SAD-IoT: Security Analysis of DDoS Attacks in IoT Networks

Kumar, Prahlad; Bagga, Harnoor; Netam, Bhuneshwar Singh; Uduthalapally, Venkanna

doi:10.1007/s11277-021-08890-6

Cited by 25 publications

(5 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Kumar et al [11] developed an artificial neural network algorithm with decision trees, random forest, KNN, and naive Bayes algorithms with the Bot-IOT dataset. Later, this algorithm was tested using trafic data from a testbed consisting of 20 IoT devices that had been established.…”

Section: Related Workmentioning

confidence: 99%

IoT-Based Intrusion Detection System Using New Hybrid Deep Learning Algorithm

Yaras,

Dener

2024

Electronics

View full text Add to dashboard Cite

The most significant threat that networks established in IoT may encounter is cyber attacks. The most commonly encountered attacks among these threats are DDoS attacks. After attacks, the communication traffic of the network can be disrupted, and the energy of sensor nodes can quickly deplete. Therefore, the detection of occurring attacks is of great importance. Considering numerous sensor nodes in the established network, analyzing the network traffic data through traditional methods can become impossible. Analyzing this network traffic in a big data environment is necessary. This study aims to analyze the obtained network traffic dataset in a big data environment and detect attacks in the network using a deep learning algorithm. This study is conducted using PySpark with Apache Spark in the Google Colaboratory (Colab) environment. Keras and Scikit-Learn libraries are utilized in the study. ‘CICIoT2023’ and ‘TON_IoT’ datasets are used for training and testing the model. The features in the datasets are reduced using the correlation method, ensuring the inclusion of significant features in the tests. A hybrid deep learning algorithm is designed using one-dimensional CNN and LSTM. The developed method was compared with ten machine learning and deep learning algorithms. The model’s performance was evaluated using accuracy, precision, recall, and F1 parameters. Following the study, an accuracy rate of 99.995% for binary classification and 99.96% for multiclassification is achieved in the ‘CICIoT2023’ dataset. In the ‘TON_IoT’ dataset, a binary classification success rate of 98.75% is reached.

show abstract

Section: Related Workmentioning

confidence: 99%

IoT-Based Intrusion Detection System Using New Hybrid Deep Learning Algorithm

Yaras,

Dener

2024

Electronics

View full text Add to dashboard Cite

show abstract

“…As the pcap files are captured at the mirroring switch, they contain all traffic from the network. Researchers interested in evaluating machine learning (ML) or DL models to detect slow-rate DDoS attacks can use applications such as CICFlowMeter, Tshark, 11 NetMate, 12 or ARGUS [26] to capture network flows from these pcap files and train and evaluate their models.…”

Section: Sdn-slowrate-ddos Datasetmentioning

confidence: 99%

Physical Assessment of an SDN-Based Security Framework for DDoS Attack Mitigation: Introducing the SDN-SlowRate-DDoS Dataset

et al. 2023

View full text Add to dashboard Cite

Slow-read Distributed Denial of Service (DDoS) attacks are complex to detect and mitigate.Although existing tools allow one to identify these attacks, these tools mainly generate alerts. However, in real scenarios, a large number of attack detection alerts will put the security workforce in a bottleneck, as they will not be able to implement mitigation actions in a complete and timely manner. Furthermore, since most existing security solutions for DDoS attack mitigation are tested using datasets and simulated scenarios, their applicability to production networks could be unfeasible or ineffective due to possibly incomplete assumptions in their design. Therefore, automated security solutions against DDoS attacks are needed not only to be designed but also to be implemented and evaluated in real scenarios. This study presents a Software-Defined Networking (SDN)-based security framework, which automates the monitoring, detection, and mitigation of slow-rate DDoS attacks. The framework is implemented in a physical network that uses equipment from the European Experimental Facility Smart Networks for Industry (SN4I). The results demonstrate that the framework effectively mitigates malicious connections, with a mitigation efficiency between 91.66% -100% for different conditions of the number of attackers and victims. In addition, the SDN-SlowRate-DDoS dataset is presented, which contains multiple experiments of slowrate DDoS attacks performed on the real testbed. The resources provided in this security dataset are useful to the scientific and industry communities in designing and testing realistic solutions for intrusion detection systems.INDEX TERMS Dataset, deep learning, slow-rate DDoS, software defined networking (SDN), intrusion detection system (IDS), intrusion prevention system (IPS). CARLOS MARTINEZ-CAGNAZZO received the B.Sc. degree in electrical engineering from Universidad de la Republica, Montevideo, Uruguay, in 1998. He has worked in the internet industry in different roles, including large network design and network security. He is currently the Chief Technical Officer with Latin American Network Address Registry. His research interests include internet measurements, inter-domain routing, BGP security, IPv6, and DNS. He has taught courses on computer networking and cybersecurity and partnered in different research projects trying to bridge the gap between academia and the industry.

