Detection of Denial-of-Service Attacks Based on Computer Vision Techniques

Abstract

the ensemble detection system involves time-consuming computation and cannot work real-time. Yu et al. [21] suggested a two-tier hierarchical detection system using SVM. The hierarchical structure and one-class SVM (i.e., Support Vector Data Description) equip it with the advantage in classifying various attacks into their appropriate classes. This detection system achieved its best attack detection rate of 99.40% using 3 selected Management Information Based (MIB) features. Statistical analysis techniques have been employed to conduct investigation into attributes of network traffic packets and to determine a rationale threshold for discriminating attacks from the legitimate traffic. Wang et al. [22] proposed a sequential Change-Point Monitoring (CPM) approach for the detection of DoS attacks. A non-parametric Cumulative Sum (CUSUM) algorithm was used in the CPM to evaluate the significance of the changes of traffic patterns and to determine the appearance of DoS attacks. The CPM is more suitable for analysing a complex network environment. Whereas in [22], CPM was only tested using SYN flooding attacks. Moreover, its performance is possibly affected by network indiscipline. Kim and Reddy [23] suggested a statistical-based approach to detect anomalies at an egress router. Discrete wavelet transform was used to transform address correlation data (i.e., the correlation of destination IP addresses, port numbers and the number of flows). This statistical-based detection technique provides a solution to detect outgoing anomalous traffic at source networks. Thatte et al. [24] developed a bivariate Parametric Detection Mechanism (bPDM) operating on aggregate traffic. The bPDM applies the Sequential Probability Ratio Test (SPRT) on two aggregate traffic statistics (i.e., packet rate and packet size), and it alleges an anomaly only when a rise in the traffic volume is associated with a change in the distribution of packet-size. Despite the afore-discussed systems or approaches show innovation and promise in different aspects of attack detection, they still suffer from relatively high false positive rates. This is partly because they either neglect the dependency and correlation between features/attributes or do not manage to fully exploit the correlation [25]. Some recent studies attempt to cope with this problem by taking full advantage of the correlation in their designs. Thottan and Ji [10] developed an abrupt change detection approach which employs statistical signal processing technique based on the Auto-Regression (AR) process. An operation matrix (A), which retained "the ensemble average of the two point spatial cross-correlation of the abnormality vectors estimated over a time interval T " [10], participated in the computation of the value of abnormality indicator. Although this detection approach has shown to be effective in detecting several network anomalies, it is still an open topic for now how to manage features with various time granularities. Jin et al. [11] proposed a statistical detection approach using...

Jamming Attack Detection and Prevention in Cyber System

“…Therefore on utilize the accessible resources; customers have to be compelled to modification, which they have to be compelled to act lots of "smart". They have to vary from being passive customers to being active customers [1]. Sensible grids aim to reduce the energy consumption, guarantee dependableness of power give, reduce carbon foot print, and minimize the costs associated with power consumption.…”

“…until recently it had been assumed that the techniques accustomed notice and establish unhealthy detector activities in state estimation can also thwart malicious detector activity modification. However, recent work by Liu et al [1] incontestable that Associate in Nursing soul, armed with the knowledge of network configuration, can inject false data into state estimation that uses DC power flow models whereas not being detected. throughout this work, we tend to tend to explore the detection of false data injection attacks of [1] by protecting a strategically elite set of detector lineaments and by having the best thanks to severally verify or live the values of a strategically elite set of state variables.…”

“…However, recent work by Liu et al [1] incontestable that Associate in Nursing soul, armed with the knowledge of network configuration, can inject false data into state estimation that uses DC power flow models whereas not being detected. throughout this work, we tend to tend to explore the detection of false data injection attacks of [1] by protecting a strategically elite set of detector lineaments and by having the best thanks to severally verify or live the values of a strategically elite set of state variables. Specifically, we tend to tend to indicate that it's a necessity and comfy to protect a gaggle of basic measurements to note such attacks.…”

“…Wise grid contains self-healing characteristics, it'll merely accommodate renewable energy sources like electrical device, wind, hydro-electric, recurrent event and biomass. It's main objectives unit to supply power faithfully, reduce energy consumption and blackouts [ 1]. Regardless of the domain, a cycle has 3 principal characteristics square measure (1) atmosphere Coupling: CPSs square measure terribly tightly as well as their atmosphere (physical process) -any modification within the behaviour of the atmosphere leads to a modification within the CPS' behaviour and vice-versa.…”

LuNet: A Deep Neural Network for Network Intrusion Detection

“…The principle of anomaly detection is that we only need to learn a profile of normal traffic whereas the outliers are considered as attacks. Statistical learning [31], [32], [32]- [34] and unsupervised learning [35]- [37] are currently primary techniques used for anomaly detection. The anomaly detection for network intrusion detection is not very suitable and practical for the reasons below:…”