Distributed Denial of Service (DDoS) attack is a menace to network security that aims at exhausting the target networks with malicious traffic. Although many statistical methods have been designed for DDoS attack detection, designing a real-time detector with low computational overhead is still one of the main concerns. On the other hand, the evaluation of new detection algorithms and techniques heavily relies on the existence of well-designed datasets. In this paper, first, we review the existing datasets comprehensively and propose a new taxonomy for DDoS attacks. Secondly, we generate a new dataset, namely CICDDoS2019, which remedies all current shortcomings. Thirdly, using the generated dataset, we propose a new detection and family classificaiton approach based on a set of network flow features. Finally, we provide the most important feature sets to detect different types of DDoS attacks with their corresponding weights.

Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy

A comprehensive survey and taxonomy of the SVM-based intrusion detection systems

The current digital world is using the internet almost everywhere. The usage of internet has been increasing, however, threats are also increasing in numbers. One such threat is DoS attack which uses reasonable service requests to gain excessive computing and network resources and results in an inability to access them by legitimate users. The DoS attack can happen at different layers of OSI model such as network, transport and application layers. The aim of this paper is to detect DoS attack effectively using Machine learning (ML) and Neural Network (NN) algorithms. The detection is specifically focused on application layer DoS attack detection rather than at transport and network DoS attack detection. The latest DoS attack dataset CIC IDS 2017 dataset is used in the experiment. The experimentation has divided the dataset into different splits and the best split is found for each algorithm i.e. RF and MLP. Results of RF and MLP are compared and it is shown that RF provides better results than MLP.

DoS Attack Detection Using Machine Learning and Neural Network

While Software Defined Networking (SDN) provides well-known advantages in terms of network automation, flexibility and resources utilization, it has been observed that SDN controllers may represent critical points of failure for the entire network infrastructure, especially when they are targeted by malicious cyber attacks such as Distributed Denial of Service (DDoS). To address this issue, in this paper we exploit stateful data planes, as enabled by P4 programming language, where switches maintain persistent memory of handled packets to perform attack detection directly at the data plane, with only marginal involvement of the SDN controllers. As machine learning (ML) is recognized as primary anomaly detection methodology, we perform DDoS attack detection using a MLbased classification and compare different ML algorithms in terms of classification accuracy and train/test duration. Moreover, we combine ML and P4-enab1ed stateful data planes to design a real-time DDoS attack detection module, which we evaluate in terms of latency required for the detection. Three real-time scenarios are considered, where P4-enab1ed switches elaborate the received packets in different ways, namely, packet mirroring, header mirroring, and P4-metadata extraction. Numerical results show significant latency reduction when P4 is adopted.

/pdf/machine-learning-assisted-ddos-attack-detection-with-p4-2nrnr8vfns.pdf

Machine-learning-assisted DDoS attack detection with P4 language

Security is one of the main requirements of the current computer systems, and recently it gains much importance as the number and severity of malicious attacks increase dramatically. Anomaly detection is one of the main branches of the intrusion detection systems which enables to recognize the newer variants of the security attacks. This paper focuses on the anomaly detection schemes (ADS), which have applied support vector machine (SVM) for detecting intrusions and security attacks. For this purpose, it first presents the required concepts about the SVM classifier and intrusion detection systems. It then classifies the ADS approaches and discusses the various machine learning and artificial intelligence techniques that have been applied in combination with the SVM classifier to detect anomalies. Besides, it specifies the primary capabilities, possible limitations, or advantages of the ADS approaches. Furthermore, a comparison of the studied ADS schemes is provided to illuminate their various technical details.

Improving security using SVM-based anomaly detection: issues and challenges

An approach for combating network intrusion detection is the development of systems applying machine learning and data mining techniques. Many Intrusion Detection Systems (IDS) suffer from a high rate of false alarms and missed intrusions. The detection rate has to be improved while maintaining low rate of misses. The focus of this paper is to generate the Distributed Denial of Service (DDoS) detection dataset and detect them using the Enhanced Support Vector Machines. The DDoS dataset with various direct and derived attributes is generated in an experimental testbed which has 14 attributes and 10 types of latest DDoS attack classes. Using the generated DDoS dataset the Enhanced Multi Class Support Vector Machines (EMCSVM) is used for detection of the attacks into various classes. The performance of the EMCSVM is evaluated over SVM with various parameter values and kernel functions. It is inferred that EMCSVM produces better classification rate for the DDoS dataset with ten types of latest DDoS attacks when compared with the kddcup 99 dataset which has six types of DoS attacks.

D. AnandKumar

Papers

Detection of DDoS attacks using Enhanced Support Vector Machines with real time generated dataset