to increase the resource usage for one or more targets [2].…”

Section: Introductionmentioning

confidence: 99%

“…Deep learning methods like CNN and recurrent neural networks use a succession of nonlinear processing elements to learn several levels of data interpretation from a large number of labeled data. As a result, DL can be a useful technique for DDoS attack detection [2]. DDoS detection using machine learning and deep learning has been shown to be successful.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Efficient Detection of DDoS Attacks Using a Hybrid Deep Learning Model with Improved Feature Selection

et al. 2021

View full text Add to dashboard Cite

DDoS (Distributed Denial of Service) attacks have now become a serious risk to the integrity and confidentiality of computer networks and systems, which are essential assets in today’s world. Detecting DDoS attacks is a difficult task that must be accomplished before any mitigation strategies can be used. The identification of DDoS attacks has already been successfully implemented using machine learning/deep learning (ML/DL). However, due to an inherent limitation of ML/DL frameworks—so-called optimal feature selection—complete accomplishment is likewise out of reach. This is a case in which a machine learning/deep learning-based system does not produce promising results for identifying DDoS attacks. At the moment, existing research on forecasting DDoS attacks has yielded a variety of unexpected predictions utilising machine learning (ML) classifiers and conventional approaches for feature encoding. These previous efforts also made use of deep neural networks to extract features without having to maintain the track of the sequence information. The current work suggests predicting DDoS attacks using a hybrid deep learning (DL) model, namely a CNN with BiLSTM (bidirectional long/short-term memory), in order to effectively anticipate DDoS attacks using benchmark data. By ranking and choosing features that scored the highest in the provided data set, only the most pertinent features were picked. Experiment findings demonstrate that the proposed CNN-BI-LSTM attained an accuracy of up to 94.52 percent using the data set CIC-DDoS2019 during training, testing, and validation.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Efficient Detection of DDoS Attacks Using a Hybrid Deep Learning Model with Improved Feature Selection

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Applying different deep learning models to detect DDoS attacks using binary classification and to categorize DDoS attack types using multi-class classification has been an active area of research in recent years. A bi-directional long short term memory (biLSTM) and Gated Recurrent Units (GRU) were proposed by [ 18 , 19 ] to classify different types of DDoS attacks using CICDDoS2019 achieving over 90% F 1- score . Sanchez et al [ 20 ] and Samom and Taggu [ 21 ] proposed a multi-layer perceptron (MLP) model approach for DDoS attack detection and demonstrated that deep learning approaches were more effective compared to shallow machine learning approaches.…”

Section: Related Workmentioning

confidence: 99%

Artificial Intelligence-Enabled DDoS Detection for Blockchain-Based Smart Transport Systems

Liu

Sabrina

Jang-Jaccard

et al. 2021

Sensors

View full text Add to dashboard Cite

A smart public transport system is expected to be an integral part of our human lives to improve our mobility and reduce the effect of our carbon footprint. The safety and ongoing maintenance of the smart public transport system from cyberattacks are vitally important. To provide more comprehensive protection against potential cyberattacks, we propose a novel approach that combines blockchain technology and a deep learning method that can better protect the smart public transport system. By the creation of signed and verified blockchain blocks and chaining of hashed blocks, the blockchain in our proposal can withstand unauthorized integrity attack that tries to forge sensitive transport maintenance data and transactions associated with it. A hybrid deep learning-based method, which combines autoencoder (AE) and multi-layer perceptron (MLP), in our proposal can effectively detect distributed denial of service (DDoS) attempts that can halt or block the urgent and critical exchange of transport maintenance data across the stakeholders. The experimental results of the hybrid deep learning evaluated on three different datasets (i.e., CICDDoS2019, CIC-IDS2017, and BoT-IoT) show that our deep learning model is effective to detect a wide range of DDoS attacks achieving more than 95% F1-score across all three datasets in average. The comparison of our approach with other similar methods confirms that our approach covers a more comprehensive range of security properties for the smart public transport system.

show abstract

“…2 and 5.4. On the other hand, not only are the DDoS attacks increasing in frequency, but they are also going to be more complicated, sophisticated, and difficult to detect [21,27,51,58], while new types are emerging [11,42,43].…”

Section: Introductionmentioning

confidence: 99%

A hybrid machine learning approach for detecting unprecedented DDoS attacks

2022

View full text Add to dashboard Cite

Service availability plays a vital role on computer networks, against which Distributed Denial of Service (DDoS) attacks are an increasingly growing threat each year. Machine learning (ML) is a promising approach widely used for DDoS detection, which obtains satisfactory results for pre-known attacks. However, they are almost incapable of detecting unknown malicious traffic. This paper proposes a novel method combining both supervised and unsupervised algorithms. First, a clustering algorithm separates the anomalous traffic from the normal data using several flowbased features. Then, using certain statistical measures, a classification algorithm is used to label the clusters. Employing a big data processing framework, we evaluate the proposed method by training on the CICIDS2017 dataset and testing on a different set of attacks provided in the more up-to-date CICDDoS2019. The results demonstrate that the Positive Likelihood Ratio (LR+) of our method is approximately 198% higher than the ML classification algorithms.

show abstract

Detection of Unknown DDoS Attacks with Deep Learning and Gaussian Mixture Model

Cited by 58 publications

References 19 publications

Efficient Detection of DDoS Attacks Using a Hybrid Deep Learning Model with Improved Feature Selection

Efficient Detection of DDoS Attacks Using a Hybrid Deep Learning Model with Improved Feature Selection

Artificial Intelligence-Enabled DDoS Detection for Blockchain-Based Smart Transport Systems

A hybrid machine learning approach for detecting unprecedented DDoS attacks

Contact Info

Product

Resources

About