HTTP flood attack detection in application layer using machine learning metrics and bio inspired bat algorithm

A distributed denial of service (DDoS) attack represents a major threat to service providers. More specifically, a DDoS attack aims to disrupt and deny services to legitimate users by overwhelming the target with a massive number of malicious requests. A cyberattack of this kind is likely to result in tremendous economic losses for businesses and service providers due to increasing both operating and financial costs. In recent years, machine learning (ML) techniques have been widely used to prevent DDoS attacks. Indeed, many defense systems have been transformed into smart and intelligent systems through the use of ML techniques, which allow them to defeat DDoS attacks. This paper analyzes recent studies concerning DDoS detection methods that have adapted single and hybrid ML approaches in modern networking environments. Additionally, the paper discusses different DDoS defense systems based on ML techniques that make use of a virtualized environment, including cloud computing, software-defined network, and network functions virtualization environments. As the development of the Internet of Things (IoT) has been the subject of significant research attention in recent years, the paper also discusses ML approaches as security solutions against DDoS attacks in IoT environments. Furthermore, the paper recommends a number of directions for future research. This paper is intended to assist the research community with the design and development of effective defense systems capable of overcoming different types of DDoS attacks.

/pdf/machine-learning-approaches-for-combating-distributed-denial-4br43qv4ja.pdf

Machine Learning Approaches for Combating Distributed Denial of Service Attacks in Modern Networking Environments

With the development of the Internet, network security has aroused people’s attention. It can be said that a secure network environment is a basis for the rapid and sound development of the Internet. Phishing is an essential class of cybercriminals which is a malicious act of tricking users into clicking on phishing links, stealing user information, and ultimately using user data to fake logging in with related accounts to steal funds. Network security is an iterative issue of attack and defense. The methods of phishing and the technology of phishing detection are constantly being updated. Traditional methods for identifying phishing links rely on blacklists and whitelists, but this cannot identify new phishing links. Therefore, we need to solve how to predict whether a newly emerging link is a phishing website and improve the accuracy of the prediction. With the maturity of machine learning technology, prediction has become a vital ability. This paper offers a state-of-the-art survey on methods for phishing website detection. It starts with the life cycle of phishing, introduces common anti-phishing methods, mainly focuses on the method of identifying phishing links, and has an in-depth understanding of machine learning-based solutions, including data collection, feature extraction, modeling, and evaluation performance. This paper provides a detailed comparison of various solutions for phishing website detection.

A Survey of Machine Learning-Based Solutions for Phishing Website Detection

The primary benefit of the cloud is that it elastically scales to meet variable demand and it provides the environment which scales up and scales down instantly according to the demand, so it needs great protection from DDoS attacks to tackle downtime effects of DDoS Attacks. Distribute Denial of Service attacks fall on the category of critical attacks that compromise the availability of the network. These attacks have become sophisticated and continue to grow at a rapid pace so to detect and counter these attacks have become a challenging task. This work was carried out on the owncloud environment using Tor Hammer as an attacking tool and a new dataset was generated with Intrusion Detection System. This work incorporates various machine learning algorithms: Support Vector Machine, Naive Bayes, and Random Forest for classification and overall accuracy was 99.7%, 97.6% and 98.0% of Support Vector Machine, Random Forest and Naive Bayes respectively

Analysis and Detection of DDoS Attacks on Cloud Computing Environment using Machine Learning Techniques

The applications that use blockchain are cryptocurrencies, decentralized finance applications, video games, and many others. Most of these applications trust that the blockchain will prevent issues like fraud, thanks to the built-in cryptographic mechanisms provided by the data structure and the consensus protocol. However, blockchains suffer from what is called a 51% attack or majority attack, which is considered a high risk for the integrity of these blockchains, where if a miner, or a group of them, has more than half the computing capability of the network, it can rewrite the blockchain. Even though this attack is possible in theory, it is regarded as hard-achievable in practice, due to the assumption that, with enough active members, it is very complicated to have that much computing power; however, this assumption has not been studied with enough detail. In this work, a detailed characterization of the miners in the Bitcoin and Crypto Ethereum blockchains is presented, with the aim of proving the computing distribution assumption and creating profiles that may allow the detection of anomalous behaviors and prevent 51% attacks. The results of the analysis show that, in the last years, there has been an increasing concentration of hash rate power in a very small set of miners, which generates a real risk for current blockchains. Also, that there is a pattern in mining among the main miners, which makes it possible to identify out-of-normal behavior.

