Digital Twin-Enabled Intelligent DDoS Detection Mechanism for Autonomous Core Networks

Abstract

Existing distributed denial of service attack (DDoS) solutions cannot handle highly aggregated data rates; thus, they are unsuitable for Internet service provider (ISP) core networks. This paper proposes a digital twin-enabled intelligent DDoS detection mechanism using an online learning method for autonomous systems. Our contributions are three-fold: we first design a DDoS detection architecture based on the digital twin for ISP core networks. We implemented a Yet Another Next Generation (YANG) model and an automated feature selection (AutoFS) module to handle core network data. We used an online learning approach to update the model instantly and efficiently, improve the learning model quickly, and ensure accurate predictions. Finally, we reveal that our proposed solution successfully detects DDoS attacks and updates the feature selection method and learning model with a true classification rate of ninety-seven percent. Our proposed solution can estimate the attack within approximately fifteen minutes after the DDoS attack starts.

A Survey on Digital Twins: Architecture, Enabling Technologies, Security and Privacy, and Future Prospects

“…Simulations validate the advantages of the designed stacked model for real-time intrusion detection. Considering the autonomous core networks, Yigit et al [86] present a digital twin-assisted DDoS detection scheme through an online learning approach. Xiao et al [87] investigate a digital twin-based security framework to protect the smart home system.…”

Empowering Digital Twin for Future Networks with Graph Neural Networks: Overview, Enabling Technologies, Challenges, and Opportunities

“…In another context, Yigit et al [44] present a digital twin-enabled framework aimed at Distributed denial of service (DDoS) attack detection for autonomous core networks. Since existing DDoS solutions are insufficient for data centers and edge networks in terms of scalability, detection rates, and latency, the authors develop an online ML-based algorithm for effective DDoS detection.…”

“…The capabilities of a GraphNDT to analyze system states over time can be leveraged for predictive maintenance, including predicting failure points, tracing back to root causes, and making maintenance decisions [28,31,43,44]. By providing two-way communication, an NDT not only allows synchronizing the digital twin with the actual network infrastructure, but also provides a means to apply remote reconfiguration, simulate potential changes or maintenance activities, and validate their impact on network performance.…”

Toward a Real-Time TCP SYN Flood DDoS Mitigation Using Adaptive Neuro-Fuzzy Classifier and SDN Assistance in Fog Computing

“…Te frst one is known as "network-level fooding," when TCP, UDP, ICMP, and DNS packets are used to overload intended clients' network capabilities and resources. Whereas, the second protocol level is referred to as "application-level DDoS fooding" which is typically done on an HTTP web page when attacks are launched to deplete server resources such as sockets, CPU, ports, memory, databases, and input/output bandwidth [6]. Regarding the rapid growth and the harm caused by DDoS attacks, several kinds of research have been conducted on these attacks, and various approaches have been presented in the literature to prevent these attacks using fog computing [7,8].…”