Generation of DDoS Attack Dataset for Effective IDS Development and Evaluation

Abstract

Distributed Denial of Service (DDoS) attacks are performed from multiple agents towards a single victim. Essentially, all attacking agents generate multiple packets towards the victim to overwhelm it with requests, thereby overloading the resources of the victim. Since it is very complex and expensive to conduct a real DDoS attack, most organizations and researchers result in using simulations to mimic an actual attack. The researchers come up with diverse algorithms and mechanisms for attack detection and prevention. Further, simulation is good practice for determining the efficacy of an intrusive detective measure against DDoS attacks. However, some mechanisms are ineffective and thus not applied in real life attacks. Nowadays, DDoS attack has become more complex and modern for most IDS to detect. Adjustable and configurable traffic generator is becoming more and more important. This paper first details the available datasets that scholars use for DDoS attack detection. The paper further depicts the a few tools that exist freely and commercially for use in the simulation programs of DDoS attacks. In addition, a traffic generator for normal and different types of DDoS attack has been developed. The aim of the paper is to simulate a cloud environment by OMNET++ simulation tool, with different DDoS attack types. Generation normal and attack traffic can be useful to evaluate developing IDS for DDoS attacks detection. Moreover, the result traffic can be useful to test an effective algorithm, techniques and procedures of DDoS attacks. eration occurs in two stages, namely the compromise stage and the attack stage.An attacker will compromise available defenseless systems and install attack tools, thereby turning the machines into zombies. The second stage involves sending attack commands into the zombie machines via a secure mechanism so as to target a specific victim [1]. Cyber security experts and other researchers are faced with the challenges of unraveling DDoS attack vectors as well as ways to prevent such attacks. The scholars conduct attack simulation using either real data or simulated data based on previous attack characteristics. Simulation involves tools that have attack agents and defense agents. Attack agents are the daemon which is attack executors and master which is the attack coordinator.Defense agents are the sensors, samplers, detectors, filters and investigators [2]. Journal of Information Security over, the network traces that results from such interaction are also collected to conduct anomaly detection. In particular, this experiment is performed using Amazon web services (AWS) platform. It explores the generation of labeled datasets for quantifying the security threats impact to cloud data centers. Among the researchers, the detection of instruction is an exciting topic. Specifically, the discovery of anomaly is one of the vital factors that help in detecting several novel attacks. Due to the complexity of these systems, however, its application has not been appropriate.

A simulation work for generating a novel dataset to detect distributed denial of service attacks on Vehicular Ad hoc NETwork systems

“…Several researchers used OMNeT++ to simulate different types of DDoS attacks in traditional networks. [56][57][58] In this work, we generated normal and DDoS traffic for VANET scenarios. For the normal traffic, each node (vehicle or RSU) broadcasts UDP packets with a transmission interval of 1-5 per second.…”

Machine Learning Approaches for Combating Distributed Denial of Service Attacks in Modern Networking Environments

“…As it is very difficult to identify a suitable dataset for a specific type of DDoS attack, most researchers either use existing datasets or create their own dataset. The major limitation of using an existing dataset that it is very old and so not applicable for testing a system's robustness [109], [110]. It is known that attacks such as DDoS attacks adapt advanced techniques and become more sophisticated in order to circumvent any security measures, which means that it is not good practice to rely on results based on old datasets.…”

A deep learning approach with Bayesian optimization and ensemble classifiers for detecting denial of service attacks

“…Similarly, in other benchmarks, there are only a limited number of DDoS attacks. 50,51 On the other hand, it is known that many other types of DDoS attacks exist and are produced in the course of time. 51,52 The present work therefore aims to fill this gap by analyzing a rich set of DDoS attacks.…”