Explainable AI-Based DDoS Attacks Classification Using Deep Transfer Learning

In the era of the Internet of Things(IoT),the proliferation of connected devices has raised security concerns,increasing the risk of intrusions into diverse systems.Despite the convenience and efficiency offered by IoT technology,the growing number of IoT devices escalates the likelihood of attacks,emphasizing the need for robust security tools to automatically detect and explain threats.This paper introduces a deep learning methodology for detecting and classifying distributed denial of service(DDoS)attacks,addressing a significant security concern within IoT environments.An effective procedure of deep transfer learning is applied to utilize deep learning backbones,which is then evaluated on two benchmarking datasets of DDoS attacks in terms of accuracy and time complexity.By leveraging several deep architectures,the study conducts thorough binary and multiclass experiments,each varying in the complexity of classifying attack types and demonstrating real-world scenarios.Additionally,this study employs an explainable artificial intelligence(XAI)AI technique to elucidate the contribution of extracted features in the process of attack detection.The experimental results demonstrate the effectiveness of the proposed method,achieving a recall of 99.39%by the XAI bidirectional long short-term memory(XAI-BiLSTM)model.

Unknown DDoS Attack Detection with Fuzzy C-Means Clustering and Spatial Location Constraint Prototype Loss

Since its inception,the Internet has been rapidly evolving.With the advancement of science and technology and the explosive growth of the population,the demand for the Internet has been on the rise.Many applications in education,healthcare,entertainment,science,and more are being increasingly deployed based on the internet.Concurrently,malicious threats on the internet are on the rise as well.Distributed Denial of Service(DDoS)attacks are among the most common and dangerous threats on the internet today.The scale and complexity of DDoS attacks are constantly growing.Intrusion Detection Systems(IDS)have been deployed and have demonstrated their effectiveness in defense against those threats.In addition,the research of Machine Learning(ML)and Deep Learning(DL)in IDS has gained effective results and significant attention.However,one of the challenges when applying ML and DL techniques in intrusion detection is the identification of unknown attacks.These attacks,which are not encountered during the system’s training,can lead to misclassification with significant errors.In this research,we focused on addressing the issue of Unknown Attack Detection,combining two methods:Spatial Location Constraint Prototype Loss(SLCPL)and Fuzzy C-Means(FCM).With the proposed method,we achieved promising results compared to traditional methods.The proposed method demonstrates a very high accuracy of up to 99.8%with a low false positive rate for known attacks on the Intrusion Detection Evaluation Dataset(CICIDS2017)dataset.Particularly,the accuracy is also very high,reaching 99.7%,and the precision goes up to 99.9%for unknown DDoS attacks on the DDoS Evaluation Dataset(CICDDoS2019)dataset.The success of the proposed method is due to the combination of SLCPL,an advanced Open-Set Recognition(OSR)technique,and FCM,a traditional yet highly applicable clustering technique.This has yielded a novel method in the field of unknown attack detection.This further expands the trend of applying DL and ML techniques in the development of intrusion detection systems and cybersecurity.Finally,implementing the proposed method in real-world systems can enhance the security capabilities against increasingly complex threats on computer networks.

Optimization of Stealthwatch Network Security System for the Detection and Mitigation of Distributed Denial of Service (DDoS) Attack: Application to Smart Grid System

The Smart Grid is an enhancement of the traditional grid system and employs new technologies and sophisticated communication techniques for electrical power transmission and distribution. The Smart Grid’s communication network shares information about status of its several integrated IEDs (Intelligent Electronic Devices). However, the IEDs connected throughout the Smart Grid, open opportunities for attackers to interfere with the communications and utilities resources or take clients’ private data. This development has introduced new cyber-security challenges for the Smart Grid and is a very concerning issue because of emerging cyber-threats and security incidents that have occurred recently all over the world. The purpose of this research is to detect and mitigate Distributed Denial of Service [DDoS] with application to the Electrical Smart Grid System by deploying an optimized Stealthwatch Secure Network analytics tool. In this paper, the DDoS attack in the Smart Grid communication networks was modeled using Stealthwatch tool. The simulated network consisted of Secure Network Analytic tools virtual machines (VMs), electrical Grid network communication topology, attackers and Target VMs. Finally, the experiments and simulations were performed, and the research results showed that Stealthwatch analytic tool is very effective in detecting and mitigating DDoS attacks in the Smart Grid System without causing any blackout or shutdown of any internal systems as compared to other tools such as GNS3, NeSSi2, NISST Framework, OMNeT++, INET Framework, ReaSE, NS2, NS3, M5 Simulator, OPNET, PLC & TIA Portal management Software which do not have the capability to do so. Also, using Stealthwatch tool to create a security baseline for Smart Grid environment, contributes to risk mitigation and sound security hygiene.

