A Survey on Machine Learning Based Detection on DDoS Attacks for IoT Systems

Wehbi, Khadijeh; Hong, Liang; Al-Salah, Tulha Hasan; Bhutta, Adeel A.

doi:10.1109/southeastcon42311.2019.9020468

Cited by 26 publications

(6 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The experiments are based on applying multi-classification or multi-label using different machine learning algorithms. The accuracy rates (AC) of RFT, K-NN, J48, AdaBoost, and Bagging are 97.99%, 97.99%, 85.51%, 97.99%, and 91.416%, respectively [ 30 , 31 , 32 , 33 , 34 , 35 ]. According to the results, RFT, K-NN, and AdaBoost models show better results in terms of accuracy than others.…”

Section: Evaluation and Experimental Resultsmentioning

confidence: 99%

Dynamic Adaptation Attack Detection Model for a Distributed Multi-Access Edge Computing Smart City

Alotaibi

Ahmed

Kamel

2023

Sensors

View full text Add to dashboard Cite

The internet of things (IoT) technology presents an intelligent way to improve our lives and contributes to many fields such as industry, communications, agriculture, etc. Unfortunately, IoT networks are exposed to many attacks that may destroy the entire network and consume network resources. This paper aims to propose intelligent process automation and an auto-configured intelligent automation detection model (IADM) to detect and prevent malicious network traffic and behaviors/events at distributed multi-access edge computing in an IoT-based smart city. The proposed model consists of two phases. The first phase relies on the intelligent process automation (IPA) technique and contains five modules named, specifically, dataset collection and pre-processing module, intelligent automation detection module, analysis module, detection rules and action module, and database module. In the first phase, each module composes an intelligent connecting module to give feedback reports about each module and send information to the next modules. Therefore, any change in each process can be easily detected and labeled as an intrusion. The intelligent connection module (ICM) may reduce the search time, increase the speed, and increase the security level. The second phase is the dynamic adaptation of the attack detection model based on reinforcement one-shot learning. The first phase is based on a multi-classification technique using Random Forest Trees (RFT), k-Nearest Neighbor (K-NN), J48, AdaBoost, and Bagging. The second phase can learn the new changed behaviors based on reinforced learning to detect zero-day attacks and malicious events in IoT-based smart cities. The experiments are implemented using a UNSW-NB 15 dataset. The proposed model achieves high accuracy rates using RFT, K-NN, and AdaBoost of approximately 98.8%. It is noted that the accuracy rate of the J48 classifier achieves 85.51%, which is lower than the others. Subsequently, the accuracy rates of AdaBoost and Bagging based on J48 are 98.9% and 91.41%, respectively. Additionally, the error rates of RFT, K-NN, and AdaBoost are very low. Similarly, the proposed model achieves high precision, recall, and F1-measure high rates using RFT, K-NN, AdaBoost, and Bagging. The second phase depends on creating an auto-adaptive model through the dynamic adaptation of the attack detection model based on reinforcement one-shot learning using a small number of instances to conserve the memory of any smart device in an IoT network. The proposed auto-adaptive model may reduce false rates of reporting by the intrusion detection system (IDS). It can detect any change in the behaviors of smart devices quickly and easily. The IADM can improve the performance rates for IDS by maintaining the memory consumption, time consumption, and speed of the detection process.

show abstract

Section: Evaluation and Experimental Resultsmentioning

confidence: 99%

Dynamic Adaptation Attack Detection Model for a Distributed Multi-Access Edge Computing Smart City

Alotaibi

Ahmed

Kamel

2023

Sensors

View full text Add to dashboard Cite

show abstract

“…Malicious and benign IoT network traffic 15M biflows 20 [105], [118], [175], [178], [185], [186], [188] [80] KDDCup99 Classification 4000000 42 [110], [141], [152], [166], [169], [171] [82] ISCXIDS2012 7 days of network activity which includes normal and malicious traffic for intrusion detection 571,698 - [109], [110], [113], [117], [157] [83] CICDDoS 2019…”

Section: Machine Learning and Deep Learningmentioning

confidence: 99%

“…Based on new input data, these models serve as a source for future predictions [35]. Not only ML but also DL and AI, in general, are getting expanded rapidly in cybersecurity fields, especially in the early detection and prediction in different domains such as malware detection in references [33] to [180], DOD/ DDOS detection in [109] to [122], intrusion detection as in references [158] to [165], spam detection as in [167], and BOTNET detection in references [179] to [192]. More details are in Table 5 which overviews different kinds of detection systems in the IoT environment.…”