/pdf/the-51-attack-on-blockchains-a-mining-behavior-study-14y7lt1tix.pdf

The 51% Attack on Blockchains: A Mining Behavior Study

Blockchain technology has attracted various areas like corporations, education, government, and healthcare because of its unhackable security features. In spite of common arguments about the occurrence of Blockchain technology in terms of security and privacy, in reality, several attacks can be launched against them. This paper presents a comprehensive survey of the most vulnerable Blockchain attacks and the different approaches proposed against these attacks. This paper also provides taxonomy of attacks, which are most challengeable to Blockchain security key features. Additionally, a review of the countermeasures, which have offered solutions to avoid these attacks, has been presented.

Blockchain Security Attack: A Brief Survey

Internet dragged more than half of the world's population into the cyber world. Unfortunately, with the increase in internet transactions, cybercrimes also increase rapidly. With the anonymous structure of the internet, attackers attempt to deceive the end-users through different forms namely phishing, malware, SQL injection, man-in-the-middle, domain name system tunnelling, ransomware, web trojan, and so on. Amongst them, phishing is the most deceiving attack, which exploits the vulnerabilities in the end-users. Phishing is often done through emails and malicious websites to lure the user by posing themselves as a trusted entity. Security experts have been proposing many anti-phishing techniques. Till today there is no single solution that is capable of mitigating all the vulnerabilities. A systematic review of current trends in web phishing detection techniques is carried out and a taxonomy of automated web phishing detection is presented. The objective of this study is to acknowledge the status of current research in automated web phishing detection and evaluate their performance. This study also discusses the research avenues for future investigation.

https://ietresearch.onlinelibrary.wiley.com/doi/epdf/10.1049/iet-net.2020.0078

Web phishing detection techniques: a survey on the state-of-the-art, taxonomy and future directions

Distributed Denial of Service attacks pose an ever great challenge to the Internet with an increasing resources and techniques available to the attackers. From SYN flooding to spoofing it has finally arrived at application layer attacks with legitimate IP addresses. Our traceback system detects the network layer attacks carried out with spoofed IP addresses, application layer attacks carried with legitimate IP addresses and traceback the real source of the attack. In contrast to the earlier works, the proposed system detects the attack, traceback the attack source and also enhances the availability of the server by proactive traffic shaping and reactive filtering mechanism. The work is deployed in the NTRO sponsored Smart and Secure Environment Test Bed and programmable routers in real time and the efficacy of the system is evaluated. Our system not only detects and traceback the attacker but also reduces the magnitude of the attack traffic and improves the probability of survival of legitimate flow.

IP traceback system for network and application layer attacks

Now a day's computer networks are very popular, so network attacks are inevitable. As a consequence, any complete security package includes a network Intrusion Detection System (nIDS). This work focuses on nIDSs which work by scanning the network traffic. We have combined classifiers based on packet header information with classifiers based on payload distribution to increase detection rates in non-flood attacks. We have divided packet processing into two parts as header information processing and payload processing. In header information processing we select features from packet header and create model for normal behavior with histograms, then find out the deviation from created models and classify the network traffic. In payload processing we create models of normal payload by generating histograms of payload ASCII distribution and find deviation from created models and classify traffic. Our work differs from previous anomaly based detection techniques by creating histograms for both network header features and for payload of packet, so that our detection system identifies both flooding attacks and non flooding attacks efficiently.

Anomaly detection system based on analysis of packet header and payload histograms

Blockchain is becoming more popular because of its decentralized, secured, and transparent nature. Supply chain and its management is indispensable to improve customer services, reduce operating costs and improve financial position of a firm. Integration of blockchain and supply chain is substantial, but it alone is not enough for the sustainability of supply chain systems. The proposed mechanism speaks about the method of rewarding the supply chain parties with incentives so as to improve the security and make the integration of supply chain with blockchain sustainable. The proposed incentive mechanism employs the co-operative approach of game theory where all the supply chain parties show a cooperative behavior of following the blockchain-based supply chain protocols and also this mechanism makes a fair attempt in rewarding the supply chain parties with incentives.

M. Vijayalakshmi

Papers

Blockchain Security Attack: A Brief Survey

Web phishing detection techniques: a survey on the state-of-the-art, taxonomy and future directions

IP traceback system for network and application layer attacks

Anomaly detection system based on analysis of packet header and payload histograms

Design and Analysis of Incentive Mechanism for Ethereum-based Supply Chain Management Systems