Distributed denial‐of‐service attack detection scheme‐based joint‐entropy

Abstract

Distributed denial-of-service (DDoS) attacks present an increasing threat to the global inter-networking infrastructure. While entropy schemes are highly robust to diverse network conditions, they remain vulnerable to distribute attacks that are similar to legitimate traffic. With the knowledge that the objective of a DDoS attack is to saturate as soon as possible the resources of the target, this would engender an unexpected disproportion between the number of received packets and the number of connections. However, in the case of flash crowds, an increase in the number of packets is always accompanied by an increase in the number of connections. In this work, we used joint-entropy that quantifies the degree of disproportion to detect traffic anomalies. We investigate a class of intelligent attacks, which, unlike high-rate attacks, are difficult for entropy schemes to detect. The experimental results indicate that our joint-entropy scheme can detect this type of attacks accurately. Compared with an entropy-based scheme, the improvement is 40% for the distributed attacks.

Harnessing Artificial Intelligence Capabilities to Improve Cybersecurity

“…Flooding a type of the flow controls preempted a server running HTTP/2 services, while maintaining a low number of connections to the target server. This bypassed known detection systems, which regard network events showing high numbers of connections as attacks [105]. When the proposed HTTP/2 flood traffic was launched against an HTTP/2 service, AI techniques (Naïve Bayes, Decision Trees, and Rule Learning) showed a higher percentage of false alarms than when the same AI techniques were employed to detect HTTP/1.1 DDoS attacks, which demonstrated that they bypassed known intrusion-detection systems.…”

Man-in-the-middle and denial of service attacks detection using machine learning algorithms

“…The RF is a supervised ensemble model comprised of many DTs created for regression and classification tasks, each of which is carried out by a single individual and yields a prediction [25], [26]. Then, in classification problems, the class with the most votes become the model's forecast like predict or detect the MTM attack or DoS, while in regression tasks, the model's prediction is computed as the average of all trees' predictions (MTM, normal in MTM dataset or DoS, normal in DoS dataset), because the label in classification is discrete while the label is continuous in regression task.…”

“…Then, in classification problems, the class with the most votes become the model's forecast like predict or detect the MTM attack or DoS, while in regression tasks, the model's prediction is computed as the average of all trees' predictions (MTM, normal in MTM dataset or DoS, normal in DoS dataset), because the label in classification is discrete while the label is continuous in regression task. The number of estimators supplied as a parameter in the RF model determines the number of trees [25], [26]. In our experiment for both datasets, we used the following parameters of RF: i) n_estimators=500; ii) max_features=log2; and iii) random_state=42.…”

Security & Privacy Challenges in IOT Based Smart Homes

“…The attacker attempts to hack multiple devices and systems, regardless of their identities, in order to profit financially from the information obtained [28]. In addition, an attacker can set up his own node or compromise one of the current ones [29]. Once a network has been breached, the eavesdropper can be hidden within network traffic, making identification extremely difficult.…”