Understanding Internet DDoS Mitigation from Academic and Industrial Perspectives

Smart Detection: An Online Approach for DoS/DDoS Attack Detection Using Machine Learning

“…e Smart Detection system has reached high accuracy and low false-positive rate. Experiments were conducted using two Virtual Linux boxes, Define all the descriptor database variables as the current variables; (5) while True do (6) Split dataset in training and test partitions; (7) Create and train the model using training data partition; (8) Select the most important variables from the trained model; (9) Calculate the cumulative importance of variables from the trained model; (10) if max (cumulative importance of variables) < Variable importance threshold then (11) Exit loop; (12) end (13) Train the model using only the most important variables; (14) Test the trained model and calculate the accuracy; (15) if Calculated accuracy < Accuracy threshold then (16) Exit loop; (17) end (18) Add current model to optimized model set; (19) Define the most important variables from the trained model as the current variables; (20) end (21) end (22) Group the models by number of variables; (23) Remove outliers from the grouped model set; (24) Select the group of models with the highest frequency and their number of variables "N"; (25) Rank the variables by the mean of the importance calculated in step 7; (26) Return the "N" most important variables; [2004][2005] have been used by the researchers to evaluate the performance of their proposed intrusion detection and prevention approaches. However, many such datasets are out of date and unreliable to use [25].…”

“…have been under study in both the scientific community and industry for several years. e related literature reveals that several studies have undertaken to propose solutions to deal with this problem in a general way [6,[11][12][13][14][15]. Another group of works dedicated themselves to presenting specific solutions for high-volume and low-volume DDoS attacks [8,13,16].…”

“…In this sense, the adoption of solutions with techniques based on artificial intelligence, mainly machine learning (ML), has been distinguished by offering high flexibility in the classification process, consequently improving the detection of malicious traffic [18,19]. e industrial sector offers DDoS protection as a service through large structures, usually operated by specialized providers [6] such as Akamai, Cloudflare, and Arbor Networks, which have large processing capacity and proprietary filtering mechanisms. But the industry also has problems, such as fragility in routing traffic, usually via Domain Name System (DNS) or Border Gateway Protocol (BGP), difficulty detecting slow attacks, and privacy issues, which drive away some customer segments as governments.…”

“…One of the most dangerous malicious tra c on the Internet is the DDoS volumetric attack, which is responsible for more than 65% of all such attacks [6]. In a volumetric DDoS attack, several attackers coordinate the sending of a high rate of useless data in an attempt to overload the victim's computing resources or the near network links.…”

“…On the one hand, the high success rates for this type of attack occur because the main Internet routers typically use the FIFO (First-In-First-Out) and DROP-TAIL queuing disciplines, which do not di erentiate between types of tra c, imposing equal loss rates for attacks and legitimate tra c. Although legitimate tra c tends to retreat to prevent further congestion, attack tra c does not have this commitment and causes the links to be exceeded. As a consequence, legitimate tra c is also obstructed [6]. On the other hand, the attackers are using more advanced techniques to potentiate attacks and ood the victim such as DDoS-for-hire, IoT-based DDoS attacks, and reflection DDoS attacks [7][8][9], profiting from the computational capability and geographical distribution promoted by the wide variety of devices and its diverse mobility patterns, typically founded in IoT and mobile IoT scenarios.…”