Section: And DL In Iot Securitymentioning

confidence: 99%

“…IoT Networks in general Network traffic [105], [107], [109], [110], [111], [115], [116], [118], [119], [120], [126], [127], [129], [132], [136], [137], [139], [140], [142], [145], [146], [147], [149], [151], [153], [154], [158], [159], [162], [165], [166], [175], [178], [182], [183], [185], [186], [187], [190], [192], [194], [195], [196], [199], [200], [201], [202], [204],…”

mentioning

confidence: 99%

See 1 more Smart Citation

A Survey of Using Machine Learning in IoT Security and the Challenges Faced by Researchers

Harahsheh,

Chen

2023

IJCAI

View full text Add to dashboard Cite

The Internet of Things (IoT) has become more popular in the last 15 years as it has significantly improved and gained control in multiple fields. We are nowadays surrounded by billions of IoT devices that directly integrate with our lives, some of them are at the center of our homes, and others control sensitive data such as military fields, healthcare, and datacenters, among others. This popularity makes factories and companies compete to produce and develop many types of those devices without caring about how secure they are. On the other hand, IoT is considered a good insecure environment for cyber thefts. Machine Learning (ML) and Deep Learning (DL) also gained more importance in the last 15 years; they achieved success in the networking security field too. IoT has some similar security requirements such as traditional networks, but with some differences according to its characteristics, some specific security features, and environmental limitations, some differences are made such as low energy resources, limited computational capability, and small memory. These limitations inspire some researchers to search for the perfect and lightweight security ways which strike a balance between performance and security. This survey provides a comprehensive discussion about using machine learning and deep learning in IoT devices within the last five years. It also lists the challenges faced by each model and algorithm. In addition, this survey shows some of the current solutions and other future directions and suggestions. It also focuses on the research that took the IoT environment limitations into consideration.Povzetek: Podan je pregled uporabe strojnega in globokega učenja v IoT napravah ter izzivov, rešitev in prihodnjih smeri raziskav.Informatica 47 (2023) 1-54 k. Harahsheh et al.

show abstract

“…In a survey conducted by Wehbi et al [17], three strategies for detecting DDoS attacks using ML were identified. Each strategy employs a distinct method of integrating machine-learning techniques, including the use of IoT network behavior (Approach 1), software-defined network (SDN) architecture (Approach 2), and Apache Spark (Approach 3).…”

Section: Related Workmentioning

confidence: 99%

An Intelligent Approach to Improving the Performance of Threat Detection in IoT

Cam

Trung

2023

IEEE Access

View full text Add to dashboard Cite

Internet of Things (IoT) systems are beneficial to our daily lives and have become increasingly important. A complete IoT system includes devices, sensors, networks, software, and other essential components necessary for operation and interconnection. However, devices and sensors of this nature often have low resource requirements and multiple security vulnerabilities from manufacturers. Moreover, edge network areas of IoT systems exhibit several security weaknesses. Consequently, unauthorized hijacking of sensors or denial-of-service attacks on edge network areas can have severe consequences for the system's operation. In this study, we propose a model that combines machine learning algorithms and principal component analysis techniques to train and predict Distributed Denial of Service (DDoS) attacks. Principal component analysis techniques were applied to reduce data dimensionality. We used accuracy, precision, recall, and F1-Score as the evaluation metrics. We explain the True Positive, False Positive, True Negative, and False Negative measures as basic parts of the above evaluation metrics. Unlike previous studies, we used the Training Time to evaluate the training time of each model. We employed two datasets, CICIDS 2017 and CSE-CIC-IDS 2018, to evaluate our proposed model. In general, the proposed models exhibited the best performance and improved training time.INDEX TERMS Machine learning, principal component analysis, Internet of Things, DDoS attack.

show abstract

A Survey on Machine Learning Based Detection on DDoS Attacks for IoT Systems

Cited by 26 publications

References 15 publications

Dynamic Adaptation Attack Detection Model for a Distributed Multi-Access Edge Computing Smart City

Dynamic Adaptation Attack Detection Model for a Distributed Multi-Access Edge Computing Smart City

A Survey of Using Machine Learning in IoT Security and the Challenges Faced by Researchers

An Intelligent Approach to Improving the Performance of Threat Detection in IoT

Contact Info

Product

Resources

About