IoT DoS and DDoS Attack Detection using ResNet

Hussain, Faisal; Abbas, Syed Ghazanfar; Husnain, Muhammad; Fayyaz, Ubaid U.; Shahzad, Farrukh; Shah, Ghalib A.

doi:10.1109/inmic50486.2020.9318216

Cited by 101 publications

(29 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Based on deep learning, Hussain et al [19] used CICDDoS2019 to simulate an IoT system. They developed an IDS with a CNN classifier to detect Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks.…”

Section: Anomaly-based Intrusion Detection Systems (Ads) Related Workmentioning

confidence: 99%

Ensemble Voting-Based Anomaly Detection for a Smart Grid Communication Infrastructure

Alshede¹,

Nassef²,

Alowidi³

et al. 2023

Intelligent Automation &Amp; Soft Computing

View full text Add to dashboard Cite

Advanced Metering Infrastructure (AMI) is the metering network of the smart grid that enables bidirectional communications between each consumer's premises and the provider's control center. The massive amount of data collected supports the real-time decision-making required for diverse applications. The communication infrastructure relies on different network types, including the Internet. This makes the infrastructure vulnerable to various attacks, which could compromise security or have devastating effects. However, traditional machine learning solutions cannot adapt to the increasing complexity and diversity of attacks. The objective of this paper is to develop an Anomaly Detection System (ADS) based on deep learning using the CIC-IDS2017 dataset. However, this dataset is highly imbalanced; thus, a two-step sampling technique: random under-sampling and the Synthetic Minority Oversampling Technique (SMOTE), is proposed to balance the dataset. The proposed system utilizes a multiple hidden layer Auto-encoder (AE) for feature extraction and dimensional reduction. In addition, an ensemble voting based on both Random Forest (RF) and Convolutional Neural Network (CNN) is developed to classify the multiclass attack categories. The proposed system is evaluated and compared with six different state-ofthe-art machine learning and deep learning algorithms: Random Forest (RF), Light Gradient Boosting Machine (LightGBM), eXtreme Gradient Boosting (XGboost), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and bidirectional LSTM (biLSTM). Experimental results show that the proposed model enhances the detection for each attack class compared with the other machine learning and deep learning models with overall accuracy (98.29%), precision (99%), recall (98%), F 1 score (98%), and the UNDetection rate (UND) (8%).

show abstract

Section: Anomaly-based Intrusion Detection Systems (Ads) Related Workmentioning

confidence: 99%

Ensemble Voting-Based Anomaly Detection for a Smart Grid Communication Infrastructure

Alshede¹,

Nassef²,

Alowidi³

et al. 2023

Intelligent Automation &Amp; Soft Computing

View full text Add to dashboard Cite

show abstract

“…Feature selection plays a significant role in the performance of a machine learning model. After preprocessing the data, we applied a Logistic Regression (LR) algorithm due to its efficient implementation in the existing literature [3,18]. Using the LR algorithm, we selected the ten most significant features to train and test the machine learning models: ['frame.time_delta', 'tcp.time_delta', 'tcp.flags.ack', 'tcp.flags.push', 'tcp.flags.reset', 'mqtt.hdrflags', 'mqtt.msgtype', 'mqtt.qos', 'mqtt.retain', 'mqtt.ver'].…”

Section: Features Selectionmentioning

confidence: 99%

“…Therefore, it is very challenging to design a security mechanism for IoT devices. The manufacturing industries are producing a massive amount of IoT products to create low-cost IoT devices in a short period [3,18]. Due to the race to the market for capturing the market as earlier as possible, the manufacturers are giving less importance to the device security [3].…”

