Evaluation of Intrusion Detection Systems in IPv6 Networks

Schrötter, Max; Scheffler, Thomas; Schnor, Bettina

doi:10.5220/0007840104080416

Cited by 7 publications

(7 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Snort can also be easily extended via plugins with other inspectors and rule options. The neighbor discovery protocol inspector indp [70], for example, detects attacks on the IPv6 neighbor discovery protocol [71].…”

Section: Snort Configurationmentioning

confidence: 99%

A Comparison of Neural-Network-Based Intrusion Detection against Signature-Based Detection in IoT Networks

Schrötter,

Niemann,

Schnor

2024

Information

Self Cite

View full text Add to dashboard Cite

Over the last few years, a plethora of papers presenting machine-learning-based approaches for intrusion detection have been published. However, the majority of those papers do not compare their results with a proper baseline of a signature-based intrusion detection system, thus violating good machine learning practices. In order to evaluate the pros and cons of the machine-learning-based approach, we replicated a research study that uses a deep neural network model for intrusion detection. The results of our replicated research study expose several systematic problems with the used datasets and evaluation methods. In our experiments, a signature-based intrusion detection system with a minimal setup was able to outperform the tested model even under small traffic changes. Testing the replicated neural network on a new dataset recorded in the same environment with the same attacks using the same tools showed that the accuracy of the neural network dropped to 54%. Furthermore, the often-claimed advantage of being able to detect zero-day attacks could not be seen in our experiments.

show abstract

Section: Snort Configurationmentioning

confidence: 99%

A Comparison of Neural-Network-Based Intrusion Detection against Signature-Based Detection in IoT Networks

Schrötter,

Niemann,

Schnor

2024

Information

Self Cite

View full text Add to dashboard Cite

show abstract

“…Snort can also be easily extended via plugins with other inspectors and rule options. The neighbor discovery protocol inspector indp 9 for example detects attacks on the IPv6 neighbor discovery protocol [63].…”

Section: Snort Configurationmentioning

confidence: 99%

A Comparison of Neural Network-Based Intrusion Detection Against Signature-Based Detection in IoT Networks

Schrötter,

Niemann,

Schnor

2024

Preprint

View full text Add to dashboard Cite

show abstract

“…IDS software is widely used to detect potential attacks through the classification algorithms that are commonly used to build accurate IDSs due to their efficiency and autolearning ability to detect ICMPv6-based DDoS attacks [47,48]. In addition, IDS uses a benchmark dataset for the evaluation of intrusion detection systems in IPv6 environments, and evaluation through the accuracy in detecting IPv6 attacks [36].…”

Section: Intrusion Detection System (Ids) For Icmpv6mentioning

confidence: 99%

Feature Selection for Detecting ICMPv6-Based DDoS Attacks Using Binary Flower Pollination Algorithm

Hasan Bdair Aighuraibawi,

Manickam,

Abdullah

et al. 2023

Computer Systems Science and Engineering

View full text Add to dashboard Cite

Internet Protocol version 6 (IPv6) is the latest version of IP that goal to host 3.4 × 10 38 unique IP addresses of devices in the network. IPv6 has introduced new features like Neighbour Discovery Protocol (NDP) and Address Auto-configuration Scheme. IPv6 needed several protocols like the Address Auto-configuration Scheme and Internet Control Message Protocol (ICMPv6). IPv6 is vulnerable to numerous attacks like Denial of Service (DoS) and Distributed Denial of Service (DDoS) which is one of the most dangerous attacks executed through ICMPv6 messages that impose security and financial implications. Therefore, an Intrusion Detection System (IDS) is a monitoring system of the security of a network that detects suspicious activities and deals with a massive amount of data comprised of repetitive and inappropriate features which affect the detection rate. A feature selection (FS) technique helps to reduce the computation time and complexity by selecting the optimum subset of features. This paper proposes a method for detecting DDoS flooding attacks (FA) based on ICMPv6 messages using a Binary Flower Pollination Algorithm (BFPA-FA). The proposed method (BFPA-FA) employs FS technology with a support vector machine (SVM) to identify the most relevant, influential features. Moreover, The ICMPv6-DDoS dataset was used to demonstrate the effectiveness of the proposed method through different attack scenarios. The results show that the proposed method BFPA-FA achieved the best accuracy rate (97.96%) for the ICMPv6 DDoS detection with a reduced number of features (9) to half the total (19) features. The proven proposed method BFPA-FA is effective in the ICMPv6 DDoS attacks via IDS.

show abstract

Evaluation of Intrusion Detection Systems in IPv6 Networks

Cited by 7 publications

References 0 publications

A Comparison of Neural-Network-Based Intrusion Detection against Signature-Based Detection in IoT Networks

A Comparison of Neural-Network-Based Intrusion Detection against Signature-Based Detection in IoT Networks

A Comparison of Neural Network-Based Intrusion Detection Against Signature-Based Detection in IoT Networks

Feature Selection for Detecting ICMPv6-Based DDoS Attacks Using Binary Flower Pollination Algorithm

Contact Info

Product

Resources

About