DoS and DDoS Attack Detection Using Deep Learning and IDS

Shurman, Mohammad; Khrais, Rami M.; Yateem, Abdulrahman A.

doi:10.34028/iajit/17/4a/10

Cited by 51 publications

(31 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Shurman et al. ( 2020 ) proposed two methodologies the first method is a hybrid-based IDS, and the second method is a DL model based on LSTM to detect DoS/DDoS attacks. The first method, the IDS framework, defined as an application, can detect malicious network traffic from any network device with running datasets of IPs against it.…”

Section: Methodologies Strengths and Weaknessesmentioning

confidence: 99%

“…Some real DDoS attacks are: TCP, UDP and ICMP Liang and Znati ( 2019 ) 2019 LSTM CICIDS2017 Slowloris, Hulk, Slowhttptest, GoldenEye and LOIC Shurman et al. ( 2020 ) 2020 Hybrid IDS and LSTM Reflection-based CICDDoS2019 MSSQL, SSDP, CharGen, LDAP, NTP, TFTP, DNS, SNMP, NETBIOS, and PORTMAP Assis et al. ( 2021 ) 2021 GRU CICDDoS2019 and CICIDS2018 CICDDoS2019: Twelve DDoS attacks on the training day and seven attacks during the testing day.…”

Section: Available Ddos Benchmarked Datasets and Classes Of Attacks In Datasetsmentioning

confidence: 99%

“…CICIDS2017 (Friday): Precision 0.9998, Recall 1, F1-score 0.9999 Shurman et al. ( 2020 ) One hot encoder and RF for feature selection The model comprises of three LSTM layers with 128 neurons and sigmoid function, three dropout layers, and a dense layer with tanh function. The model used categorical cross-entropy loss function and RMS propagation as an optimizer – Accuracy 99.19% Assis et al.…”

Section: Preprocessing Strategies Hyperparameter Values Experimental Setups and Performance Metricsmentioning

confidence: 99%

See 2 more Smart Citations

Deep learning approaches for detecting DDoS attacks: a systematic review

Mittal¹,

Kumar²,

Behal³

2022

Soft Comput

104

View full text Add to dashboard Cite

In today’s world, technology has become an inevitable part of human life. In fact, during the Covid-19 pandemic, everything from the corporate world to educational institutes has shifted from offline to online. It leads to exponential increase in intrusions and attacks over the Internet-based technologies. One of the lethal threat surfacing is the Distributed Denial of Service (DDoS) attack that can cripple down Internet-based services and applications in no time. The attackers are updating their skill strategies continuously and hence elude the existing detection mechanisms. Since the volume of data generated and stored has increased manifolds, the traditional detection mechanisms are not appropriate for detecting novel DDoS attacks. This paper systematically reviews the prominent literature specifically in deep learning to detect DDoS. The authors have explored four extensively used digital libraries (IEEE, ACM, ScienceDirect, Springer) and one scholarly search engine (Google scholar) for searching the recent literature. We have analyzed the relevant studies and the results of the SLR are categorized into five main research areas: (i) the different types of DDoS attack detection deep learning approaches, (ii) the methodologies, strengths, and weaknesses of existing deep learning approaches for DDoS attacks detection (iii) benchmarked datasets and classes of attacks in datasets used in the existing literature, and (iv) the preprocessing strategies, hyperparameter values, experimental setups, and performance metrics used in the existing literature (v) the research gaps, and future directions.

show abstract

Section: Methodologies Strengths and Weaknessesmentioning

confidence: 99%

Section: Available Ddos Benchmarked Datasets and Classes Of Attacks In Datasetsmentioning

confidence: 99%

Section: Preprocessing Strategies Hyperparameter Values Experimental Setups and Performance Metricsmentioning

confidence: 99%

See 1 more Smart Citation

Deep learning approaches for detecting DDoS attacks: a systematic review

Mittal¹,

Kumar²,

Behal³

2022

Soft Comput

104

View full text Add to dashboard Cite

show abstract

“…Shurman et al [ 92 ] proposed two models in an attempt to detect anomalies on the CICDDoS2019 dataset [ 93 ]. The first model was a hybrid model that encompasses signature-based method with an anomaly-based method.…”