Detection of Real-Time Distributed Denial-of-Service (DDoS) Attacks on Internet of Things (IoT) Networks Using Machine Learning Algorithms

The primary concern of modern technology is cyber attacks targeting the Internet of Things.As it is one of the most widely used networks today and vulnerable to attacks.Real-time threats pose with modern cyber attacks that pose a great danger to the Internet of Things(IoT)networks,as devices can be monitored or service isolated from them and affect users in one way or another.Securing Internet of Things networks is an important matter,as it requires the use of modern technologies and methods,and real and up-to-date data to design and train systems to keep pace with the modernity that attackers use to confront these attacks.One of the most common types of attacks against IoT devices is Distributed Denial-of-Service(DDoS)attacks.Our paper makes a unique contribution that differs from existing studies,in that we use recent data that contains real traffic and real attacks on IoT networks.And a hybrid method for selecting relevant features,And also how to choose highly efficient algorithms.What gives the model a high ability to detect distributed denial-of-service attacks.the model proposed is based on a two-stage process:selecting essential features and constructing a detection model using the K-neighbors algorithm with two classifier algorithms logistic regression and Stochastic Gradient Descent classifier(SGD),combining these classifiers through ensemble machine learning(stacking),and optimizing parameters through Grid Search-CV to enhance system accuracy.Experiments were conducted to evaluate the effectiveness of the proposed model using the CIC-IoT2023 and CIC-DDoS2019 datasets.Performance evaluation demonstrated the potential of our model in robust intrusion detection in IoT networks,achieving an accuracy of 99.965%and a detection time of 0.20 s for the CIC-IoT2023 dataset,and 99.968%accuracy with a detection time of 0.23 s for the CIC-DDoS 2019 dataset.Furthermore,a comparative analysis with recent related works highlighted the superiority of our methodology in intrusion detection,showing improvements in accuracy,recall,and detection time.

Cybernet Model:A New Deep Learning Model for Cyber DDoS Attacks Detection and Recognition

Cyberspace is extremely dynamic,with new attacks arising daily.Protecting cybersecurity controls is vital for network security.Deep Learning(DL)models find widespread use across various fields,with cybersecurity being one of the most crucial due to their rapid cyberattack detection capabilities on networks and hosts.The capabilities of DL in feature learning and analyzing extensive data volumes lead to the recognition of network traffic patterns.This study presents novel lightweight DL models,known as Cybernet models,for the detection and recognition of various cyber Distributed Denial of Service(DDoS)attacks.These models were constructed to have a reasonable number of learnable parameters,i.e.,less than 225,000,hence the name“lightweight.”This not only helps reduce the number of computations required but also results in faster training and inference times.Additionally,these models were designed to extract features in parallel from 1D Convolutional Neural Networks(CNN)and Long Short-Term Memory(LSTM),which makes them unique compared to earlier existing architectures and results in better performance measures.To validate their robustness and effectiveness,they were tested on the CIC-DDoS2019 dataset,which is an imbalanced and large dataset that contains different types of DDoS attacks.Experimental results revealed that bothmodels yielded promising results,with 99.99% for the detectionmodel and 99.76% for the recognition model in terms of accuracy,precision,recall,and F1 score.Furthermore,they outperformed the existing state-of-the-art models proposed for the same task.Thus,the proposed models can be used in cyber security research domains to successfully identify different types of attacks with a high detection and recognition rate.

