Hybrid DDoS Detection Framework Using Matching Pursuit Algorithm

Abstract

Although a considerable amount of research has been done on DDoS attacks, it still poses a severe threat to many businesses and internet service providers. DDoS attacks commonly generate a high amount of network traffic. However, the resource depletion DDoS attacks can deny the target service, although it generates much less traffic than legitimate traffic. We propose a novel DDoS detection framework using the Matching Pursuit algorithm to detect resource depletion type DDoS attacks. We use multiple characteristics of network traffic simultaneously in order to detect low-density DDoS attacks efficiently. The proposed method uses the dictionary produced from the parameters of the network traffic using the K-SVD algorithm. Dictionary generation using network traffic, provides legitimate and attack traffic models, and adds adaptability of the proposed method to network traffic. We also implement DDoS detection approaches that use Matching Pursuit and Wavelet techniques and compare them using two different data sets. Additionally, we offer a hybrid DDoS detection framework that combines these approaches with a decision-making mechanism using an artificial neural network. We evaluate the proposed methods with two different data sets. The proposed approaches perform over 99% true positive rate with a false positive rate lower than 0.7% with a low-density DDoS attack dataset. In the hybrid intrusion detection system with more than one attack, the detection performances of other methods have decreased, while the proposed approach achieves true positive rates higher than 99% with a false positive rate lower than 0.7%.

Blockchain-Based Security Mechanism for the Medical Data at Fog Computing Architecture of Internet of Things

“…The authors of [10] attempted to pinpoint the most endangered security concerns in cloud computing, which will aid vendors, researchers, and users in knowing the key threats, what to watch out for, and the various frameworks proposed to solve these concerns. A framework for the detection of Distributed Denial of Service (DDoS) attacks was proposed in [11][12][13], which can cause a large amount of network traffic and is a threat to Internet Service Providers. The results from the experiment prove that the suggested framework has an increased detection performance when likened to the other techniques.…”

“…The initial hash value computation (H 0 ): The initial hash value is computed from the 32-bits length, 8-words of remaining blocks, and premeditated from the first eight primes, which is the square root in modulo 1 before multiplied by 16 8 and rounded to the nearest integer value as expressed in Equation (2). Where the initial hash values (ρ = 2, 3,5,7,11,13,17,19).…”

Intrusion detection with deep learning on internet of things heterogeneous network

“…According to [2]- [4] from 2013 to 2020, there will be around 24-50 billion new IoT devices that will be connected to the internet. With so many devices connected, it raises serious security problems, and it was proven [5] that in 2016 the biggest DDoS attack had occurred through an IoT device. Therefore, one solution is to implement an intrusion detection system in the heterogeneous network.…”

Boğaziçi University distributed denial of service dataset

“…These datasets are suitable for developing and evaluating network-based attack detection methodologies. Boğaziçi University DDoS (BOUN DDoS) Dataset has been already used in some academic papers [1] , [2] , [3] , [4] , [5] , [6] , [7] , [8] , [9] Unlike other publicly available DDoS datasets [ 10 , 11 ], the BOUN dataset includes legitimate background internet traffic mixed with DDoS attack traffic. In addition, the BOUN datasets provide easier simulation and analysis because of small file sizes and fewer packets compared to other datasets [ 10 , 11 , 12 ].…”

“…These datasets are suitable for developing and evaluating network-based attack detection methodologies. Boğaziçi University DDoS (BOUN DDoS) Dataset has been already used in some academic papers [1] , [2] , [3] , [4] , [5] , [6] , [7] , [8] , [9] …”