DoS Detection Method based on Artificial Neural Networks

Abstract

Abstract-DoS attack tools have become increasingly sophisticated challenging the existing detection systems to continually improve their performances. In this paper we present a victimend DoS detection method based on Artificial Neural Networks (ANN). In the proposed method a Feed-forward Neural Network (FNN) is optimized to accurately detect DoS attack with minimum resources usage. The proposed method consists of the following three major steps: (1) Collection of the incoming network traffic, (2) selection of relevant features for DoS detection using an unsupervised Correlation-based Feature Selection (CFS) method, (3) classification of the incoming network traffic into DoS traffic or normal traffic. Various experiments were conducted to evaluate the performance of the proposed method using two public datasets namely UNSW-NB15 and NSL-KDD. The obtained results are satisfactory when compared to the state-of-the-art DoS detection methods.

Network Intrusion Detection Using Neural Networks on FPGA SoCs

“…In this case, however, the workload of the ANN in [11] with a 6-7-1 configuration is significantly smaller compared to the proposed ANN's configuration. Taking into account the number of multiplications and additions in each layer, as those are the most computationally intensive operations, we estimate 49 multiplications and 57 additions for the ANN in [11]. Meanwhile for our work, a total of 651 multiplications and 674 additions are required.…”

“…To demonstrate and evaluate the benefits of utilizing the Look-Up-Table mechanism, we also provide the execution time of the unoptimized software implementation on the Arm core. This version of the ANN uses 110 inputs at the input layer and goes through a number of redundant multiplications as described in the Section IV-D. We also compare our work with the test time of the ANN used in [11]. Although the authors use a different dataset and detect only DoS attacks, we only focus on the execution time and corresponding workload in this section.…”

“…If we naively compare the execution time of the proposed ANN, considering our proposed optimised implementation with a 29-21-2 configuration, and the work in [11], our proposed accelerator performs about 26.6× faster. Meanwhile, our optimised model on the Arm core is about 6× slower.…”

“…Meanwhile for our work, a total of 651 multiplications and 674 additions are required. This amounts to 13.3× the multiplications and 11.8× the additions of the ANN used in [11], while delivering 26.6× its performance. Overall, our proposed approach is able to detect more types of attack: DoS, Probe, R2L and U2R, at a faster detection rate compared to the work in [11].…”

“…The authors use a custom dataset to train a three-layer (shallow) ANN for binary classification (normal-DoS/DDoS) and test it in a simulated IoT network, demonstrating 99.4% accuracy. The work in [11] presents two ANNs trained on the UNSW-NB15 and NSL-KDD datasets to detect DoS attacks. The authors use only input features relevant to such attacks, obtaining at best a detection accuracy of 99% on the NSL-KDD and 97% on the UNSW-NB15.…”