SDN中DDoS攻击检测与混合防御技术

DDoS攻击是软件定义网络(SDN)安全领域的一大威胁,严重威胁网络控制器及交换机等设备的正常运行,因此提出一种SDN中DDoS攻击检测与混合防御技术。在DDoS攻击检测方面,利用卡方检验值对SDN中控制器收到的Packet_In数据流内数据帧数量进行统计分析,将高于数据流卡方阈值的数据流初步判断为可疑流;继续计算数据流与可疑流的相对Sibson距离,区分可疑流是DDoS攻击流还是正常突发流;最后通过计算数据流之间的Sibson距离,根据DDoS攻击流的特征,确定攻击流是否为DDoS攻击流。在DDoS攻击防御方面,采用共享流表空间支持和Packet_In报文过滤方法混合防御,被DDoS攻击的交换机流表空间过载,将过载流表引流到其他交换机,从而完成数据层的防御;溯源得到DDoS攻击MAC地址并进行Packet_In数据流过滤,完成控制层的防御。实验结果表明,所提方法可有效检测软件定义网络交换机和控制器内的DDoS攻击流,能够防御不同的DDoS攻击。

Machine Learning Enabled Novel Real-Time IoT Targeted DoS/DDoS Cyber Attack Detection System

The increasing prevalence of Internet of Things(IoT)devices has introduced a new phase of connectivity in recent years and,concurrently,has opened the floodgates for growing cyber threats.Among the myriad of potential attacks,Denial of Service(DoS)attacks and Distributed Denial of Service(DDoS)attacks remain a dominant concern due to their capability to render services inoperable by overwhelming systems with an influx of traffic.As IoT devices often lack the inherent security measures found in more mature computing platforms,the need for robust DoS/DDoS detection systems tailored to IoT is paramount for the sustainable development of every domain that IoT serves.In this study,we investigate the effectiveness of three machine learning(ML)algorithms:extreme gradient boosting(XGB),multilayer perceptron(MLP)and random forest(RF),for the detection of IoTtargeted DoS/DDoS attacks and three feature engineering methods that have not been used in the existing stateof-the-art,and then employed the best performing algorithm to design a prototype of a novel real-time system towards detection of such DoS/DDoS attacks.The CICIoT2023 dataset was derived from the latest real-world IoT traffic,incorporates both benign and malicious network traffic patterns and after data preprocessing and feature engineering,the data was fed into our models for both training and validation,where findings suggest that while all threemodels exhibit commendable accuracy in detectingDoS/DDoS attacks,the use of particle swarmoptimization(PSO)for feature selection has made great improvements in the performance(accuracy,precsion recall and F1-score of 99.93%for XGB)of the ML models and their execution time(491.023 sceonds for XGB)compared to recursive feature elimination(RFE)and randomforest feature importance(RFI)methods.The proposed real-time system for DoS/DDoS attack detection entails the implementation of an platform capable of effectively processing and analyzing network traffic in real-time.This involvesemploying the best-performing ML algorithmfor detection and the integration of warning mechanisms.We believe this approach will significantly enhance the field of security research and continue to refine it based on future insights and developments.

基于联邦增量学习的SDN环境下DDoS攻击检测模型

SDN是一种被广泛应用的网络范式.面对DDoS攻击等网络安全威胁,在SDN中集成高效的DDoS攻击检测方法尤为重要.由于SDN集中控制的特性,集中式DDoS攻击检测方法在SDN环境中存在较高的安全风险,使得SDN的控制平面安全性受到了巨大挑战.此外,SDN环境中流量数据不断增加,导致复杂流量特征的更复杂化、不同实体之间严重的Non-IID分布等问题.这些问题对现有的基于联邦学习的检测模型准确性与鲁棒性的进一步提高造成严重阻碍.针对上述问题,本文提出了一种基于联邦增量学习的SDN环境下DDoS攻击检测模型.首先,为解决集中式DDoS攻击检测的安全风险与数据增量带来的Non-IID分布问题,本文提出了一种基于联邦增量学习的加权聚合算法,使用动态调整聚合权重的方式个性化适应不同子数据集增量情况,提高增量聚合效率.其次,针对SDN环境中复杂的流量特征,本文设计了一种基于LSTM的DDoS攻击检测方法,通过统计SDN环境中流量数据的时序特征,提取并学习数据的时序关特征的相关性,实现对流量特征数据的实时检测.最后,本文结合SDN集中管控特点,实现了SDN环境下的DDoS实时防御决策,根据DDoS攻击检测结果与网络实体信息,实现流规则实时下发,达到有效阻断DDoS攻击流量、保护拓扑重要实体并维护拓扑流量稳定的效果.本文将提出的模型在增量式DDoS攻击检测任务上与FedAvg、FA-FedAvg和FIL-IIoT三种方法进行性能对比实验.实验结果表明,本文提出方法相比于其他方法,在DDoS攻击检测准确率上提升5.06%~12.62%,F1-Score提升0.0565~0.1410.

