Network traffic fusion and analysis against DDoS flooding attacks with a novel reversible sketch

Jing, Xuyang; Yan, Zheng; Jiang, Xue; Pedrycz, Witold

doi:10.1016/j.inffus.2018.10.013

Cited by 77 publications

(52 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Malicious network behaviors such as DDos and brute force attacks tend to be "mixed into" malicious traffic. Security researchers seek to effectively analyze the malicious traffic in a given network so as to identify potential attacks and quickly stop them [5][6][7][8]. [9], threshold analysis methods [10], and signature analysis methods [11].…”

Section: Related Workmentioning

confidence: 99%

DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System

Sun

Liu

et al. 2020

Security and Communication Networks

139

View full text Add to dashboard Cite

Many studies utilized machine learning schemes to improve network intrusion detection systems recently. Most of the research is based on manually extracted features, but this approach not only requires a lot of labor costs but also loses a lot of information in the original data, resulting in low judgment accuracy and cannot be deployed in actual situations. This paper develops a DL-IDS (deep learning-based intrusion detection system), which uses the hybrid network of Convolutional Neural Network (CNN) and Long Short-Term Memory Network (LSTM) to extract the spatial and temporal features of network traffic data and to provide a better intrusion detection system. To reduce the influence of an unbalanced number of samples of different attack types in model training samples on model performance, DL-IDS used a category weight optimization method to improve the robustness. Finally, DL-IDS is tested on CICIDS2017, a reliable intrusion detection dataset that covers all the common, updated intrusions and cyberattacks. In the multiclassification test, DL-IDS reached 98.67% in overall accuracy, and the accuracy of each attack type was above 99.50%.

show abstract

Section: Related Workmentioning

confidence: 99%

DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System

Sun

Liu

et al. 2020

Security and Communication Networks

139

View full text Add to dashboard Cite

show abstract

“…Third, sketches lack capacity of tracing, which make this kind of methods take the risk of the false positive due to hash collisions. Jing et al [27], [28] proposed novel reversible sketch-based methods based on Chinese Remainder Theorem for collecting and storing network data. They used the compressed data to detect and mitigate amplification attacks and DDoS flooding attacks.…”

Section: Network Data Collectionmentioning

confidence: 99%

“…At present, many flow sampling algorithms have been proposed to guide data collectors to realize the restorable ability of flow distribution when the collected data is compressed. In addition, some algorithms [23], [27] reduce the redundant information of flows based on in-flow sampling. Packet sampling methods are time-sensitive data collection methods, which usually adjust collection strategies at time intervals.…”

Section: E Adaptive Traffic Collection Modulementioning

confidence: 99%

An Adaptive Network Data Collection System in SDN

Zhou

Yan

Liu

et al. 2020

IEEE Trans. Cogn. Commun. Netw.

Self Cite

View full text Add to dashboard Cite

Network data collection is a vital part in the process of network monitoring, traffic billing, network management and intrusion detection. As a new kind of network architecture, Software Defined Network (SDN) provides a possibility of intelligent and adaptive network data collection with centralized control and programming. However, existing literatures lack a concrete solution to economically collect network data, while satisfying the quality of data processing and analytics. Current data collection methods are not sufficiently adaptive and intelligent in terms of network context awareness. In this paper, we propose an adaptive network data collection system in SDN by automatically selecting proper data collection nodes based on network status in a dynamic way. During data collection, network traffic is sampled by considering flow characteristics in order to effectively reduce the amount of collected data while ensuring the accuracy of later data analysis, e.g., malicious traffic detection. A series of experiments are conducted to test and verify the data collection system and show its advantages through comparison with existing works in terms of CPU/memory consumption, storage usage, flow size recovery, and threat perception.

show abstract

“…Researchers have studied DDoS attacks from different perspectives and proposed many approaches to detect and mitigate them [1], [3]- [6], [11]- [18]. Recent research interests have been more concentrated on AL-DDoS attack [2], [7], [19]- [30] for its harmfulness and concealment.…”

Section: Related Workmentioning

confidence: 99%

Identifying Application-Layer DDoS Attacks Based on Request Rhythm Matrices

Lin

Cao

et al. 2019

IEEE Access

View full text Add to dashboard Cite

Application-layer distributed denial of service (AL-DDoS) attacks are becoming critical threats to websites because the stealth of AL-DDoS attacks makes many intrusion prevention systems ineffective. To detect AL-DDoS attacks aimed at websites, we propose a novel statistical model called the RM (rhythm matrix). Although the original features from the network layer are adopted, the access trajectory, including requested objects and corresponding dwell-time values, can be abstracted and accumulated into an RM. With an RM, we can almost losslessly compress complex features into a simple structure and characterize the user access behavior. We detect AL-DDoS attacks according to the increase of the abnormality degree in the RM and further identify malicious hosts based on change-rate outliers. In the experiments, we simulate three modes of AL-DDoS attacks with the latest popular DDoS attack tools: LOIC and HOIC. The results show that our method can detect these simulated attacks and identify the malicious hosts accurately and efficiently. For an AL-DDoS detection method, the ability to distinguish flash crowds is indispensable. We also demonstrate the excellent performance of our approach in distinguishing flash crowds from AL-DDoS attacks with two reconstructed public datasets.

show abstract

Network traffic fusion and analysis against DDoS flooding attacks with a novel reversible sketch

Cited by 77 publications

References 21 publications

DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System

DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System

An Adaptive Network Data Collection System in SDN

Identifying Application-Layer DDoS Attacks Based on Request Rhythm Matrices

Contact Info

Product

Resources

About