A distributed denial of service (DDoS) attack represents a major threat to service providers. More specifically, a DDoS attack aims to disrupt and deny services to legitimate users by overwhelming the target with a massive number of malicious requests. A cyberattack of this kind is likely to result in tremendous economic losses for businesses and service providers due to increasing both operating and financial costs. In recent years, machine learning (ML) techniques have been widely used to prevent DDoS attacks. Indeed, many defense systems have been transformed into smart and intelligent systems through the use of ML techniques, which allow them to defeat DDoS attacks. This paper analyzes recent studies concerning DDoS detection methods that have adapted single and hybrid ML approaches in modern networking environments. Additionally, the paper discusses different DDoS defense systems based on ML techniques that make use of a virtualized environment, including cloud computing, software-defined network, and network functions virtualization environments. As the development of the Internet of Things (IoT) has been the subject of significant research attention in recent years, the paper also discusses ML approaches as security solutions against DDoS attacks in IoT environments. Furthermore, the paper recommends a number of directions for future research. This paper is intended to assist the research community with the design and development of effective defense systems capable of overcoming different types of DDoS attacks.

/pdf/machine-learning-approaches-for-combating-distributed-denial-4br43qv4ja.pdf

Machine Learning Approaches for Combating Distributed Denial of Service Attacks in Modern Networking Environments

Numerous attacks are performed on network infrastructures. These include attacks on network availability, confidentiality and integrity. Distributed denial-of-service (DDoS) attack is a persistent attack which affects the availability of the network. Command and Control (C & C) mechanism is used to perform such kind of attack. Various researchers have proposed different methods based on machine learning technique to detect these attacks. In this paper, DDoS attack was performed using ping of death technique and detected using machine learning technique by using WEKA tool. NSL-KDD dataset was used in this experiment. Random forest algorithm was used to perform classification of the normal and attack samples. 99.76% of the samples were correctly classified.

DDOS Detection Using Machine Learning Technique

Wireless sensor networks (WSNs) are developing at an incredible pace because of their cost-effective solutions for applications like military and medical. WSN consists of a large number of nodes that have to suffer from constraints like limited computation capacity and limited battery capacity. There are a lot of attacks in WSNs; one of them is the distributed denial of service attack. Many studies have shown that decreasing the redundancy of relevant features from a dataset can make a model more accurate and efficient. In this paper, correlation-based feature selection, principal component analysis, linear discriminant analysis, recursive feature elimination, and univariate feature selection are used for feature selection. Results are compared after selecting features using these techniques. A novel technique for feature selection is introduced, which combines five feature selection techniques as a stack. After implementing the feature selection techniques, the model is trained with five machine learning algorithms, namely SVM, perceptron, K-nearest neighbor, stochastic gradient descent, and XGBoost. Finally, the model is evaluated with the help of K-fold cross-validation. Among all of the techniques best accuracy of 99.87% is achieved with the XGBoost classifier after selecting the best eleven features from the KDD dataset.

Feature selection and comparison of classification algorithms for wireless sensor networks

The main objective of this chapter is to enhance security system in network communication by using machine learning algorithm. Cyber security network attack issues and possible machine learning solutions are also elaborated. The basic network communication component and working principle are also addressed. Cyber security and data analytics are two major pillars in modern technology. Data attackers try to attack network data in the name of man-in-the-middle attack. Machine learning algorithm is providing numerous solutions for this cyber-attack. Application of machine learning algorithm is also discussed in this chapter. The proposed method is to solve man-in-the-middle attack problem by using reinforcement machine learning algorithm. The reinforcement learning is to create virtual agent that should predict cyber-attack based on previous history. This proposed solution is to avoid future cyber middle man attack in network transmission.

Cyber Secure Man-in-the-Middle Attack Intrusion Detection Using Machine Learning Algorithms

The identification of network attacks in real-time is becoming increasingly important. Most Artificial Intelligence (AI) applications use machine learning to do the classification of attack types but the advantage of an ontological approach is that automated reasoning is the underpinning theory rather than automated learning. Automated reasoners allow automated classification and this powerful feature is the basis for the developing of an early warning system for active network attacks. In this paper, the authors describe how to employ Semantic Technologies by building an ontology to identify network attack types in order to support the automated classification of current network attacks by recognising relevant properties which are then mapped to relevant attack scenarios depicted in the ontology. The classes and relationships of the ontology are described formally and implemented in Protege, an ontology editor. The Attack Scenario class, a core class of the ontology, represents types of network attacks, for example, a Denial of Service attack. The ontology is evaluated by showing three examples of real attacks that are correctly classified by the presented ontology.

Description of a Network Attack Ontology Presented Formally

Distributed Denial-of-Service (DDoS) attacks overwhelm the critical resources of a target server in order to reject its services to the legitimate clients and attack mainly on the availability in the Confidentiality Integrity Availability (CIA) triad in Internet-based applications. In this paper, we analyze three major components of DDoS defense mechanisms such as DDoS detection, DDoS mitigation, and IP traceback. In the first step, we need to detect all DDoS attacks using any intrusion detection system to pinpoint the exact packet characteristics of the attack. We classify the attack traffic based on packet characteristics. The classification can lead to mitigate an attack. Mitigation scheme uses rate limits and filters the malicious packets. IP traceback is capable of tracing IP packets to their sources without depending upon source address field of the IP header. IP traceback mechanisms are used to identify true source address and to refuse spoofed IP addresses. Finally, in this paper we proposed a novel mechanism to defend DDoS attacks at network layer and application layer.

D. Bujji Babu

Papers

DDoS Attacks—Analysis and Prevention