A Distributed Network Intrusion Detection System for Distributed Denial of Service Attacks in Vehicular Ad Hoc Network

Abstract

Security assurance in Vehicular Ad hoc Network (VANET) is a crucial and challenging task due to the open-access medium. One great threat to VANETs is Distributed Denial-of-Service (DDoS) attack because the target of this attack is to prevent authorized nodes from accessing the services. To provide high availability of VANETs, a scalable, reliable and robust network intrusion detection system should be developed to efficiently mitigate DDoS. However, big data from VANETs poses serious challenges to DDoS attack detection since the detection system require scalable methods to capture, store and process the big data. To overcome these challenges, this paper proposes a distributed DDoS network intrusion detection system based on big data technology. The proposed detection system consists of two main components: real-time network traffic collection module and network traffic detection module. To build our proposed system, we use Spark to speed up data processing and use HDFS to store massive suspicious attacks. In the network collection module, micro-batch data processing model is used to improve the real-time performance of traffic feature collection. In the traffic detection module, the classification algorithm based on Random Forest (RF) is adopted. In order to evaluate the accuracy of detection, the algorithm was evaluated and compared in the datasets, containing NSL-KDD and UNSW-NB15. The experimental results show that the proposed detection algorithm reached the accuracy rate of 99.95% and 98.75%, and the false alarm rate (FAR) of 0.05% and 1.08%, respectively, in two datasets.INDEX TERMS Artificial intelligence, distributed denial-of-services, intrusion detection, intelligent transportation systems, spark, vehicular ad hoc networks.

A simulation work for generating a novel dataset to detect distributed denial of service attacks on Vehicular Ad hoc NETwork systems

“…Several studies have been proposed for detecting DDoS attacks using either existing datasets or simulations to generate their own datasets for the purpose of training and validating different ML classifiers. [35][36][37][38][39][40] The main limitation of these studies is that the datasets used do not capture the characteristics of VANETs or the environment.…”

“…26–34 (4) Category 4: studies that used ML techniques trained on datasets to evaluate detection of different attacks including DDoS, but not on a VANET environment architecture. 35–40 (5) Category 5: studies introducing frameworks for generating datasets for the VANET environment. 41,42 (6) Finally, Category 6: studies introducing the generation of datasets for detecting attacks but not considering the specifications of VANETs.…”

“…Similarly, a study presented in Reddy and Thilagam 38 conducted a simulation work using Network Simulator (NS-2) for ad hoc networks to evaluate a proposed DDoS attack’s mitigation technique that relies on the usage of NB classifier. Gao et al 39 proposed an IDS for DDoS attacks using RF classifier utilizing big data technologies such as Spark and Hadoop distributed file system for implementing the proposed approach. They used both NSL-KDD 47 and UNSW-NB15 48 datasets for evaluating the proposed method for detecting DDoS attacks.…”

“…However, the datasets used in Luong et al 37 and Reddy and Thilagam 38 were generated by considering only general ad hoc network characteristics, and are not available online. Similarly, the NSL-KDD and UNSW-NB15 datasets used in Gao et al 39 include traffic for DDoS attacks, but are not properly representative of VANET as they were designed for general network traffic and thus do not capture the characteristics of a VANET environment.…”

Multi-level cyber security system for VANET

“…In this level, the proposed protocol works to secure data, discover the attack [21][22][23][24][25][26]. Know the harmful vehicle after it has passed through the registration and authentication stages.…”