A Gated Recurrent Unit Deep Learning Model to Detect and Mitigate Distributed Denial of Service and Portscan Attacks

Abstract

Nowadays, it is common for applications to require servers to run constantly and aim as close as possible to zero downtime. The slightest failure might cause significant financial losses and sometimes even lives. For this reason, security and management measures against network threats are fundamental and have been researched for years. Software-defined networks (SDN) are an advancement in network management due to their centralization of the control plane, as it facilitates equipment setup and administration over the local network. However, this centralization makes the controller a target to denial of service attacks (DoS). In this study, we aim to develop a network anomaly detection and mitigation system that uses gated recurrent unit (GRU) neural networks combined with fuzzy logic. The neural network is trained to forecast future traffic, and anomalies are detected when the forecasting fails. The system is designed to operate in software-defined networks since they provide network flow information and tools to manage forwarding tables. We also demonstrate how the neural network's hyperparameters affect the detection module. The system was tested using two datasets: one with emulated traffic generated by the data communication and networking research group called Orion, from computer science department at state university of Londrina, and CICDDoS2019, a well-known dataset by the anomaly detection community. The results show that GRU networks combined with fuzzy logic are a viable option to detect anomalies in SDN and possibly in other anomaly detection applications. We compared our model with other deep learning techniques.

Reducing the Electronic Nose Sensor Array for Asthma Detection Using Firefly Algorithm

“…GRU offers update and reset gates to control the flow of information within the unit, allowing it to keep and discard information adaptively based on sequence requirements over various periods [33]. This model has a simpler architecture and fewer parameters, making its computation faster and more efficient [34]. GRU does not annihilate essential features but maintains relevant information through its sequential gate mechanism.…”

A Survey of Intrusion Detection Systems based Machine Learning Approaches Applied to Software-Defined Networks (SDN): Research Issues and Challenges

“…An unauthorized user could carry out this process while communicating with the API. Consequently, SDN applications are seen as a direct target to disrupt the service of controllers [19].…”

“…Non-DL-based approaches are often used in behaviour-based and statistical anomalybased detection methods. They are effective in detecting known attack patterns but may struggle with detecting complex or evolving attack techniques [19].…”

“…-Adaptability to Diverse Data Structures: DL methods can process diverse data formats without explicit feature engineering [19].…”

“…The attacker employs the obtained information to breach sensitive services and threaten the victim. It is difficult to prevent this attack due to its stealthy nature [19].…”