Performance evaluation of Botnet DDoS attack detection using machine learning

Tuan, Tong Anh; Long, Hoàng Việt; Sơn, Lê Hoàng; Kumar, Raghvendra; Priyadarshini, Ishaani; Son, Nguyen Thi Kim

doi:10.1007/s12065-019-00310-w

Cited by 148 publications

(59 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The visual results obtained with this algorithm were discussed and detailed information about the characteristics of each attack type was given. Unlike the studies in the literature [36][37][38], defining the type of attack and determining its characteristic features have been focused on.…”

Section: Discussionmentioning

confidence: 99%

Farklı Türde Dağıtık Hizmet Dışı Bırakma Saldırılarının Tespiti

Söğüt

Oyucu

Erdem

2021

Gazi Üniversitesi Fen Bilimleri Dergisi Part C: Tasarım Ve Teknoloji

View full text Add to dashboard Cite

Distributed Denial of Service Attacks (DDoS) threaten every device connected to the Internet. The fast progress and wide spreading DDoS attacks are among the most well-known features of them. Many studies have been conducted to reduce the impact of these fast-progressing and widespread attacks. However, due to the continuous development of attack types and the implementation of different techniques, the prevention of attacks has not been fully achieved. Therefore, within the scope of this study, a DDoS attack was examined first and applications used to detect it were investigated. A system has been proposed to detect DDoS attacks using data mining methods. For the proposed system, experiment mechanisms for Transmission Control Protocol (TCP) Flooding, Spoofing Internet Protocol (IP), SYN Flood with Spoofed IP, and User Datagram Protocol (UDP) Flooding, which are among the DDoS attack types, were established and the attacks were performed to obtain network flow data. The classification was made with appropriate data mining methods according to the specified features and ZeroR, OneR, Naive Bayes, Bayes Net, Decision Stump, and J48 algorithms were used. According to these algorithms, the best classification rate has been reached with J48 algorithm. The results have shown that the proposed system plays an important role in determining the DDoS attack type. The proposed system will ensure that appropriate detection mechanisms are applied more quickly, effectively and efficiently in real attacks.

show abstract

Section: Discussionmentioning

confidence: 99%

Farklı Türde Dağıtık Hizmet Dışı Bırakma Saldırılarının Tespiti

Söğüt

Oyucu

Erdem

2021

Gazi Üniversitesi Fen Bilimleri Dergisi Part C: Tasarım Ve Teknoloji

View full text Add to dashboard Cite

show abstract

“…Besides using random forest, Reference [126] found Support Vector Machine (SVM), Naive Bayes (NB), K-Nearest Neighbour and Linear Regression algorithms to be possible detection mechanisms. Furthermore, Reference [109] conducted an analysis of various machine learning algorithms for botnet DDoS attack detection, including SVM, ANN, NB, Decision Tree (DT) and USML. According to [109], when considering only DDoS attacks, Unsupervised Learning (USML) stands out as the better option to differentiate between botnet traffic and legitimate network traffic.…”

Section: Machine Learning and Network-based Detection Mechanismsmentioning

confidence: 99%

“…Furthermore, Reference [109] conducted an analysis of various machine learning algorithms for botnet DDoS attack detection, including SVM, ANN, NB, Decision Tree (DT) and USML. According to [109], when considering only DDoS attacks, Unsupervised Learning (USML) stands out as the better option to differentiate between botnet traffic and legitimate network traffic.…”

Section: Machine Learning and Network-based Detection Mechanismsmentioning

confidence: 99%

A Survey on Botnets: Incentives, Evolution, Detection and Current Trends

Stege

El-Habr

et al. 2021

Future Internet

View full text Add to dashboard Cite

Botnets, groups of malware-infected hosts controlled by malicious actors, have gained prominence in an era of pervasive computing and the Internet of Things. Botnets have shown a capacity to perform substantial damage through distributed denial-of-service attacks, information theft, spam and malware propagation. In this paper, a systematic literature review on botnets is presented to the reader in order to obtain an understanding of the incentives, evolution, detection, mitigation and current trends within the field of botnet research in pervasive computing. The literature review focuses particularly on the topic of botnet detection and the proposed solutions to mitigate the threat of botnets in system security. Botnet detection and mitigation mechanisms are categorised and briefly described to allow for an easy overview of the many proposed solutions. The paper also summarises the findings to identify current challenges and trends within research to help identify improvements for further botnet mitigation research.

show abstract

“…Similarly, deep learning methods lack the optimization perspective that leads to low generality of the model. Researchers are now able to develop high-detection detectors for fixed botnet data sets with binary recognition tasks [25]. However, since botnet attack detection techniques are constantly changing, a high detection rate for only fixed data sets cannot guarantee excellent accuracy when dealing with complex traffic data.…”

Section: Introductionmentioning

confidence: 99%

Botnet Attack Detection Using Local Global Best Bat Algorithm for Industrial Internet of Things

et al. 2021

View full text Add to dashboard Cite

The need for timely identification of Distributed Denial-of-Service (DDoS) attacks in the Internet of Things (IoT) has become critical in minimizing security risks as the number of IoT devices deployed rapidly grows globally and the volume of such attacks rises to unprecedented levels. Instant detection facilitates network security by speeding up warning and disconnection from the network of infected IoT devices, thereby preventing the botnet from propagating and thereby stopping additional attacks. Several methods have been developed for detecting botnet attacks, such as Swarm Intelligence (SI) and Evolutionary Computing (EC)-based algorithms. In this study, we propose a Local-Global best Bat Algorithm for Neural Networks (LGBA-NN) to select both feature subsets and hyperparameters for efficient detection of botnet attacks, inferred from 9 commercial IoT devices infected by two botnets: Gafgyt and Mirai. The proposed Bat Algorithm (BA) adopted the local-global best-based inertia weight to update the bat’s velocity in the swarm. To tackle with swarm diversity of BA, we proposed Gaussian distribution used in the population initialization. Furthermore, the local search mechanism was followed by the Gaussian density function and local-global best function to achieve better exploration during each generation. Enhanced BA was further employed for neural network hyperparameter tuning and weight optimization to classify ten different botnet attacks with an additional one benign target class. The proposed LGBA-NN algorithm was tested on an N-BaIoT data set with extensive real traffic data with benign and malicious target classes. The performance of LGBA-NN was compared with several recent advanced approaches such as weight optimization using Particle Swarm Optimization (PSO-NN) and BA-NN. The experimental results revealed the superiority of LGBA-NN with 90% accuracy over other variants, i.e., BA-NN (85.5% accuracy) and PSO-NN (85.2% accuracy) in multi-class botnet attack detection.

show abstract

Performance evaluation of Botnet DDoS attack detection using machine learning

Cited by 148 publications

References 36 publications

Farklı Türde Dağıtık Hizmet Dışı Bırakma Saldırılarının Tespiti

Farklı Türde Dağıtık Hizmet Dışı Bırakma Saldırılarının Tespiti

A Survey on Botnets: Incentives, Evolution, Detection and Current Trends

Botnet Attack Detection Using Local Global Best Bat Algorithm for Industrial Internet of Things

Contact Info

Product

Resources

About