Flow and unified information-based DDoS attack detection system for multi-topology IoT networks

Saiyed, Makhduma F.; Al-Anbagi, Irfan

doi:10.1016/j.iot.2023.100976

Cited by 2 publications

(1 citation statement)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Attackers attempt to blend in their attacks by spreading the attack over time, using unusual protocols, or imitating normal packet characteristics. This covert approach challenges the efficacy of packet-based features in detecting low-volume attacks [47], [48]. The attack volume from any single source becomes significantly smaller, making attack detection solely based on packetbased features challenging [49].…”

Section: Packet Versus Flow-based Features In High-and Low-volume Ddo...mentioning

confidence: 99%

Deep Ensemble Learning With Pruning for DDoS Attack Detection in IoT Networks

Saiyedand,

Al-Anbagi

2024

Trans. Mach. Learn. Comm. Netw.

Self Cite

View full text Add to dashboard Cite

The upsurge of Internet of Things (IoT) devices has increased their vulnerability to Distributed Denial of Service (DDoS) attacks. DDoS attacks have evolved into complex multi-vector threats that highvolume and low-volume attack strategies, posing challenges for detection using traditional methods. These challenges highlight the importance of reliable detection and prevention measures. This paper introduces a novel Deep Ensemble learning with Pruning (DEEPShield) system, to efficiently detect both high-and low-volume DDoS attacks in resource-constrained environments. The DEEPShield system uses ensemble learning by integrating a Convolutional Neural Network (CNN) and a Long Short-Term Memory (LSTM) network with a network traffic analysis system. This system analyzes and preprocesses network traffic while being data-agnostic, resulting in high detection accuracy. In addition, the DEEPShield system applies unit pruning to refine ensemble models, optimizing them for deployment on edge devices while maintaining a balance between accuracy and computational efficiency. To address the lack of a detailed dataset for highand low-volume DDoS attacks, this paper also introduces a dataset named HL-IoT, which includes both attack types. Furthermore, the testbed evaluation of the DEEPShield system under various load scenarios and network traffic loads showcases its effectiveness and robustness. Compared to the state-of-the-art deep ensembles and deep learning methods across various datasets, including HL-IoT, ToN-IoT, CICIDS-17, and ISCX-12, the DEEPShield system consistently achieves an accuracy over 90% for both DDoS attack types. Furthermore, the DEEPShield system achieves this performance with reduced memory and processing requirements, underscoring its adaptability for edge computing scenarios.

show abstract

Section: Packet Versus Flow-based Features In High-and Low-volume Ddo...mentioning

confidence: 99%

Deep Ensemble Learning With Pruning for DDoS Attack Detection in IoT Networks

Saiyedand,

Al-Anbagi

2024

Trans. Mach. Learn. Comm. Netw.

Self Cite

View full text Add to dashboard Cite

show abstract

A Genetic Algorithm- and t-Test-Based System for DDoS Attack Detection in IoT Networks

Saiyed,

Al-Anbagi

2024

IEEE Access

Self Cite

View full text Add to dashboard Cite

Internet and cloud-based technologies have facilitated the implementation of large-scale Internet of Things (IoT) networks. However, these networks are susceptible to emerging attacks. This paper proposes a novel lightweight system for detecting both high-and low-volume Distributed Denial of Service (DDoS) attacks in IoT networks, namely Genetic Algorithm (GA) and t-Test for DDoS Attack Detection (GADAD). The GADAD system employs edge-based technologies and has three phases. In the first phase, it creates and preprocesses an HL-IoT (High-and Low-volume attacks in IoT networks) dataset, which includes both high-and low-volume DDoS attacks. The second phase introduces a novel and lightweight method, called GAStats, for optimal feature selection using the GA and statistical parameters (Stats.). In the third phase, the system trains three tree-based Machine Learning (ML) models: Random Forest (RF), Extra-Tree (ET), and Adaptive Boosting (AdaBoost), along with other ML models, using both the selfgenerated HL-IoT dataset and the publicly available ToN-IoT dataset. The evaluation includes the assessment of key performance metrics such as accuracy, precision, recall, F1-score, Receiver Operating Characteristic Curve (ROC), computation time, and scalability analysis with overall system performance. The experimental results illustrate the efficacy of the feature selection method in optimizing the system's efficiency in detecting DDoS attacks in IoT networks, along with a reduction in computation time compared to existing state-ofthe-art techniques.

show abstract

Flow and unified information-based DDoS attack detection system for multi-topology IoT networks

Cited by 2 publications

References 31 publications

Deep Ensemble Learning With Pruning for DDoS Attack Detection in IoT Networks

Deep Ensemble Learning With Pruning for DDoS Attack Detection in IoT Networks

A Genetic Algorithm- and t-Test-Based System for DDoS Attack Detection in IoT Networks

Contact Info

Product

Resources

About