Real-time DDoS flood attack monitoring and detection (RT-AMD) model for cloud computing

Abstract

In recent years, the advent of cloud computing has transformed the field of computing and information technology. It has been enabling customers to rent virtual resources and take advantage of various on-demand services with the lowest costs. Despite the advantages of cloud computing, it faces several threats; an example is a distributed denial of service (DDoS) attack, which is considered among the most serious. This article presents real-time monitoring and detection of DDoS attacks on the cloud using a machine learning approach. Naïve Bayes, K-nearest neighbor, decision tree, and random forest machine learning classifiers have been selected to build a predictive model named “Real-Time DDoS flood Attack Monitoring and Detection RT-AMD.” The DDoS-2020 dataset was constructed with 70,020 records to evaluate RT-AMD’s accuracy. The DDoS-2020 contains three protocols for network/transport-level, which are TCP, DNS, and ICMP. This article evaluates the proposed model by comparing its accuracy with related works. Our model has shown improvement in the results and reached real-time attack detection using incremental learning. The model achieved 99.38% accuracy for the random forest in real-time on the cloud environment and 99.39% on local testing. The RT-AMD was evaluated on the NSL-KDD dataset as well, in which it achieved 99.30% accuracy in real-time in a cloud environment.

A Deep Learning Approach for Intrusion Detection Systems in Cloud Computing Environments

“…The field of intrusion detection systems is widely studied in the literature. Some research papers, such as [15][16][17], cover the use of ML and DL to improve the network security of cloud computing.…”

“…In [16], the authors demonstrate a proposed real-time monitoring and detection "RT-AMD" of DDoS attacks on cloud computing using machine learning algorithms and an intrusion detection system, which uses anomaly-based detection. They selected machine learning classifiers of naïve Bayes (NB), decision tree (DT), k-neighbors (KN), and random forest (RF) to build a predictive model and compare them by two primary criteria: accuracy and detection rate.…”

Torrent Poisoning Protection with a Reverse Proxy Server

“…Peer-to-peer file-sharing systems are still the most popular method for any type of content sharing over the internet, especially using the BitTorrent protocol. Like any other technology using the internet, it is vulnerable to attacks, suffering from different kinds of denial-of-service attacks, such as query flooding and pollution [3]. For example, in the content pollution attack, a malicious user publishes a large number of decoys (same or similar meta-data) so that queries of a given content return predominantly fake/corrupted copies [4].…”