入侵意图分析下的软件定义网络DDoS攻击检测方法

为在数据样本回溯期内解决因本地信息熵值增大而造成的服务攻击问题,维护软件定义网络的运行安全性,提出入侵意图分析下的软件定义网络分布式拒绝服务(DDoS)攻击检测方法。按照软件定义网络场景重构原则,确定因果网转换标准,实现对识别参数的更新处理,完成攻击性行为的入侵意图分析,再定义DDoS数据集,根据攻击行为的时空特性,求解模型参数的取值范围,完成入侵意图分析下软件定义网络DDoS攻击检测方法的设计。实验结果表明,在该算法控制下数据样本回溯期为10 min,低于传统算法,能够较好维护软件定义网络的运行安全性。

基于时空图神经网络的应用层DDoS攻击检测方法

分布式拒绝服务(Distributed Denial of Service,DDoS)攻击已经成为网络安全的主要威胁之一,其中应用层DDoS攻击是主要的攻击手段。应用层DDoS攻击是针对具体应用服务的攻击,其在网络层行为表现正常,传统安全设备无法有效抵御。同时,现有的针对应用层DDoS攻击的检测方法检测能力不足,难以适应攻击模式的变化。为此,文章提出一种基于时空图神经网络(Spatio-Temporal Graph Neural Network,STGNN)的应用层DDoS攻击检测方法,利用应用层服务的特征,从应用层数据和应用层协议交互信息出发,引入注意力机制并结合多个GraphSAGE层,学习不同时间窗口下的实体交互模式,进而计算检测流量与正常流量的偏差,完成攻击检测。该方法仅利用时间、源IP、目的IP、通信频率、平均数据包大小5维数据便可有效识别应用层DDoS攻击。由实验结果可知,该方法在攻击样本数量较少的情况下,与对比方法相比可获得较高的Recall和F1分数。

基于流量特征重构与映射的物联网DDoS攻击单流检测方法

针对现有检测方法对物联网(IoT)分布式拒绝服务(DDoS)攻击响应速度慢、特征差异性低、检测性能差等不足,提出了一种基于流量特征重构与映射的单流检测方法(SFDTFRM)。首先,为扩充特征,使用队列按照先入先出存储定长时间跨度内接收的流量,得到队列特征矩阵。其次,针对物联网设备正常通信流量与DDoS攻击流量存在相似性的问题,提出一种与基线模型相比更加轻量化的多维重构神经网络模型与一种函数映射方法,改进模型损失函数按照相应索引重构队列定量特征矩阵,并通过函数映射方法转化为映射特征矩阵,增强包括物联网设备正常通信流量与DDoS攻击流量在内的不同类型流量之间的差异和同类型流量的相似性。最后,使用文本卷积网络、信息熵计算分别提取映射特征矩阵和队列定性特征矩阵的频率信息,得到拼接向量,丰富单条流量的特征信息并使用机器学习分类器进行DDoS攻击流量检测。在两个基准数据集上的实验结果表明,SFDTFRM能够有效检测不同类型的DDoS攻击,检测性能指标平均值与现有方法相比最多提升12.01%。

基于人工智能的物联网DDoS攻击检测

针对物联网DDoS攻击检测最优解问题,文章采用多种算法对物联网DDoS攻击进行检测和建模分类,运用核密度估计筛选出有影响的流量特征字段,建立基于机器学习和深度学习算法的DDoS攻击检测模型,分析了通过可逆残差神经网络和大语言模型处理数据集并进行攻击检测的可行性。实验结果表明,ResNet50算法在综合指标上表现最好;在区分DDoS攻击流量和其他流量问题上,梯度提升类算法表现更优秀;在细分DDoS攻击类型方面,经过优化的ResNet50-GRU算法表现更好。

