Suspicious traffic detection based on edge gateway sampling method

Nguyen, Sinh-Ngoc; Choi, Jintae; Kim, Kyungbaek

doi:10.1109/apnoms.2017.8094143

Cited by 5 publications

(3 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Python scripts are used for regular communication requests based on the statistical laws of different scenarios in the 5G environment to simulate sending massive connection regular request traffic. Based on the above implementation methods, this study collects traffic and automatically extracts flow feature information under minimal-degree DDoS assault and normal communication behaviour [23]. In our investigation, the capture period starts at 08:00 on May 19, 2021 and ends at 17:00 on May 24, 2021.…”

Section: Minimal-degree Ddos Assault Detection Frameworkmentioning

confidence: 99%

Light Weighted CNN Model to Detect DDoS Attack over Distributed Scenario

Kumar

Aoudni

Ortiz

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

The minimal-degree distributed denial-of-service attack takes advantage of flaws in the adaptive mechanisms of network protocols, which could have a big impact on network service quality. It is very hard to find, has a low attack rate, and comes at a set time. Detection methods that have been used before have problems because they only use one type of detection and are not very good at identifying the object. In the end, a way to detect many sorts of minimal DDoS assaults that use deep hybrid learning is suggested. To construct multi-type limited DDoS threat data sets and mimic diverse sorts DDoS assaults and legitimate traffic in varying situations in the 5G setting, collect congestion at the networking entry and extract flow feature info are considered. From a statistical threshold and feature engineering point of view, these data sets show how many sorts of minimal DDoS assaults are there. This study aims to develop a deep hybrid learning-based multi-type low-rate DDoS attack detection solution for 5G networks which is the novel model that is recently deployed, and a hybrid deep learning algorithm was used to train the algorithm offline, and the algorithm’s performance was compared to that of the LSTM-Light GBM and LSTM-RF algorithms. The CNN-RF revealing model was then used to detect minimal DDoS assaults at the gateway, so that multiple attacks could be detected at the same time. It can identify 4 sorts of low-rate DDoS assaults like Slow-Headers, Slow-Body, Slow-Read, and Shrew assaults, in a 120-second window. The false intercept rate is 11.03 percent. This means that 96.22 percent of traffic could be found. Using the strategy suggested can help cut down on the traffic concentration of minimal DDoS attacks at the net ingress. It can also be used in real-world situations.

show abstract

Section: Minimal-degree Ddos Assault Detection Frameworkmentioning

confidence: 99%

Light Weighted CNN Model to Detect DDoS Attack over Distributed Scenario

Kumar

Aoudni

Ortiz

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…The NFV module is responsible for virtualizing and managing virtual machines on DDoS mitigation requirement. Nguyen et al [15] proposed an IDS with sampling method for DDoS detection in SDN. It detects the attacks even with small volume by choosing the appropriate sample rate.…”

Section: Related Workmentioning

confidence: 99%

Adaptive Entropy-Based Detection and Mitigation of Ddos Attacks in Software Defined Networks

Dalou¹,

Al-Duwairi²,

Al‐Jarrah³

2020

IJC

View full text Add to dashboard Cite

Software Defined Networking (SDN) has emerged as a new networking paradigm that is based on the decoupling between data plane and control plane providing several benefits that include flexible, manageable, and centrally controlled networks. From a security point of view, SDNs suffer from several vulnerabilities that are associated with the nature of communication between control plane and data plane. In this context, software defined networks are vulnerable to distributed denial of service attacks. In particular, the centralization of the SDN controller makes it an attractive target for these attacks because overloading the controller with huge packet volume would result in bringing the whole network down or degrade its performance. Moreover, DDoS attacks may have the objective of flooding a network segment with huge traffic volume targeting single or multiple end systems. In this paper, we propose an entropy-based mechanism for Distributed Denial of Service (DDoS) attack detection and mitigation in SDN networks. The proposed mechanism is based on the entropy values of source and destination IP addresses of flows observed by the SDN controller which are compared to a preset entropy threshold values that change in adaptive manner based on network dynamics. The proposed mechanism has been evaluated through extensive simulation experiments.

show abstract

“…Then, we describe how to obtain the seasonality of traffic and how to adjust the threshold with the seasonality of traffic. In order to detect DoS attack near sources, the gateway of a local network can be a good location for deploying the functionality of DoS attack detection, especially with IoT devices [15]. Fig.…”

Section: Traffic Seasonality Aware Adaptive Threshold For Source-sidementioning

confidence: 99%

Traffic Seasonality aware Threshold Adjustment for Effective Source-side DoS Attack Detection

2019

KSII TIIS

View full text Add to dashboard Cite

In order to detect Denial of Service (DoS) attacks, victim-side detection methods are used popularly such as static threshold-based method and machine learning-based method. However, as DoS attacking methods become more sophisticated, these methods reveal some natural disadvantages such as the late detection and the difficulty of tracing back attackers. Recently, in order to mitigate these drawbacks, source-side DoS detection methods have been researched. But, the source-side DoS detection methods have limitations if the volume of attack traffic is relatively very small and it is blended into legitimate traffic. Especially, with the subtle attack traffic, DoS detection methods may suffer from high false positive, considering legitimate traffic as attack traffic. In this paper, we propose an effective source-side DoS detection method with traffic seasonality aware adaptive threshold. The threshold of detecting DoS attack is adjusted adaptively to the fluctuated legitimate traffic in order to detect subtle attack traffic. Moreover, by understanding the seasonality of legitimate traffic, the threshold can be updated more carefully even though subtle attack happens and it helps to achieve low false positive. The extensive evaluation with the real traffic logs presents that the proposed method achieves very high detection rate over 90% with low false positive rate down to 5%.

show abstract

Suspicious traffic detection based on edge gateway sampling method

Cited by 5 publications

References 8 publications

Light Weighted CNN Model to Detect DDoS Attack over Distributed Scenario

Light Weighted CNN Model to Detect DDoS Attack over Distributed Scenario

Adaptive Entropy-Based Detection and Mitigation of Ddos Attacks in Software Defined Networks

Traffic Seasonality aware Threshold Adjustment for Effective Source-side DoS Attack Detection

Contact Info

Product

Resources

About