A deep learning approach with Bayesian optimization and ensemble classifiers for detecting denial of service attacks

Abstract

Summary Detecting malicious behavior is important for preventing security threats in a computer network. Denial of Service (DoS) is among the popular cyber attacks targeted at web sites of high‐profile organizations and can potentially have high economic and time costs. In this paper, several machine learning methods including ensemble models and autoencoder‐based deep learning classifiers are compared and tuned using Bayesian optimization. The autoencoder framework enables to extract new features by mapping the original input to a new space. The methods are trained and tested both for binary and multi‐class classification on Digiturk and Labris datasets, which were introduced recently for detecting various types of DDoS attacks. The best performing methods are found to be ensembles though deep learning classifiers achieved comparable level of accuracy.

Ensemble learning for intrusion detection systems: A systematic mapping study and cross-benchmark evaluation

“…The study concluded that random tree classifier was the winner under various performance metrics. RUSBoost [120,137,146] Not mentioned [137] LogitBoost [94,103,120] GentleBoost [53,120] LPBoost [62] RealBoost [53,56] MultiBoost [56] CatBoost [107,147] ModestBoost [53] Random subspace [46,137,146] Rotation forest [55,56,70,85,110,111] Tree Maximum probability voting [68,106,135] Product probability voting [68,135] Sum probability voting [76] Minimum probability voting [68,145] Median probability voting [106,145] Bayesian [98] Al-Jarrah et al [80] proposed a semi-supervised multi-layered clustering (SMLC) model for IDSs. The performance of SMLC was compared with that of supervised ensemble ML models and a well-known semi-supervised model (i.e., tri-training).…”

“…Du and Zhang [51] applied a two-level selective ensemble learning algorithm for handling imbalanced datasets. Gormez et al [147] compared and tuned several machine learning methods including ensemble models and autoencoder-based deep learning classifiers using Bayesian optimization. The methods were trained and tested both for binary and multi-class classification on Digiturk and Labris datasets.…”

“…It is obvious that the selected studies were published in 92 different outlets, where the vast majority of studies were published in IEEE Access (6 publications), Procedia Computer Science (5 publications), IEEE Internet of Things Journal (4 publications), [125], Contagio [112], UPC [112], ISOT [112], MCFP [112], KPI [140], Telemetry [141], WUIL [142], DARPA 1998 [143], GureKDD [144], GSB [145], Intel Lab [145], Indoor WSN [145], RPL-NDDS17 [146], NIMS [90], UNB-CICT [50], Digiturk [147], Labris [147], IoT Botnet [148], Moore [149], ISCXVPN 2016 [149], CICIDS 2018 [52], Malicious URLs [107], TRAbID [53], CIDDS-001 [104] 25…”

Detecting Distributed Denial of Service in Network Traffic with Deep Learning

“…Gormez et al [13] demonstrate that by using traditional machine learning algorithms, ensemble, and deep feature extraction methods, Bayesian optimization is faster than traditional grid search optimization. However, it requires more computing resources than the train-test step.…”

An Algorithm for Detection of Traffic Attribute Exceptions Based on Cluster Algorithm in Industrial Internet of Things

“…Reference [21] proposes a Bayesian network detection method, which manages the database, establishes a Bayesian detection model, and filters abnormal behaviors of the network through the model. Reference [22] proposed optimization of a traffic detection model based on the Bayesian algo-rithm and introduced a time series to improve the accuracy of the detection model.…”