An intelligent system to detect slow denial of service attacks in software-defined networks

Abstract

<span lang="EN-US">Slow denial of service attack (DoS) is a tricky issue in software-defined network (SDN) as it uses less bandwidth to attack a server. In this paper, a slow-rate DoS attack called Slowloris is detected and mitigated on Apache2 and Nginx servers using a methodology called an intelligent system for slow DoS detection using machine learning (ISSDM) in SDN. Data generation module of ISSDM generates dataset with response time, the number of connections, timeout, and pattern match as features. Data are generated in a real environment using Apache2, Nginx server, Zodiac FX OpenFlow switch and Ryu controller. Monte Carlo simulation is used to estimate threshold values for attack classification. Further, ISSDM performs header inspection using regular expressions to mark flows as legitimate or attacked during data generation. The proposed feature selection module of ISSDM, called blended statistical and information gain (BSIG), selects those features that contribute best to classification. These features are used for classification by various machine learning and deep learning models. Results are compared with feature selection methods like Chi-square, T-test, and information gain.</span>

A hybrid deep learning approach for enhanced network intrusion detection

“…Anomaly-based IDS, alternatively labeled misuse data-based IDS, depends on predefined norms for regular network or host behavior. It recognizes any deviations from these norms as potential intrusions [19].…”

“…In the realm of intrusion detection, contemporary deep learning and machine learning techniques, recognized for their effectiveness in cybersecurity [23], encompass diverse tools. Deep belief network (DBN) employs layered hidden units for intricate data representation [18], while DNN excels in complex feature learning [19]. The whale optimization algorithm (WOA), inspired by humpback whale behavior [21], and SVM adept at separating classes in high-dimensional spaces, contribute significantly to threat detection [6].…”