Mitigating DDoS using weight‐based geographical clustering

Abstract

Distributed denial of service (DDoS) attacks have for the last two decades been among the greatest threats facing the internet infrastructure. Mitigating DDoS attacks is a particularly challenging task as an attacker tries to conceal a huge amount of traffic inside a legitimate traffic flow. This article proposes to use data mining approaches to find unique hidden data structures which are able to characterize the normal traffic flow. This will serve as a mean for filtering illegitimate traffic under DDoS attacks. In this endeavor, we devise three algorithms built on previously uncharted areas within mitigation techniques where clustering techniques are used to create geographical clusters in regions which are likely to contain legitimate traffic. We argue through extensive experimental results that establishing clusters around this narrative is a superior solution to clustering algorithms which rely on bitwise distances between IP addresses. In addition, the DDoS filtering algorithm is deployed in a virtual Linux environment using Nfqueue and tested in a simulated real-life DDoS attack.

DoS and DDoS mitigation using Variational Autoencoders

“…The confusion matrices from figure 8, and figure 9, shows the test results of of preset 4 and preset 6 respectively, before performing manual feature selection with LIME 17 . Preset 6 showed slightly better benign accuracy than preset 4, but both models had trouble classifying the malicious traffic flows.…”

“…IP addresses, although not always reliable to pinpoint exactly where a connection is based, provide the general geographical location such as country and city, unless the address is spoofed or hidden in layers of redirection. The authors of the article discussed here propose two novel methods for DDoS mitigation, specifically for HTTP flooding, based on hidden data structures in historical traffic [17]. The first method is A priori-based frequent networks (AFN), used to discover common known prefixes during training and relating it to unknown data later on.…”

Traffic Anomaly Detection Method Based on Improved GRU and EFMS-Kmeans Clustering

“…This document has a wealth of experimental data sets and has achieved good simulation results. Kongshavn et al [11] applied clustering techniques to diagnose distributed denial of service (DDoS) attacks. Use clustering techniques to create geographic clusters in areas that may contain legitimate traffic.…”

Permissionless proof‐of‐reputation‐X: A hybrid reputation‐based consensus algorithm for permissionless blockchains

“…Algorithms, such as References 88 and 89, can be ported and utilized as part of the investigation procedure. Geo‐spatial correlation: admission requests from an attacker trying to gain access to multiple wallets can follow certain trends that may be detected using geospatial correlation. The literature has an arsenal of algorithms and mechanisms to detect such correlation including 90‐94 . This will lead to immunity against attacks resulting from identity thefts such as node impersonation 95 …”