show abstract

“…In order to guarantee security from DoS and DDoS attacks, a number of ideas have been put forth in this article. Algorithms for Deep Learning and Machine Learning have both been used to assess DoS and DDoS attacks [11]. For training, the UNSW Canberra Cyber Center's BOT-IOT dataset was utilized.…”

Section: Literature Surveymentioning

confidence: 99%

“…In the evaluation that was presented, the DT and RF algorithms generated the best results, with accuracy results of 99% and 99%, respectively. [11] To guarantee security from DoS and DDoS attacks using ML and DL techniques.…”

Section: Cicddos2019 Knn Svm Nb Dt Rfmentioning

confidence: 99%

A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques

Sadhwani,

Manibalan,

Muthalagu

et al. 2023

Applied Sciences

View full text Add to dashboard Cite

The study in this paper characterizes lightweight IoT networks as being established by devices with few computer resources, such as reduced battery life, processing power, memory, and, more critically, minimal security and protection, which are easily vulnerable to DDoS attacks and propagating malware. A DDoS attack detection model is crucial for attacks in various industries, ensuring the availability and reliability of their networks and systems. The model distinguishes between legitimate and malicious traffic by analyzing network traffic patterns and identifying anomalies. This safeguards critical infrastructure, preserves business continuity, and protects the user experience, minimizing the impact of DDoS attacks. Numerous scholars have studied the notion that protecting lightweight IoT networks essentially requires improving intrusion detection systems. This research is valuable, as it follows a tailored pre-processing methodology specific to IoT network challenges, addressing a pressing need in cybersecurity by focusing on a growing concern related to IoT devices and DDoS attacks, enhancing the security of essential network systems in various industries by effectively detecting DDoS attacks, and developing a lightweight intrusion detection system that aligns with the limited resources of IoT devices. This manuscript proposes a compact and lightweight intrusion detection system that blends machine learning classifiers with a fresh approach to data pre-processing. The handling of missing values, data standardization using Standard Scalar, feature selection using ExtraTreeClassifier wherein only the 15 best features are extracted, and anomaly detection using a classifier are performed. The network dataset of TON-IOT and BOT-IOT datasets is used for experiments, specifically binary classifications and multiple-class classification for the experiment with DDoS and all attacks, respectively. There is an imbalance between the TON-IOT and BOT-IOT attack classes. In trials using the TON-IOT and BOT-IOT datasets, the classes were balanced using several iterations of the SMOTE approach. This research provides a number of classifier types, namely logistic regression, random forest, naïve bayes, artificial neural network, and k nearest neighbor algorithms, which are used to build a lightweight intrusion detection system that is ideally suited for protecting against DDoS attacks in IoT networks. The time taken to train and predict the DDoS attacks is also implemented. Random forest performed well under TON-IOT and naïve bayes performed well under BOT-IOT under binary and multiple-class classification, achieving an accuracy of 100% with less training and prediction time.

show abstract

SAD-IoT: Security Analysis of DDoS Attacks in IoT Networks

Cited by 25 publications

References 22 publications

IoT-Based Intrusion Detection System Using New Hybrid Deep Learning Algorithm

IoT-Based Intrusion Detection System Using New Hybrid Deep Learning Algorithm

Physical Assessment of an SDN-Based Security Framework for DDoS Attack Mitigation: Introducing the SDN-SlowRate-DDoS Dataset

A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques

Contact Info

Product

Resources

About