Real-time anomaly traffic monitoring based on dynamic k-NN cumulative-distance abnormal detection algorithm

Song, Ruoning; Liu, Fang

doi:10.1109/ccis.2014.7175727

Cited by 10 publications

(3 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The majority of studies have employed machine learning techniques, such as classification, clustering, and prediction. The dynamic K-NN algorithm [7], ARIMA [8], SVD [9], entropy variations [10], PCA [11], MLP [12], and Naive Bayes (NB) [13] algorithms are examples of machine learning techniques.…”

Section: Literaturementioning

confidence: 99%

Enhancing Multi-Class DDoS Attack Classification using Machine Learning Techniques

Mohammad Jawad Kadhim Abood,

Ghassan Hameed Abdul-Majeed

2024

ARASET

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks, which adversely impact network availability, confidentiality, and integrity, represent a persistent threat. These attacks involve affected systems consuming resources through spurious requests instead of serving legitimate clients. Various methodologies exist for detecting and mitigating DDoS attacks, with Machine Learning (ML) emerging as a particularly effective approach due to its predictive capabilities after training on pertinent data. The primary objective of this study is to identify an improved ML algorithm for the detection of multiple DDoS types, considering metrics such as accuracy, precision, recall, and training time. Leveraging WEKA tools and the CICDDoS2019 dataset, several machine-learning algorithms, including Multilayer Perceptron, Reduced Error Pruning (REP) Tree, Partial Decision Tree (PART), RandomForest, and J48, were trained and evaluated. Among these, J48 was determined to be the superior algorithm for classifying four DDoS types (UDP, SYN, Portmap, MSSQL), based on the aforementioned criteria. The algorithms were experimented with using diverse sets of features, and optimal results were obtained using six features, resulting in an overall accuracy of 99.97%. Subsequently, the selected algorithm was integrated into a real-time model, exhibiting exceptional performance, which will be thoroughly elucidated and discussed in a forthcoming paper.

show abstract

Section: Literaturementioning

confidence: 99%

Enhancing Multi-Class DDoS Attack Classification using Machine Learning Techniques

Mohammad Jawad Kadhim Abood,

Ghassan Hameed Abdul-Majeed

2024

ARASET

View full text Add to dashboard Cite

show abstract

“…Recently, the application of machine learning algorithms to detect DDoS attacks in SDN network has been widely studied [3][4][5][6][7][8][9][10][11][12], but there are remaining limitations that need to be studied further, namely: 1) Since each DDoS type has specific properties, different machine learning detection algorithms should be deployed for each DDoS type.…”

Section: Fig 2 Ddos Attacks Classificationmentioning

confidence: 99%

“…In terms of abnormal traffic detection, Song et al [8] proposed a real-time anomaly traffic detection method based on dynamic KNN cumulative-distance anomaly detection algorithm. The authors presented the design and implementation of the method by leveraging STROM, a distributed steam computing technology.…”

Section: Related Workmentioning

confidence: 99%

Untitled

2023

JST: SSAD

View full text Add to dashboard Cite

Software Defined Network (SDN) is a new architecture designed to make the network infrastructure more flexible and easier to manage. It allows network administrators to configure network parameters as well as integrating new functions using programming languages easily. Thanks to the centralized control paradigm, it is easier to collect information of the entire network, which facilitates the implementation of machine learning algorithms to detect anomaly traffic as well as network attacks. Recently, with the development of machine learning and artificial intelligence, several methods have been applied to detect and mitigate Distributed Denial of Service (DDoS) attacks. However, all of activities from monitoring data, detecting and mitigating the attack consume time and resources. To reduce unnecessary redundancy, in this paper, we divide attack detection into two phases, which are anomaly detection phase with lightweight machine learning algorithm and attack detection phase when anomaly behaviors have been detected. This reduces the in-depth analysis of normal traffic and helps to improve the use of computing resources and data transmission efficiency of the network. By setting up a testbed, we have successfully run this model as well as evaluated the accuracy of the model. The results show that our model can detect attacks quickly and accurately.

show abstract

An Improved Parallel Network Traffic Anomaly Detection Method Based on Bagging and GRU

Tao

Peng

Zhao

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Real-time anomaly traffic monitoring based on dynamic k-NN cumulative-distance abnormal detection algorithm

Cited by 10 publications

References 5 publications

Enhancing Multi-Class DDoS Attack Classification using Machine Learning Techniques

Enhancing Multi-Class DDoS Attack Classification using Machine Learning Techniques

Untitled

An Improved Parallel Network Traffic Anomaly Detection Method Based on Bagging and GRU

Contact Info

Product

Resources

About