ML-Based DDoS Detection and Identification Using Native Cloud Telemetry Macroscopic Monitoring

Corrêa, João Henrique G. M.; Ciarelli, Patrick Marques; Ribeiro, Moisés R. N.; Villaça, Rodolfo da Silva

doi:10.1007/s10922-020-09578-1

Cited by 11 publications

(11 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…There is a choice for the value of squared error loss L (i) for regression L can be formulated as in Equation ( 17) and (ii) for classification L in Equation (18). 17)…”

Section: Random Forestmentioning

confidence: 99%

See 1 more Smart Citation

DDoS attack detection in cloud using ensemble model tuned with optimal hyperparameter

Reddy,

Meera

2024

Adaptive Control & Signal

View full text Add to dashboard Cite

SummaryDDoS attacks are a type of cloud incursion that lessen service degradation. DDoS attacks target the cloud network with invalid requests, rejecting legitimate requests. Such attacks disrupt the entire cloud architecture, thus it needs efficient detection methods to spot their presence. This study proposes a novel ensemble classification model for DDoS incursion detection. Pre‐processing, feature extraction, and attack detection are the three main components of the suggested intrusion detection system. Improved data imbalance processing is processed during pre‐processing. Features including HOS‐based features enhanced entropy‐based features, correlation features, and raw features are extracted from the pre‐processed data. The generated features are trained using an ensemble model, which integrates classifiers like SVM, RF, NN, LSTM, and DRN, during the attack detection phase. A new hybrid approach known as TUDMA optimally trains the model by setting the ideal weight because DRN provides the final detected outcome. By reducing errors, this ideal training will guarantee an improvement in detection results. The suggested hybrid optimization combines the two techniques, TDO and DMO. The accuracy of the methods FS‐WOA‐DNN, RBF‐PSO, SMA, BRO, SLO, and NMRA was 86.73%, 85.69%, 84.58%, 87.43%, 88.91%, and 89.78%, respectively, while the accuracy of the TUDMA was 95.34% in the 80th learning percentage. Finally, for many measurements, the suggested efficiency is superior to the traditional methods.

show abstract

“…There is a choice for the value of squared error loss L (i) for regression L can be formulated as in Equation ( 17) and (ii) for classification L in Equation (18). 17)…”

Section: Random Forestmentioning

confidence: 99%

“…On the other side, semantic assaults also known as vulnerability assaults exhaust the cloud server's network bandwidth by weakening the use of protocols. 18 The attacker targets a particular protocol by producing a least low volume of malicious traffic. This type of attack is termed a low-rate DDoS attack like legitimate traffic.…”

Section: Introductionmentioning

confidence: 99%

DDoS attack detection in cloud using ensemble model tuned with optimal hyperparameter

Reddy,

Meera

2024

Adaptive Control & Signal

View full text Add to dashboard Cite

show abstract

“…Signature-based IDS and anomaly-based IDS have two major drawbacks. The first is when the IDS detects a weakness starting with the SYN protocol, for example SYN-Flood, because the SYN protocol is a legal and absolute protocol used to initiate communication between two computers/devices in a network [13]. Therefore, it is difficult for ordinary IDS to generate an alert against attacks initiated with SYN protocol artifacts [14].…”