Section: Related Workmentioning

confidence: 99%

Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset

Liu

Thapa

Shaver

et al. 2021

Sensors

View full text Add to dashboard Cite

As Internet of Things (IoT) networks expand globally with an annual increase of active devices, providing better safeguards to threats is becoming more prominent. An intrusion detection system (IDS) is the most viable solution that mitigates the threats of cyberattacks. Given the many constraints of the ever-changing network environment of IoT devices, an effective yet lightweight IDS is required to detect cyber anomalies and categorize various cyberattacks. Additionally, most publicly available datasets used for research do not reflect the recent network behaviors, nor are they made from IoT networks. To address these issues, in this paper, we have the following contributions: (1) we create a dataset from IoT networks, namely, the Center for Cyber Defense (CCD) IoT Network Intrusion Dataset V1 (CCD-INID-V1); (2) we propose a hybrid lightweight form of IDS—an embedded model (EM) for feature selection and a convolutional neural network (CNN) for attack detection and classification. The proposed method has two models: (a) RCNN: Random Forest (RF) is combined with CNN and (b) XCNN: eXtreme Gradient Boosting (XGBoost) is combined with CNN. RF and XGBoost are the embedded models to reduce less impactful features. (3) We attempt anomaly (binary) classifications and attack-based (multiclass) classifications on CCD-INID-V1 and two other IoT datasets, the detection_of_IoT_botnet_attacks_N_BaIoT dataset (Balot) and the CIRA-CIC-DoHBrw-2020 dataset (DoH20), to explore the effectiveness of these learning-based security models. Using RCNN, we achieved an Area under the Receiver Characteristic Operator (ROC) Curve (AUC) score of 0.956 with a runtime of 32.28 s on CCD-INID-V1, 0.999 with a runtime of 71.46 s on Balot, and 0.986 with a runtime of 35.45 s on DoH20. Using XCNN, we achieved an AUC score of 0.998 with a runtime of 51.38 s for CCD-INID-V1, 0.999 with a runtime of 72.12 s for Balot, and 0.999 with a runtime of 72.91 s for DoH20. Compared to KNN, XCNN required 86.98% less computational time, and RCNN required 91.74% less computational time to achieve equal or better accurate anomaly detections. We find XCNN and RCNN are consistently efficient and handle scalability well; in particular, 1000 times faster than KNN when dealing with a relatively larger dataset-Balot. Finally, we highlight RCNN and XCNN’s ability to accurately detect anomalies with a significant reduction in computational time. This advantage grants flexibility for the IDS placement strategy. Our IDS can be placed at a central server as well as resource-constrained edge devices. Our lightweight IDS requires low train time and hence decreases reaction time to zero-day attacks.

show abstract

“…Shurman et al [16] proposed two models in an attempt to detect anomalies on the CICDDoS2019 dataset [17]. The first model was a hybrid model that encompasses signaturebased method with an anomaly-based method.…”

Section: Related Workmentioning

confidence: 99%

Secure Cyber Defense: An Analysis of Network Intrusion-Based Dataset CCD-IDSv1 with Machine Learning and Deep Learning Models

et al. 2021

View full text Add to dashboard Cite

Anomaly detection and multi-attack classification are major concerns for cyber defense. Several publicly available datasets have been used extensively for the evaluation of Intrusion Detection Systems (IDSs). However, most of the publicly available datasets may not contain attack scenarios based on evolving threats. The development of a robust network intrusion dataset is vital for network threat analysis and mitigation. Proactive IDSs are required to tackle ever-growing threats in cyberspace. Machine learning (ML) and deep learning (DL) models have been deployed recently to detect the various types of cyber-attacks. However, current IDSs struggle to attain both a high detection rate and a low false alarm rate. To address these issues, we first develop a Center for Cyber Defense (CCD)-IDSv1 labeled flow-based dataset in an OpenStack environment. Five different attacks with normal usage imitating real-life usage are implemented. The number of network features is increased to overcome the shortcomings of the previous network flow-based datasets such as CIDDS and CIC-IDS2017. Secondly, this paper presents a comparative analysis on the effectiveness of different ML and DL models on our CCD-IDSv1 dataset. In this study, we consider both cyber anomaly detection and multi-attack classification. To improve the performance, we developed two DL-based ensemble models: Ensemble-CNN-10 and Ensemble-CNN-LSTM. Ensemble-CNN-10 combines 10 CNN models developed from 10-fold cross-validation, whereas Ensemble-CNN-LSTM combines base CNN and LSTM models. This paper also presents feature importance for both anomaly detection and multi-attack classification. Overall, the proposed ensemble models performed well in both the 10-fold cross-validation and independent testing on our dataset. Together, these results suggest the robustness and effectiveness of the proposed IDSs based on ML and DL models on the CCD-IDSv1 intrusion detection dataset.

show abstract

DoS and DDoS Attack Detection Using Deep Learning and IDS

Cited by 51 publications

References 0 publications

Deep learning approaches for detecting DDoS attacks: a systematic review

Deep learning approaches for detecting DDoS attacks: a systematic review

Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset

Secure Cyber Defense: An Analysis of Network Intrusion-Based Dataset CCD-IDSv1 with Machine Learning and Deep Learning Models

Contact Info

Product

Resources

About