Low Rate DDoS Detection Using Weighted Federated Learning in SDN Control Plane in IoT Network

Ali, Muhammad Nadeem; Imran, Muhammad; din, Muhammad Salah ud; Kim, Byung-Seo

doi:10.3390/app13031431

Cited by 35 publications

(13 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The focus shifted to a comparative analysis that highlights the crucial role of human expert intervention in supporting the application of deep learning classifiers (in the context of intrusion detection) in real-world network scenarios. The assessment involved a comprehensive set of parameters, including varying the cluster count (N = [10,20,30,40,50,60]) and adjusting the H-FAR thresholds (θ = [10%, 20%, 30%, 40%, 50%, 60%]) for each cluster to ensure a thorough and robust evaluation. The comparative results derived from the CICDDoS2019, UNSW-NB15, and CICIDS2017 datasets when the human expertise technique was applied and when it was not are comprehensively presented in Figures 7, 8, and 9, respectively.…”

Section: B Evaluation Results: With Human-in-the-loop Techniquementioning

confidence: 99%

See 1 more Smart Citation

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Maiga,

Ataro,

Githinji

2024

IEEE Access

View full text Add to dashboard Cite

Intrusion detection systems (IDS) have seen an increasing number of proposals by researchers utilizing deep learning (DL) to safeguard critical networks. However, they often suffer from high false alarm rates, posing a significant challenge to their deployment in critical networks. This paper presents a comprehensive human-machine framework for mitigating false alarms in DL-based intrusion detection systems. The proposed approach uses probabilistic clustering to enable human-machine collaboration in a synergistic manner. Probabilistic clustering involves regrouping network traffic into clusters based on their probabilities (computed using the DL model). Clusters with high false alarms (H-FAR) are detected, and all traffic falling within them is considered uncertain for efficient classification by the DL model as malicious or benign. They are redirected to human experts to analyze and make a final decision. The proposed framework incorporates a next-generation firewall (NGFW) to help human experts handle the processed traffic efficiently. The proposed framework enhances the performance of DL-based intrusion detection classifiers by reducing false alarms. To validate the proposed concept, assessments were conducted using a customized high-performance convolutional neural network (CNN) and a hybrid recurrent neural network (RNN) model with three open-access benchmark datasets (CICDDoS2019, UNSW-NB15, and CICIDS2017). The evaluation through simulation demonstrated that combining human expertise with deep learning technology can significantly reduce the number of false positives (FNs) and false negatives (FNs) by up to 79.61% and 86.99%, respectively.

show abstract

Section: B Evaluation Results: With Human-in-the-loop Techniquementioning

confidence: 99%

“…The detection and mitigation of low-rate DDoS attacks have been a research focus of Ali et al [20]. A low-rate DDoS can be very difficult to detect because it behaves like normal traffic.…”

Section: Previous Workmentioning

confidence: 99%

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Maiga,

Ataro,

Githinji

2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…The centralized control plane of SDN provides a global view of the network topology, aiding in achieving flexibility and simplifying the complexity of the network nodes. However, the current SDN architecture faces significant security threats [136,137], especially from distributed denial of service (DDoS) attacks. FL offers advantages in terms of real-time responsiveness and adaptability for DDoS detection.…”

Section: Discussionmentioning

confidence: 99%

Decision Tree-Based Federated Learning: A Survey

Wang,

Gai

2024

Blockchains

View full text Add to dashboard Cite

Federated learning (FL) has garnered significant attention as a novel machine learning technique that enables collaborative training among multiple parties without exposing raw local data. In comparison to traditional neural networks or linear models, decision tree models offer higher simplicity and interpretability. The integration of FL technology with decision tree models holds immense potential for performance enhancement and privacy improvement. One current challenge is to identify methods for training and prediction of decision tree models in the FL environment. This survey addresses this issue and examines recent efforts to integrate federated learning and decision tree technologies. We review research outcomes achieved in federated decision trees and emphasize that data security and communication efficiency are crucial focal points for FL. The survey discusses key findings related to data privacy and security issues, as well as communication efficiency problems in federated decision tree models. The primary research outcomes of this paper aim to provide theoretical support for the engineering of federated learning with decision trees as the underlying training model.

show abstract

“…Nadeem Ali et al 81 proposed a Weighted Federated Learning (WFL) model for detecting and mitigating the low‐rate DDoS attack in the SDN control plane for IoT. The proposed model is based on local training of data using ANN to extract the weights of the trained model, which are then shared with the federated server for aggregation.…”

Section: Ml‐based Ddos Detection Methodsmentioning

confidence: 99%

DDoS attacks and machine‐learning‐based detection methods: A survey and taxonomy

Najafimehr

Zarifzadeh

Mostafavi

2023

Engineering Reports

View full text Add to dashboard Cite

Distributed denial of service (DDoS) attacks represent a significant cybersecurity challenge, posing a critical risk to computer networks. Developing an effective defense mechanism against these attacks is crucial but challenging, given their diverse attack types, network and computing platform heterogeneity, and complex communication protocols. Moreover, the emergence of innovative DDoS attack methods presents a formidable threat to existing countermeasures. Various machine learning techniques have shown promise in detecting DDoS attacks with low false‐positive rates and high detection rates. This survey paper offers a comprehensive taxonomy of machine learning‐based methods for detecting DDoS attacks, reviewing supervised, unsupervised, hybrid approaches, and analyzing the related challenges. Further, we explore relevant datasets, highlighting their strengths and limitations, and propose future research directions to address the current gaps in this domain. This paper aims to provide a profound understanding of DDoS attack detection mechanisms, aiding researchers, and practitioners in developing effective cybersecurity approaches against such attacks. This research is essential because DDoS attacks are diverse and pose a formidable threat to computer networks, and various machine learning techniques have shown promise in detecting them. Its implications include providing insights that can inform the development of robust defense mechanisms against DDoS attacks.

show abstract

Low Rate DDoS Detection Using Weighted Federated Learning in SDN Control Plane in IoT Network

Cited by 35 publications

References 29 publications

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Decision Tree-Based Federated Learning: A Survey

DDoS attacks and machine‐learning‐based detection methods: A survey and taxonomy

Contact Info

Product

Resources

About