IDS for Improving DDoS Attack Recognition Based on Attack Profiles and Network Traffic Features

Sallam, Amer A.; Kabir, Muhammad Nomani; Alginahi, Yasser M.; Jamal, Ahmed; Esmeel, Thamer Khalil

doi:10.1109/cspa48992.2020.9068679

Cited by 19 publications

(8 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…When A and B are distinct variables with ranges in a1....ak and b1....bk, the uncertainty about A's value is quantified by its entropy in Equation (2).…”

Section: Feature Range Using Igmentioning

confidence: 99%

See 1 more Smart Citation

Integration of Fuzzy with Incremental Import Vector Machine for Intrusion Detection

Ramamoorthy

Karuppasamy²

2022

INT J COMPUT COMMUN, Int. J. Comput. Commun. Control

View full text Add to dashboard Cite

IDM design and implementation remain a difficult undertaking and an unsolved research topic. Multi-dimensional irrelevant characteristics and duplicate information are included in the network dataset. To boost the effectiveness of IDM, a novel hybrid model is developed that combines Fuzzy Genetic Algorithms with Increment Import Vector Machines (FGA-I2VM), which works with huge amounts of both normal and aberrant network data with high detecting accuracy and low false alarm rates. The algorithms chosen for IDM in this stage are machine learning algorithms, which learn, find, and adapt patterns to changing situations over time. Pre-processing is the most essential stage in any IDM, and feature selection is utilized for pre-processing, which is the act of picking a collection or subset of relevant features for the purpose of creating a solution model. Information Gain (IG) is utilized in this FGA-I2VM model to pick features from the dataset for I2VM classification. To train the I2VM classifier, FGA uses three sets of operations to produce a new set of inhabitants with distinct patterns: cross over operation, selection, and finally mutation. The new population is then put into the Import Vector Machine, a strong classifier that has been used to solve a wide range of pattern recognition issues. FGA are quick, especially considering their capacity to discover global optima. Another advantage of FGA is their naturally parallel nature of assessing the individuals within a population. As a classifier, I2VM has self-tuning properties that allow patterns to attain global optimums. The FGA-efficacy I2VM model’s is complemented by information gain, which improves speed and detection accuracy while having a low computing cost

show abstract

“…When A and B are distinct variables with ranges in a1....ak and b1....bk, the uncertainty about A's value is quantified by its entropy in Equation (2).…”

Section: Feature Range Using Igmentioning

confidence: 99%

“…Figure 1: Basic flow of IDS Current IDS have several flaws; there are numerous IDS programs available on the market and on the internet, but the fact remains that they are not entirely capable of detecting all types of assaults [2]. The most widely used intrusion detection tool is Snort.…”

Section: Introductionmentioning

confidence: 99%

Integration of Fuzzy with Incremental Import Vector Machine for Intrusion Detection

Ramamoorthy

Karuppasamy²

2022

INT J COMPUT COMMUN, Int. J. Comput. Commun. Control

View full text Add to dashboard Cite

show abstract

“…Decision tree learning is a target learning classifier and the most popular inference logical model. 76 It takes discrete values as target and threshold values, which is the base of classification. It starts with a root node and then with multiple nodes, where each respective node determines the value of the respective feature or attribute.…”

Section: Decision Tree Classifiermentioning

confidence: 99%

Performance evaluation of machine learning models for distributed denial of service attack detection using improved feature selection and hyper‐parameter optimization techniques

Habib

Khursheed

2022

Concurrency and Computation

View full text Add to dashboard Cite

This article gives the framework of extensive experimentation of various machine learning models to detect distributed denial of service attacks (DDoS). We use six-tier feature ranking methods that use statistical techniques as well as machine learning based classifiers to obtain the significant features. The measurable statistical based feature selection involves Chi-Square (Chi2), information gain (IG), merged Chi-Square (Chi2)-IG ranking and machine learning classifiers involve ensemble classifiers, that is, decision tree, random forest and eXtreme gradient boosting (XGBoost). Different supervised machine learning models (logistic regression, decision tree classifier, linear support vector machine, k-nearest neighbors, Gaussian Naive Bayes, random forest classifier, XGBoost) are trained on a feature-engineered datasets. To further our research, we use neural networks (ANN and CNN) using both feature-selected and auto-feature selection training setup. We check the validation and adaptability of these models with the optimal tuning of various parameters using GridSearchCV and the effectiveness of random sampling in overcoming the class imbalance problem. Based on various feature selection methods, the models are evaluated for their best performance. The experimental results show that our trained machine learning models and neural networks outperformed the ones in the state of art. The performance analysis is done based on confusion matrix scores, that is, accuracy, false alarm rate, sensitivity, specificity, false-positive rate, F1 score, area under curve analysis and loss functions on well-known KDD Cup 99 and UNSW-NB15 datasets. This study is significant for furthering the research in DDoS detection with machine learning and deep neural networks.

show abstract

“…The entropy for every division against the feature is computed [22]. Finally, it is added correspondingly to become overall entropy.…”

Section: Entropy For Two Attributesmentioning

confidence: 99%

“…The tremendous volume of existing and recently appearing network data influenced researchers to use data mining technologies to investigate attacks [16,17,21,23,32]. Currently, various researchers are continuing to develop an effective IDS system for DDoS using a machine learning algorithm [1,3,6,8,12,19,22,30]. This is since data mining methods are suitable for extensive mining of collection of different patterns from a network traffic flow.…”

Section: Introductionmentioning

confidence: 99%

Predictive machine learning-based integrated approach for DDoS detection and prevention

Kebede

Tiwari

et al. 2021

Multimed Tools Appl

View full text Add to dashboard Cite

Distributed Denial of Service attack has been a huge threat to the Internet and may carry extreme losses to systems, companies, and national security. The invader can disseminate Distributed denial of service (DDoS) attacks easily, and it ends up being significantly harder to recognize and forestall DDoS attacks. In recent years, many ITbased companies are attacked by DDoS attacks. In this view, the primary concern of this work is to detect and prevent DDoS attacks. To fulfill the objective, various data mining techniques such that Jrip, J48, and k-NN have been employed for DDoS attacks detection. These algorithms are implemented and thoroughly evaluated individually to validate their performance in this domain. The presented work has been evaluated using the latest dataset CICIDS2017. The dataset characterizes different DDoS attacks viz. brute force SSH, brute force FTP, Heartbleed, infiltration, botnet TCP, UDP, and HTTP with port scan attack. Further, the prevention method takes place in progress to block the malicious nodes participates in any of the said attacks. The proposed DDoS prevention works in a proactive mode to defend all these attack types and gets evaluated concerning various parameters such as Throughput, PDR, End-to-End Delay, and NRL. This study claimed that the proposed technique outperforms with respect to the AODV routing algorithm.

show abstract

IDS for Improving DDoS Attack Recognition Based on Attack Profiles and Network Traffic Features

Cited by 19 publications

References 25 publications

Integration of Fuzzy with Incremental Import Vector Machine for Intrusion Detection

Integration of Fuzzy with Incremental Import Vector Machine for Intrusion Detection

Performance evaluation of machine learning models for distributed denial of service attack detection using improved feature selection and hyper‐parameter optimization techniques

Predictive machine learning-based integrated approach for DDoS detection and prevention

Contact Info

Product

Resources

About