基于多模态神经网络流量特征的网络应用层DDoS攻击检测方法

农业设备、传感器和监控系统与网络的连接日益紧密,给农村配电网带来了新的网络安全挑战。其中,分布式拒绝服务(DDoS)攻击是一种常见的网络威胁,对农村配电网的安全性构成了严重威胁。针对农村配电网的特殊需求,提出一种基于多模态神经网络流量特征的网络应用层DDoS攻击检测方法。通过制定网络应用层流量数据包捕获流程并构建多模态神经网络模型,成功提取并分析了网络应用层DDoS攻击流量的特征。在加载DDoS攻击背景下的异常流量特征后,计算相关系数并设计相应的DDoS攻击检测规则,以实现对DDoS攻击的有效检测。经试验分析,所提出的方法在提取DDoS攻击相关特征上表现出色,最大提取完整度可达95%,效果明显优于对比试验中基于EEMD-LSTM的检测方法和基于条件熵与决策树的检测方法。

基于CNN-BiLSTM的ICMPv6 DDoS攻击检测方法

针对ICMPv6网络中DDoS攻击检测问题,提出一种基于CNN-BiLSTM网络的检测算法。通过将带有注意力机制、DropConnect和Dropout混合使用加入到CNN-BiLSTM算法中,防止在训练过程中产生的过拟合问题,同时更准确地提取数据的特性数据。通过实验表明:提出的算法在多次实验中的检测准确率、误报率与漏报率平均值分别为92.84%、4.49%和10.54%,检测算法泛化性较强,性能由于其他算法,能够有效处理ICMPv6 DDoS攻击检测问题。

An Abnormal Network Flow Feature Sequence Prediction Approach for DDoS Attacks Detection in Big Data Environment

Distributed denial-of-service(DDoS)is a rapidly growing problem with the fast development of the Internet.There are multitude DDoS detection approaches,however,three major problems about DDoS attack detection appear in the big data environment.Firstly,to shorten the respond time of the DDoS attack detector;secondly,to reduce the required compute resources;lastly,to achieve a high detection rate with low false alarm rate.In the paper,we propose an abnormal network flow feature sequence prediction approach which could fit to be used as a DDoS attack detector in the big data environment and solve aforementioned problems.We define a network flow abnormal index as PDRA with the percentage of old IP addresses,the increment of the new IP addresses,the ratio of new IP addresses to the old IP addresses and average accessing rate of each new IP address.We design an IP address database using sequential storage model which has a constant time complexity.The autoregressive integrated moving average(ARIMA)trending prediction module will be started if and only if the number of continuous PDRA sequence value,which all exceed an PDRA abnormal threshold(PAT),reaches a certain preset threshold.And then calculate the probability that is the percentage of forecasting PDRA sequence value which exceed the PAT.Finally we identify the DDoS attack based on the abnormal probability of the forecasting PDRA sequence.Both theorem and experiment show that the method we proposed can effectively reduce the compute resources consumption,identify DDoS attack at its initial stage with higher detection rate and lower false alarm rate.

DDoS Attack Detection Scheme Based on Entropy and PSO-BP Neural Network in SDN

SDN (Software Defined Network) has many security problems, and DDoS attack is undoubtedly the most serious harm to SDN architecture network. How to accurately and effectively detect DDoS attacks has always been a difficult point and focus of SDN security research. Based on the characteristics of SDN, a DDoS attack detection method combining generalized entropy and PSOBP neural network is proposed. The traffic is pre-detected by the generalized entropy method deployed on the switch, and the detection result is divided into normal and abnormal. Locate the switch that issued the abnormal alarm. The controller uses the PSO-BP neural network to detect whether a DDoS attack occurs by further extracting the flow features of the abnormal switch. Experiments show that compared with other methods, the detection accurate rate is guaranteed while the CPU load of the controller is reduced, and the detection capability is better.

