Evaluating ML-based DDoS Detection with Grid Search Hyperparameter Optimization

Sanchez, Odnan Ref; Repello, Matteo; Carrega, Alessandro; Bolla, Raffaele

doi:10.1109/netsoft51509.2021.9492633

Cited by 23 publications

(18 citation statements)

References 20 publications

(39 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The authors [12] propose a lightweight approach to detect DDoS attacks aimed at resource-constrained environments such as IoT and shows that their lightweight random forest technique can achieve as high as 99% of detection accuracy. Varghese et al [13] proposed a statistical anomaly detection algorithm implemented in the data plane of Software Defined Network (SDN) to detect DDoS attacks near real-time as a part of an Intrusion Detection System (IDS).…”

Section: A Machine Learning Based Approachesmentioning

confidence: 99%

“…Shieh et al [15] demonstrate a Bi-directional LSTM model along with a Gaussian Mixture Model to detect and classify 6 different types of DDoS attacks with an accuracy of 98%. Sanchez et al [12] proposed a standalone Multi-Layer Perceptron (MLP) achieving the 99.93% accuracy and 99.96% F1-score. Rehman et al [16] proposed a Gated Recurrent Units (GRU) model to detect DDoS attack based on CI-CDDoS2019 dataset.…”

Section: B Deep Learning Based Approachesmentioning

confidence: 99%

“…The area under the curve (AUC) computes the area under the receiver operating characteristics (ROC) curve which is plotted based on the trade-off between the true positive rate on the y-axis and the false positive rate on the x-axis across different thresholds. Mathematically, AUC is computed as shown in Equation (12).…”

Section: P Recision = T P T P + F Pmentioning

confidence: 99%

“…[22], [23]. Many state-of-the-VOLUME 4, 2016 [6] KNN, NB, RF, SVM IDS 98.86 ≈ 99.54 (Accuracy) CICDDoS2017 Ullah et al [7] NB, LR, DT, RF IoT 99.99 ≈ 100 (F1-score) IoT Botnet Gohil et al [8] DT, NB, LR, SVM, KNN IDS 97.72 ≈ 99.99 (Accuracy) CICDDoS2019 Alamri et al [9] XGBoost SDN 99.9 (Accuracy) CICDDoS2019 Khoei et al [10] Stacking, Bagging, Boosting Smart Grid 92.2 ≈ 93.4 (Accuracy) CICDDoS2019 Parfenov et al [11] Gradient Boosting IDS 96.8 (F1-score) CICDDoS2019 Parfenov et al [11] CatBoost IDS 96.9 (F1-score) CICDDoS2019 Sanchez et al [12] Random Forest IoT 99.97 (Accuracy) CICDDoS2019 Varghese et al [13] D3 SDN 84.54 (Accuracy) CICDDoS2019 Pontes et al [14] EFC IDS 97.5 (F1-score) CICDDoS2019…”

Section: Introductionmentioning

confidence: 99%

“…Shieh et al [15] Bi-directional LSTM + Gaussian Mixture IDS 98 (Accuracy) CICDDoS2019 Sanchez et al [12] MLP IDS 99.93 (Accuracy) CICDDoS2019 Rehman et al [16] Gated Recurrent Units (GRU) IDS 99.69 ≈ 99.94 (Accuracy) CICDDoS2019 Almaini et al [17] Kalman Backpropagation Neural Network IDS 94 (Accuracy) CICDDoS2019 Samom and Taggu [18] MLP IDS 99.92 (Accuracy) CICDDoS2019 Elsayed et al [19] RNN + Autoencoder SDN 99 (F1-score) CICDDoS2019 Javaid et al [20] Sparse-Autoencoder IDS 88.39 (Accuracy) NSL-KDD Sadaf et a. [21] Autoencoder IDS 88.98 (Accuracy) NSL-KDD Can et al [2] MLP IDS 79.39 (F1-score) CICDDoS2019…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

AE-MLP: A Hybrid Deep Learning Approach for DDoS Detection and Classification

Wei¹,

et al. 2021

View full text Add to dashboard Cite

Distributed Denial-of-Service (DDoS) attacks are increasing as the demand for Internet connectivity massively grows in recent years. Conventional shallow machine learning-based techniques for DDoS attack classification tend to be ineffective when the volume and features of network traffic, potentially carry malicious DDoS payloads, increase exponentially as they cannot extract high importance features automatically. To address this concern, we propose a hybrid approach named AE-MLP that combines two deep learning-based models for effective DDoS attack detection and classification. The Autoencoder (AE) part of our proposed model provides an effective feature extraction that finds the most relevant feature sets automatically without human intervention (e.g., knowledge of cybersecurity professionals). The Multilayer Perceptron Network (MLP) part of our proposed model uses the compressed and reduced feature sets produced by the AE as inputs and classifies the attacks into different DDoS attack types to overcome the performance overhead and bias associated with processing large feature sets with noise (i.e., unnecessary feature values). Our experimental results, obtained through comprehensive and extensive experiments on different aspects of performance on the CICDDoS2019 dataset, demonstrate both a very high and robust accuracy rate and F1-score that exceed 98% which also outperformed the performance of many similar methods. This shows that our proposed model can be used as an effective DDoS defense tool against the growing number of DDoS attacks.

show abstract

Section: A Machine Learning Based Approachesmentioning

confidence: 99%

Section: B Deep Learning Based Approachesmentioning

confidence: 99%

Section: P Recision = T P T P + F Pmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

AE-MLP: A Hybrid Deep Learning Approach for DDoS Detection and Classification

Wei¹,

et al. 2021

View full text Add to dashboard Cite

show abstract

Monitoring Network Flows in Containerized Environments

Repetto

Carrega²

2022

Cybersecurity of Digital Service Chains

View full text Add to dashboard Cite

With the progressive implementation of digital services over virtualized infrastructures and smart devices, the inspection of network traffic becomes more challenging than ever, because of the difficulty to run legacy cybersecurity tools in novel cloud models and computing paradigms. The main issues concern i) the portability of the service across heterogeneous public and private infrastructures, that usually lack hardware and software acceleration for efficient packet processing, and ii) the difficulty to integrate monolithic appliances in modular and agile containerized environments.In this Chapter, we investigate the usage of the extended Berkeley Packet Filter (eBPF) for effective and efficient packet inspection in virtualized environments. Our preliminary implementation demonstrates that we can achieve the same performance as well-known packet inspection tools, but with far less resource consumption. This motivates further research work to extend the capability of our framework and to integrate it in Kubernetes.

show abstract