Section: En-176mentioning

confidence: 99%

Rekayasa Fitur Berbasis Machine Learning untuk Mendeteksi Serangan DDoS

Faiz¹,

Somantri²,

Muhammad³

2022

JNTETI

View full text Add to dashboard Cite

Serangan jaringan terdistribusi yang disebut juga dengan distributed denial of service (DDoS) merupakan ancaman dan masalah utama keamanan internet. DDoS adalah serangan pada jaringan yang bertujuan melumpuhkan sumber daya server. Serangan ini meningkat setiap tahunnya, terlebih pada kondisi pandemi COVID-19 saat ini. Salah satu bentuk penanggulangan untuk meminimalkan dampak DDoS adalah dengan perintah deteksi sistem atau intrusion detection system (IDS). Teknik IDS saat ini masih banyak menggunakan metode tradisional, sehingga masih jauh dari sempurna dibandingkan dengan teknik dan alat yang digunakan penyerang, karena IDS dengan metode tradisional hanya menggunakan deteksi berbasis signature atau model deteksi berbasis anomali dan menyebabkan banyak kesalahan. Lalu lintas paket data jaringan memiliki sifat yang kompleks, baik dari segi ukuran maupun sumbernya. Penelitian ini memanfaatkan kemampuan jaringan saraf tiruan untuk mendeteksi serangan DDoS atau normal. Teknik klasifikasi dengan metode jaringan saraf tiruan menjadi salah satu solusi. Berdasarkan kekurangan pada IDS tradisional, penelitian ini bertujuan untuk mendeteksi serangan DDoS menggunakan teknik rekayasa fitur berbasis feeder machine learning untuk meningkatkan pengembangan IDS. Selain itu, penelitian ini juga bertujuan untuk menganalisis dan mendapatkan kombinasi fungsi pelatihan dan arsitektur lapisan tersembunyi jaringan saraf tiruan terbaik untuk menyelesaikan permasalahan deteksi dan klasifikasi paket DDoS dalam jaringan komputer dengan memanfaatkan dataset UNSW-NB15 menggunakan metode jaringan saraf tiruan, sehingga didapatkan suatu kombinasi antara fungsi pelatihan dan arsitektur jaringan tersembunyi jaringan saraf tiruan yang mampu memberikan tingkat akurasi pengenalan DDoS yang tinggi. Berdasarkan percobaan yang dilakukan dengan tiga skema dan menggunakan teknik arsitektur skema jaringan saraf tiruan dengan masukan delapan fitur, diperoleh akurasi tertinggi sebesar 98,22%. Pemilihan fitur memainkan peranan penting dalam ketepatan hasil deteksi dan kinerja pembelajaran mesin dalam masalah klasifikasi.

show abstract

“…Several studies proposed to use Support Vector Machine (SVM) classifiers, such as [6][7][8][9][10], and [11]. artificial neural networks, such as [12,13] and [14], and other ML algorithms, as in [15][16][17][18][19], and [20]. Interestingly, reinforcement learning has been also adopted to perform DDoS mitigation in paper [21].…”

Section: Related Workmentioning

confidence: 99%

Machine-Learning-Enabled DDoS Attacks Detection in P4 Programmable Networks

et al. 2021

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks represent a major concern in modern Software Defined Networking (SDN), as SDN controllers are sensitive points of failures in the whole SDN architecture. Recently, research on DDoS attacks detection in SDN has focused on investigation of how to leverage data plane programmability, enabled by P4 language, to detect attacks directly in network switches, with marginal involvement of SDN controllers. In order to effectively address cybersecurity management in SDN architectures, we investigate the potential of Artificial Intelligence and Machine Learning (ML) algorithms to perform automated DDoS Attacks Detection (DAD), specifically focusing on Transmission Control Protocol SYN flood attacks. We compare two different DAD architectures, called Standalone and Correlated DAD, where traffic features collection and attack detection are performed locally at network switches or in a single entity (e.g., in SDN controller), respectively. We combine the capability of ML and P4-enabled data planes to implement real-time DAD. Illustrative numerical results show that, for all tested ML algorithms, accuracy, precision, recall and F1-score are above 98% in most cases, and classification time is in the order of few hundreds of $$\upmu \text {s}$$ μ s in the worst case. Considering real-time DAD implementation, significant latency reduction is obtained when features are extracted at the data plane by using P4 language. Graphic Abstract

show abstract

ML-Based DDoS Detection and Identification Using Native Cloud Telemetry Macroscopic Monitoring

Cited by 11 publications

References 24 publications

DDoS attack detection in cloud using ensemble model tuned with optimal hyperparameter

DDoS attack detection in cloud using ensemble model tuned with optimal hyperparameter

Rekayasa Fitur Berbasis Machine Learning untuk Mendeteksi Serangan DDoS

Machine-Learning-Enabled DDoS Attacks Detection in P4 Programmable Networks

Contact Info

Product

Resources

About