A Data Enhancement Algorithm for DDoS Attacks Using IoT

Abstract

With the rapid development of the Internet of Things (IoT), the frequency of attackers using botnets to control IoT devices in order to perform distributed denial-of-service attacks (DDoS) and other cyber attacks on the internet has significantly increased. In the actual attack process, the small percentage of attack packets in IoT leads to low accuracy of intrusion detection. Based on this problem, the paper proposes an oversampling algorithm, KG-SMOTE, based on Gaussian distribution and K-means clustering, which inserts synthetic samples through Gaussian probability distribution, extends the clustering nodes in minority class samples in the same proportion, increases the density of minority class samples, and improves the amount of minority class sample data in order to provide data support for IoT-based DDoS attack detection. Experiments show that the balanced dataset generated by this method effectively improves the intrusion detection accuracy in each category and effectively solves the data imbalance problem.

An Intrusion Detection Method Based on Hybrid Machine Learning and Neural Network in the Industrial Control Field

“…And when dealing with small sample data, the SVM classifier does not classify as well as when dealing with large data. Lv, H. proposed a new data enhancement algorithm for DDoS attacks [15]. The literature mainly addresses the problem of unbalanced datasets in the face of DDoS attack types.…”

Improvement of Distributed Denial of Service Attack Detection through Machine Learning and Data Processing

“…Lv et al [17] proposed a Decision Tree (DT)-based classifier for DDoS attack classification using the MBB-IoT dataset. Owing to the large size of the dataset, they used only 1% of the records, resulting in a total of 77 features to evaluate the classifier.…”

“…However, in some studies, the data preprocessing was not detailed, or outliers were not taken into account [16,18,19]. In other studies [1,13,17,20,22], it was not specified how many records were affected after processing the outliers.…”

“…In many studies, this selection was performed arbitrarily [20][21][22]. In other cases, the hyperparameters used were not justified, making implementation difficult, or only the author only mention the algorithm used without specifying its hyperparameters [17].…”