Low-Rate DoS Attack Detection Using PSD Based Entropy and Machine Learning

Zhang, Naiji; Jaafar, Fehmi; Malik, Yasir

doi:10.1109/cscloud/edgecom.2019.00020

Cited by 43 publications

(21 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, instantiating containers according to the amount of traffic required by users affects directly in processing power and memory consumption of the overall system. Zhang et al [36] provided a low-rate attack detection using Power Spectral Density (PSD) entropy and Support Vector Machines (SVM). They argued that PSD-entropy has lowcomputation cost and improves detection and efficiency of the system.…”

Section: Related Workmentioning

confidence: 99%

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

et al. 2020

View full text Add to dashboard Cite

While there have been extensive studies of denial of service (DoS) attacks and DDoS attack mitigation, such attacks remain challenging to mitigate. For example, Low-Rate DDoS (LR-DDoS) attacks are known to be difficult to detect, particularly in a software-defined network (SDN). Hence, in this paper we present a flexible modular architecture that allows the identification and mitigation of LR-DDoS attacks in SDN settings. Specifically, we train the intrusion detection system (IDS) in our architecture using six machine learning (ML) models (i.e., J48, Random Tree, REP Tree, Random Forest, Multi-Layer Perceptron (MLP), and Support Vector Machines (SVM)) and evaluate their performance using the Canadian Institute of Cybersecurity (CIC) DoS dataset. The findings from the evaluation demonstrate that our approach achieves a detection rate of 95%, despite the difficulty in detecting LR-DoS attacks. We also remark that in our deployment, we use the open network operating system (ONOS) controller running on Mininet virtual machine in order for our simulated environment to be as close to real-world production networks as possible. In our testing topology, the intrusion prevention detection system mitigates all attacks previously detected by the IDS system. This demonstrates the utility of our architecture in identifying and mitigating LR-DDoS attacks. INDEX TERMS DDoS attack mitigation, Low-rate DDoS (LR-DDoS) attacks, Machine learning, Software-defined network (SDN).

show abstract

Section: Related Workmentioning

confidence: 99%

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

et al. 2020

View full text Add to dashboard Cite

show abstract

“…However, the authors created real-world datasets by using tools to stimulate normal and attacker traffic; and no accuracy measurement was provided in the proposed work for a comparison with other related work. Zhang et al [50] proposed a DDoS detection model that uses two algorithms, namely the power spectral density (PSD) and SVM algorithms, for low-rate DDoS attack classifications. The PSD algorithm calculates the entropy and then compares it with two predefined thresholds.…”

Section: Ddos Defense Systems Based On ML Approaches In Traditiomentioning

confidence: 99%

Machine Learning Approaches for Combating Distributed Denial of Service Attacks in Modern Networking Environments

Aljuhani

2021

IEEE Access

View full text Add to dashboard Cite

“…Chen proposed the Fourier-Robust RED (FRRED) algorithm to detect LDoS attacks by implementing an active queue management system using Power Spectral Density (PSD) entropy [20]. Zhang et al presented a detection algorithm that combines the PSD entropy function and support vector machine to distinguish LDoS traffic from normal traffic [21]. A factorisation machine-based LDDoS detection algorithm is put forward in reference [22].…”

Section: Related Workmentioning

confidence: 99%

Is low‐rate distributed denial of service a great threat to the Internet?

Chen

Wei

et al. 2021

IET Information Security

View full text Add to dashboard Cite

Low-rate Distributed Denial of Service (LDDoS) attacks, in which the attackers send packets to a victim at a sufficiently low rate to avoid being detected, are considered to be a subtype of DDoS attacks and a potential threat to Internet security. However, an overwhelming attack paradigm on the Internet has rarely been reported due to the harsh requirements for launching LDDoS attacks; therefore, most existing LDDoS attacks are constructed and evaluated through theoretical deduction and/or simulation tests. In this backdrop, the authors aim to figure out what the conditions for launching a successful LDDoS attack are, and how harmful an attack could be. They first analyse the characteristics of LDDoS attacks, and derive the conditions and parameters for initiating LDDoS attacks using a queuing model. Based on the analysis results, an LDDoS algorithm is presented. Then, an LDDoS validation prototype is built on a Network Function Virtualization network to validate the derived parameters and conditions. Finally, a series of experiments are conducted on the testbed, and the results show that a successful LDDoS attack could be achieved based on the derived algorithm; however, its attack effect only lasts for a short time compared with its DDoS counterparts.This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

show abstract

Low-Rate DoS Attack Detection Using PSD Based Entropy and Machine Learning

Cited by 43 publications

References 3 publications

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

Machine Learning Approaches for Combating Distributed Denial of Service Attacks in Modern Networking Environments

Is low‐rate distributed denial of service a great threat to the Internet?

Contact Info

Product

Resources

About