DeepDetect: Detection of Distributed Denial of Service Attacks Using Deep Learning

Asad, Muhammad; Asim, Muhammad; Javed, Talha; Beg, Mirza Omer; Mujtaba, Hasan; Abbas, Sohail

doi:10.1093/comjnl/bxz064

Cited by 78 publications

(44 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Deep learning algorithms have also been used in SDN-based architectures to solve the problem of intrusion detection [16][17][18]. Other deep learning algorithms [19,20] have been applied in non-SDN architectures to detect DDoS and intrusion detection.…”

Section: Related Workmentioning

confidence: 99%

An Investigation into the Application of Deep Learning in the Detection and Mitigation of DDOS Attack on SDN Controllers

et al. 2021

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is a new paradigm that revolutionizes the idea of a software-driven network through the separation of control and data planes. It addresses the problems of traditional network architecture. Nevertheless, this brilliant architecture is exposed to several security threats, e.g., the distributed denial of service (DDoS) attack, which is hard to contain in such software-based networks. The concept of a centralized controller in SDN makes it a single point of attack as well as a single point of failure. In this paper, deep learning-based models, long-short term memory (LSTM) and convolutional neural network (CNN), are investigated. It illustrates their possibility and efficiency in being used in detecting and mitigating DDoS attack. The paper focuses on TCP, UDP, and ICMP flood attacks that target the controller. The performance of the models was evaluated based on the accuracy, recall, and true negative rate. We compared the performance of the deep learning models with classical machine learning models. We further provide details on the time taken to detect and mitigate the attack. Our results show that RNN LSTM is a viable deep learning algorithm that can be applied in the detection and mitigation of DDoS in the SDN controller. Our proposed model produced an accuracy of 89.63%, which outperformed linear-based models such as SVM (86.85%) and Naive Bayes (82.61%). Although KNN, which is a linear-based model, outperformed our proposed model (achieving an accuracy of 99.4%), our proposed model provides a good trade-off between precision and recall, which makes it suitable for DDoS classification. In addition, it was realized that the split ratio of the training and testing datasets can give different results in the performance of a deep learning algorithm used in a specific work. The model achieved the best performance when a split of 70/30 was used in comparison to 80/20 and 60/40 split ratios.

show abstract

Section: Related Workmentioning

confidence: 99%

An Investigation into the Application of Deep Learning in the Detection and Mitigation of DDOS Attack on SDN Controllers

et al. 2021

View full text Add to dashboard Cite

show abstract

“…The experimental results showed that their system outperformed conventional machine learning models. Furthermore, Asad's team [26] proposed a deep neural network-based system that Fig. 2 DDoS attacks utilising different attack types uses feed-forward back-propagation.…”

Section: Related Workmentioning

confidence: 99%

“…The complexity of the model increasing the level of difficulty for duplicating the model Asad [26] Simplicity of the model making it easy to understand and duplicate Potential performance reduction on data sets with different attacks exhibiting different traffic patterns Salama [27] Applying RBM to select features for a SVM Requirement an additional machine learning model for classification are provided in the 'Target Detector' section. Furthermore, to reduce the variance of the system, the IAM applies an ensemble technique by employing RAAs as base learners and utilising a majority voting scheme to attain the final classification.…”

Section: System Designmentioning

confidence: 99%

“…Since there are two modes 73 and 96, the mode with the largest value 96 is the potential RT. Next, each value in the Random Steps list of [26,75,89,80,2,51] is compared to the potential RT of 96 and the comparisons list is [0, 0, 0, 0, 0, 0], so the modified list changes to [26,75,89,80,2,51]. Since there is no mode, the largest value 89 is the potential RT.…”

Section: Variables or Names Descriptionsmentioning

confidence: 99%

See 1 more Smart Citation

Recurrent autonomous autoencoder for intelligent DDoS attack mitigation within the ISP domain

Chambers

Barrett

2021

Int. J. Mach. Learn. & Cyber.

View full text Add to dashboard Cite

The continuous advancement of DDoS attack technology and an increasing number of IoT devices connected on 5G networks escalate the level of difficulty for DDoS mitigation. A growing number of researchers have started to utilise Deep Learning algorithms to improve the performance of DDoS mitigation systems. Real DDoS attack data has no labels, and hence, we present an intelligent attack mitigation (IAM) system, which takes an ensemble approach by employing Recurrent Autonomous Autoencoders (RAA) as basic learners with a majority voting scheme. The RAA is a target-driven, distributionenabled, and imbalanced clustering algorithm, which is designed to work with the ISP's blackholing mechanism for DDoS flood attack mitigation. It can dynamically select features, decide a reference target (RT), and determine an optimal threshold to classify network traffic. A novel Comparison-Max Random Walk algorithm is used to determine the RT, which is used as an instrument to direct the model to classify the data so that the predicted positives are close or equal to the RT. We also propose Estimated Evaluation Metrics (EEM) to evaluate the performance of unsupervised models. The IAM system is tested with UDP flood, TCP flood, ICMP flood, multi-vector and a real UDP flood attack data. Additionally, to check the scalability of the IAM system, we tested it on every subdivided data set for distributed computing. The average Recall on all data sets was above 98%.

show abstract

“…Other methods such as the auto-encoder neural network [27], Long and Short Time Memory network (LSTM) [28] and the CNN [29] are also used to detect the anomaly through encoding the traffic. Furthermore, some researches have been carried out based on the environmental feature of multi-flows [30], which applied the DNN to learn the characteristics of the network flow.…”

Section: Related Workmentioning

confidence: 99%

Analysis of Multi-Types of Flow Features Based on Hybrid Neural Network for Improving Network Anomaly Detection

Cao

2019

IEEE Access

View full text Add to dashboard Cite

Security issues of large-scale local area network are becoming more prominent and the anomaly detection for the network traffic is the key means to solve this problem. On the other hand, it is a challenge to extract effective and accurate traffic features for anomaly detection. In order to resolve this challenge, multi-types of network flow features are designed and analyzed in the present study. These features include sequence packet features, general statistical features and environmental features, which can profile the characteristics of network flows accurately. Moreover, a method based on the hybrid neural network is proposed to detect anomaly by analyzing these features. One-dimensional convolutional network is implemented to analyze the sequence features in the hybrid neural network, while deep neural networks are utilized to learn the characteristics of high-dimension feature vectors including general statistical features and environmental features. The method can make comprehensive analysis for network anomaly detection. Two datasets of ISCX-IDS-2012 and CIC-IDS-2017 are carried out to evaluate the performance of the proposed method and other similar algorithms. The present study shows that the comprehensive performances of the proposed method are better than that for others algorithms. It is concluded that the proposed method can be applied for the anomaly detection applications with reasonable performance. INDEX TERMS Anomaly detection, hybrid neural network, network flow feature.

show abstract

DeepDetect: Detection of Distributed Denial of Service Attacks Using Deep Learning

Cited by 78 publications

References 17 publications

An Investigation into the Application of Deep Learning in the Detection and Mitigation of DDOS Attack on SDN Controllers

An Investigation into the Application of Deep Learning in the Detection and Mitigation of DDOS Attack on SDN Controllers

Recurrent autonomous autoencoder for intelligent DDoS attack mitigation within the ISP domain

Analysis of Multi-Types of Flow Features Based on Hybrid Neural Network for Improving Network Anomaly Detection

Contact Info

Product

Resources

About