Distributed Denial of Service Attack Detection in Network Traffic Using Deep Learning Algorithm

Abstract

Internet security is a major concern these days due to the increasing demand for information technology (IT)-based platforms and cloud computing. With its expansion, the Internet has been facing various types of attacks. Viruses, denial of service (DoS) attacks, distributed DoS (DDoS) attacks, code injection attacks, and spoofing are the most common types of attacks in the modern era. Due to the expansion of IT, the volume and severity of network attacks have been increasing lately. DoS and DDoS are the most frequently reported network traffic attacks. Traditional solutions such as intrusion detection systems and firewalls cannot detect complex DDoS and DoS attacks. With the integration of artificial intelligence-based machine learning and deep learning methods, several novel approaches have been presented for DoS and DDoS detection. In particular, deep learning models have played a crucial role in detecting DDoS attacks due to their exceptional performance. This study adopts deep learning models including recurrent neural network (RNN), long short-term memory (LSTM), and gradient recurrent unit (GRU) to detect DDoS attacks on the most recent dataset, CICDDoS2019, and a comparative analysis is conducted with the CICIDS2017 dataset. The comparative analysis contributes to the development of a competent and accurate method for detecting DDoS attacks with reduced execution time and complexity. The experimental results demonstrate that models perform equally well on the CICDDoS2019 dataset with an accuracy score of 0.99, but there is a difference in execution time, with GRU showing less execution time than those of RNN and LSTM.

Improvement of Distributed Denial of Service Attack Detection through Machine Learning and Data Processing

“…This table provides a comprehensive evaluation of previous studies that used the CICDDoS2019 dataset and different machine learning techniques, including deep learning (DL) and the technique proposed in this work. As can be seen, the results obtained here surpass those achieved in previous works, except for those proposed in [16,22], with a difference of just 0.02 in accuracy and 0.01 in the F1 score. It is worth noting that in [16], the number of features is 24, in ours it is 22, while in the research of [22] it is 20 features.…”

“…As can be seen, the results obtained here surpass those achieved in previous works, except for those proposed in [16,22], with a difference of just 0.02 in accuracy and 0.01 in the F1 score. It is worth noting that in [16], the number of features is 24, in ours it is 22, while in the research of [22] it is 20 features. Another aspect to consider is that both studies used a random split for training and testing, which can face the issue of data leakage, compared to our study, where cross-validation (k = 5) was applied to ensure the representativeness of all data during the training phase.…”

“…Ramzan et al [22] used three deep learning models, namely RNN, LSTM, and GRU, to perform binary and multiclass classification of DDoS attacks using the CICDDoS2019 dataset. A total of 20 features were selected using an additional tree classifier.…”

“…However, in some studies, the data preprocessing was not detailed, or outliers were not taken into account [16,18,19]. In other studies [1,13,17,20,22], it was not specified how many records were affected after processing the outliers.…”

“…A crucial aspect when working with machine learning algorithms is the appropriate selection of the hyperparameters that a model should use. In many studies, this selection was performed arbitrarily [20][21][22]. In other cases, the hyperparameters used were not justified, making implementation difficult, or only the author only mention the algorithm used without specifying its hyperparameters [17].…”