Section: Introductionmentioning

confidence: 99%

A Framework for Malicious Traffic Detection in IoT Healthcare Environment

Hussain

Abbas

Shah

et al. 2021

Sensors

Self Cite

141

View full text Add to dashboard Cite

The Internet of things (IoT) has emerged as a topic of intense interest among the research and industrial community as it has had a revolutionary impact on human life. The rapid growth of IoT technology has revolutionized human life by inaugurating the concept of smart devices, smart healthcare, smart industry, smart city, smart grid, among others. IoT devices’ security has become a serious concern nowadays, especially for the healthcare domain, where recent attacks exposed damaging IoT security vulnerabilities. Traditional network security solutions are well established. However, due to the resource constraint property of IoT devices and the distinct behavior of IoT protocols, the existing security mechanisms cannot be deployed directly for securing the IoT devices and network from the cyber-attacks. To enhance the level of security for IoT, researchers need IoT-specific tools, methods, and datasets. To address the mentioned problem, we provide a framework for developing IoT context-aware security solutions to detect malicious traffic in IoT use cases. The proposed framework consists of a newly created, open-source IoT data generator tool named IoT-Flock. The IoT-Flock tool allows researchers to develop an IoT use-case comprised of both normal and malicious IoT devices and generate traffic. Additionally, the proposed framework provides an open-source utility for converting the captured traffic generated by IoT-Flock into an IoT dataset. Using the proposed framework in this research, we first generated an IoT healthcare dataset which comprises both normal and IoT attack traffic. Afterwards, we applied different machine learning techniques to the generated dataset to detect the cyber-attacks and protect the healthcare system from cyber-attacks. The proposed framework will help in developing the context-aware IoT security solutions, especially for a sensitive use case like IoT healthcare environment.

show abstract

“…The work utilizes an offline IDS to collect and analyze information from a variety of IoT networks, as well as to identify DoS attacks on them. Hussain et al [36] have carried out experiments on network attack detection through recognition of DDoS attack patterns using Naïve Bayes method. De Lima Filho et al [37] have performed analysis on DoS/DDoS attack pattern recognition in IoT environment using ResNet.…”

Section: Dos/ddos Attack and Its Counter Measures In Iot Networkmentioning

confidence: 99%

Ping Flood Attack Pattern Recognition Using a K-Means Algorithm in an Internet of Things (IoT) Network

et al. 2021

View full text Add to dashboard Cite

Security is the main challenge in Internet of Things (IoT) systems. The devices on the IoT networks are very heterogeneous, many of them have limited resources, and they are connected globally, which makes the IoT much more challenging to secure than other types of networks. Denial of service (DoS) is the most popular method used to attack IoT networks, either by flooding services or crashing services. Intrusion detection system (IDS) is one of countermeasures for DoS attack. Unfortunately, the existing IDSs are still suffering from detection accuracy problem due to difficulty of recognizing features of the DoS attacks. Thus, we need to determine specific features that representing well the traffic attacks, so the IDS will be able to distinguish normal traffic from the attacks. In this work, we investigate ping flood attack pattern recognition on IoT networks. Experiments were conducted using wireless communication with three different scenarios: normal traffic, attack traffic, and combined normal-attack traffic. Each scenario created an associated dataset. The datasets were then grouped into two clusters: normal and attack. The K-Means algorithm was used to produce the clustering results. The average number of packets in the attack cluster was 95 931 packets, and the average in the normal cluster was 4,068 packets. The accuracy level of the clustering results was calculated using a confusion matrix. The accuracy of the clustering using the implemented K-Means algorithm was 99.94%. The rates from the confusion matrix were true negative (98.62%), true positive (100.00%), false negative (0.00%), and false positive (1.38%).INDEX TERMS Internet of Things (IoT), pattern recognition, ping flood, K-means, clustering.

show abstract

IoT DoS and DDoS Attack Detection using ResNet

Cited by 101 publications

References 13 publications

Ensemble Voting-Based Anomaly Detection for a Smart Grid Communication Infrastructure

Ensemble Voting-Based Anomaly Detection for a Smart Grid Communication Infrastructure

A Framework for Malicious Traffic Detection in IoT Healthcare Environment

Ping Flood Attack Pattern Recognition Using a K-Means Algorithm in an Internet of Things (IoT) Network

Contact Info

Product

Resources

About