Anti-D Chain:A Lightweight DDoS Attack Detection Scheme Based on Heterogeneous Ensemble Learning in Blockchain

With rapid development of blockchain technology,blockchain and its security theory research and practical application have become crucial.At present,a new DDoS attack has arisen,and it is the DDoS attack in blockchain network.The attack is harmful for blockchain technology and many application scenarios.However,the traditional and existing DDoS attack detection and defense means mainly come from the centralized tactics and solution.Aiming at the above problem,the paper proposes the virtual reality parallel anti-DDoS chain design philosophy and distributed anti-D Chain detection framework based on hybrid ensemble learning.Here,Ada Boost and Random Forest are used as our ensemble learning strategy,and some different lightweight classifiers are integrated into the same ensemble learning algorithm,such as CART and ID3.Our detection framework in blockchain scene has much stronger generalization performance,universality and complementarity to identify accurately the onslaught features for DDoS attack in P2P network.Extensive experimental results confirm that our distributed heterogeneous anti-D chain detection method has better performance in six important indicators(such as Precision,Recall,F-Score,True Positive Rate,False Positive Rate,and ROC curve).

Automated Controller Placement for Software-Defined Networks to Resist DDoS Attacks

In software-defined networks(SDNs),controller placement is a critical factor in the design and planning for the future Internet of Things(IoT),telecommunication,and satellite communication systems.Existing research has concentrated largely on factors such as reliability,latency,controller capacity,propagation delay,and energy consumption.However,SDNs are vulnerable to distributed denial of service(DDoS)attacks that interfere with legitimate use of the network.The ever-increasing frequency of DDoS attacks has made it necessary to consider them in network design,especially in critical applications such as military,health care,and financial services networks requiring high availability.We propose a mathematical model for planning the deployment of SDN smart backup controllers(SBCs)to preserve service in the presence of DDoS attacks.Given a number of input parameters,our model has two distinct capabilities.First,it determines the optimal number of primary controllers to place at specific locations or nodes under normal operating conditions.Second,it recommends an optimal number of smart backup controllers for use with different levels of DDoS attacks.The goal of the model is to improve resistance to DDoS attacks while optimizing the overall cost based on the parameters.Our simulated results demonstrate that the model is useful in planning for SDN reliability in the presence of DDoS attacks while managing the overall cost.

Unprecedented Smart Algorithm for Uninterrupted SDN Services During DDoS Attack

In the design and planning of next-generation Internet of Things(IoT),telecommunication,and satellite communication systems,controller placement is crucial in software-defined networking(SDN).The programmability of the SDN controller is sophisticated for the centralized control system of the entire network.Nevertheless,it creates a significant loophole for the manifestation of a distributed denial of service(DDoS)attack straightforwardly.Furthermore,recently a Distributed Reflected Denial of Service(DRDoS)attack,an unusual DDoS attack,has been detected.However,minimal deliberation has given to this forthcoming single point of SDN infrastructure failure problem.Moreover,recently the high frequencies of DDoS attacks have increased dramatically.In this paper,a smart algorithm for planning SDN smart backup controllers under DDoS attack scenarios has proposed.Our proposed smart algorithm can recommend single or multiple smart backup controllers in the event of DDoS occurrence.The obtained simulated results demonstrate that the validation of the proposed algorithm and the performance analysis achieved 99.99%accuracy in placing the smart backup controller under DDoS attacks within 0.125 to 46508.7 s in SDN.

IPv6中一种基于卷积的DDoS攻击两阶段防御机制

针对IPv6快速普及背景下分布式拒绝服务(DDoS)攻击威胁不断增长的现状,提出一种两阶段的DDoS攻击防御机制,包括初期实时监控DDoS攻击发生的预检测阶段,以及告警后精准过滤DDoS攻击流量的深度检测阶段.首先,分析IPv6报文格式并解析PCAP流量捕获文件中的16进制头部字段作为样本元素.其次,在预检测阶段,引入轻量化二值卷积神经网络(BCNN),设计一种二维流量矩阵作为模型输入,整体感知网络在混杂DDoS流量后出现的恶意态势作为告警DDoS发生的证据.告警后,深度检测阶段介入,引入一维卷积神经网络(1DCNN)具体区分混杂的DDoS报文,从而下发阻断策略.在实验中,自建IPv6-LAN拓扑并基于NAT 4to6技术重放CIC-DDoS2019公开集生成纯IPv6-DDoS流量源测试.结果证明,所提机制提升针对DDoS攻击的响应速度、准确度和攻击流量过滤效率,当DDoS流量出现仅占总网络6%和10%时,BCNN就能以90.9%和96.4%的准确度感知到DDoS攻击的发生,同时1DCNN能够以99.4%准确率区分DDoS报文并过滤.