Despite significant development in distributed denial of service (DDoS) defense systems, the downtime caused by DDoS damages reputation, crushes end-user experience, and leads to considerable revenue loss. Volumetric DDoS attacks are the most common form of DDoS attack and are carried out by an army of infected IoT devices or by reflector servers, which increase attacks at massive scales. In this work, we propose a voting-based multimode framework to combat volumetric DDoS (VMFCVD) attacks. VMFCVD is based on a triad of fast detection mode (FDM), defensive fast detection mode (DFDM), and high accuracy mode (HAM) methods. FDM is designed to classify network traffic when the server is under attack. The highly dimensionally reduced dataset helps FDM accelerate detection speed. During our experiment, the dimension reduction for FDM was more than 97% while maintaining an accuracy of 99.9% in most cases. DFDM is an extended version of FDM that enhances malicious network traffic detection accuracy by tightening the detection technique. HAM focuses on detection accuracy, showing substantial improvement over FDM and DFDM. HAM activates when the server is stable. VMFCVD is extensively experimented on the latest benchmark DDoS and botnet datasets, namely the CICIDS2017 (BoT & DDoS), CSE-CIC-IDS2018 (BoT & DDoS), CICDDoS2019 (DNS, LDAP, SSDP & SYN), DoHBrw2020, NBaIoT2018 (Mirai), UNSW2018 BoTIoT, and UNSW NB15 datasets. The VMFCVD results show that it outperforms recent studies. VMFCVD performs exceptionally well when the server is under DDoS attack. 

/pdf/vmfcvd-an-optimized-framework-to-combat-volumetric-ddos-7xcwgyuy.pdf

VMFCVD: An Optimized Framework to Combat Volumetric DDoS Attacks using Machine Learning

/pdf/vmfcvd-an-optimized-framework-to-combat-volumetric-ddos-1flkmy67.pdf

On IoT intrusion detection based on data augmentation for enhancing learning on unbalanced samples

Comparative research on network intrusion detection methods based on machine learning

A botnet, which is a collection of devices polluted by malicious software programs, is among the top security challenges in the Internet of Things (IoT) environments. Therefore, to deal with such an abnormality in these environments, different machine learning-based studies, which have resulted in outstanding findings, have been carried out and applied to predict the botnets. However, the existing techniques may still suffer from three main limitations. First, some of them are not suitable for real-time applications because they spend a lot of time to determine the normal/abnormal traffic. Second, the functionality of some of the approaches is not satisfactory because they ignore/do not utilize the efficient feature selection methods. Third, these studies have usually focused on generating a binary botnet prediction model without taking the attack types into consideration. To reduce the botnet prediction time and address the second and third restrictions, the present study suggested a two-step machine learning method designed based on our previously developed optimization algorithm (WCC) and the support vector machine classifier. The outcomes indicated that the proposed method outperforms the existing approaches since it can precisely classify the data streams into their related groups and make a trade-off between the total number of the selected features and the performance of the prediction model. The results also showed that IP addresses, source ports as well as destination hosts-related features, and the total number of the transferred data streams and their statistical measurements are possible key factors in identifying botnet traffics. 

A real-time IoT-based botnet detection method using a novel two-step feature selection technique and the support vector machine classifier

In recent decades, the internet of things (IoT) is a growing technology in smart applications, where it is highly susceptible to security breaches, due to the resource constrained nature of IoT. Among the available security breaches in IoT, Mirai, denial of service, user to root attack, remote to local attack, and probe attack renounce the networks in several ways such as saturating link bandwidth, consumption of server resources, etc. Hence, the installation of antivirus software cannot be guaranteed, because the IoT devices are equipped only with light weighted operating systems. So, intrusion detection systems are developed for the detection of IoT attacks. In this research, a new model is proposed based on random forest and synthetic minority over-sampling technique (RF-SMOTE) to detect the attacks in an IoT network. In this research, the experimental analysis is performed for IoT attack detection, where the evaluation is done on NSL-KDD dataset and network-based detection of IoT (N-BaIoT) dataset, which are the well-known datasets for IoT attack detection. In the experimental phase, the proposed RF-SMOTE model showed minimum of 0.14% and maximum of 14.25% improvement in accuracy on NSL-KDD dataset for binary class. In addition, the proposed model averagely showed minimum of 0.04% and maximum of 7.35% improvement in accuracy on NSL-KDD dataset for four classes. Additionally, the proposed RF-SMOTE model showed minimum of 0.01% and maximum of 0.04% improvement in accuracy on N-BaIoT dataset related to the existing model’s decision tree, shallow model, etc.

M. Ganesh Karthik

Papers

Hybrid random forest and synthetic minority over sampling technique for detecting internet of things attacks