Predicting DOS-DDOS Attacks: Review and Evaluation Study of Feature Selection Methods based on Wrapper Process

Abstract

Now-a-days, Cybersecurity attacks are becoming increasingly sophisticated and presenting a growing threat to individuals, private and public sectors, especially the Denial Of Service attack (DOS) and its variant Distributed Denial Of Service (DDOS). Dealing with these dangerous threats by using traditional mitigation solutions suffers from several limits and performance issues. To overcome these limitations, Machine Learning (ML) has become one of the key techniques to enrich, complement and enhance the traditional security experiences. In this context, we focus on one of the key processes that improve and optimize Machine Learning DOS-DDOS predicting models: DOS-DDOS feature selection process, particularly the wrapper process. By studying different DOS-DDOS datasets, algorithms and results of several research projects, we have reviewed and evaluated the impact on used wrapper strategies, number of DOS-DDOS features, and many commonly used metrics to evaluate DOS-DDOS prediction models based on the optimized DOS-DDOS features. In this paper, we present three important dashboards that are essential to understand the performance of three wrapper strategies commonly used in DOS-DDOS ML systems: heuristic search algorithms, meta-heuristic search and random search methods. Based on this review and evaluation study, we can observe some of wrapper strategies, algorithms, DOS-DDOS features with a relevant impact can be selected to improve the DOS-DDOS ML existing solutions.

Building an Effective Classifier for Phishing Web Pages Detection: A Quantum-Inspired Biomimetic Paradigm Suitable for Big Data Analytics of Cyber Attacks

“…For implementation, each module was embedded into the main model as a black box with its default parameters. See [ 67 , 68 , 69 , 70 , 71 , 72 , 73 ] for more details about the mentioned metaheuristic optimization techniques and their default parameters. As revealed in Table 5 , both GA and ACO have gained better classification accuracy than other algorithms.…”

DDoS Attacks Detection in IoV using ML-based Models with an Enhanced Feature Selection Technique

“…The process of data sampling involves creating a data set by adjusting the number of samples of the majority class in the unbalanced data set and it occupies the largest part while the minority class occupies the smallest part. The sampling method is classified as a reduction or oversampling method, depending on which of the two categories is the number of samples [27].…”

A Flow-Based Anomaly Detection Approach With Feature Selection Method Against DDoS Attacks in SDNs

“…Table VII shows that there are 7 common features (i.e. 3,5,7,8,10,23,31) between the CICIDS2017 and CICIDS2018 in case of using the RF algorithm. However, the InSDN dataset has only 1 common feature (i.e.…”

“…3, 8, 10, 22, 31), while they are combined on six features (i.e. 5, 7,8,10,21,31) in case of CICIDS2018. In a similar way, six features (i.e.…”

“…Motivated by this fact, we apply the DL techniques to temper the problem of DDoS attacks in SDNs. On the other hand, feature selection methods are one of the significant pre-processing phase to success the anomaly detection models [7]. Such techniques can eradicate the irrelevant and redundant features, retaining only the most representative characteristics from the original dataset.…”