Using the Cumulative Sum Algorithm Against Distributed Denial of Service Attacks in Internet of Things

Machaka, Pheeha; McDonald, Andre; Nelwamondo, Fulufhelo V.; Bagula, Antoine

doi:10.1007/978-3-319-29236-6_7

Cited by 10 publications

(6 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Others researchers [82] investigated the possibility of applying Cumulative Sum (CUMSUM) algorithm in order to detect DDoS attacks in the context of IoT. The main aim of CUSUM algorithm is to detect real time changes in statistic process issued from data streams.…”

Section: Iot Dos/ddos Countermeasure Approachesmentioning

confidence: 99%

Internet of things security: A top-down survey

2018

View full text Add to dashboard Cite

Internet of Things (IoT) is one of the promising technologies that has attracted a lot of attention in both industrial and academic fields these years. It aims to integrate seamlessly both physical and digital worlds in one single ecosystem that makes up a new intelligent era of Internet. This technology offers a huge business value for organizations and provides opportunities for many existing applications such as energy, healthcare and other sectors. However, as new emergent technology, IoT suffers from several security issues which are most challenging than those from other fields regarding its complex environment and resources-constrained IoT devices. A lot of researches have been initiated in order to provide efficient security solutions in IoT, particularly to address resources constraints and scalability issues. Furthermore, some technologies related to networking and cryptocurrency fields such as Software Defined Networking (SDN) and Blockchain are revolutionizing the world of the Internet of Things thanks to their efficiency and scalability. In this paper, we provide a comprehensive top down survey of the most recent proposed security and privacy solutions in IoT. We discuss particularly the benefits that new approaches such as blockchain and Software Defined Networking can bring to the security and the privacy in IoT in terms of flexibility and scalability. Finally, we give a general classification of existing solutions and comparison based on important parameters.

show abstract

Section: Iot Dos/ddos Countermeasure Approachesmentioning

confidence: 99%

Internet of things security: A top-down survey

2018

View full text Add to dashboard Cite

show abstract

“…The CUMSUM method estimates the cumulative sum of the difference between an input sequence's actual and expected values, which is then compared to a threshold value [102]. A CUMSUM value above the threshold signifies a change in statistical features in the network traffic over time series.…”

Section: Statistical Forecasting Modelsmentioning

confidence: 99%

“…The results of the simulation showed that TCP-SYN flooding may be accurately detected with a low false alarm ratio and a high detection ratio. In the research study presented in [102], the authors investigated the use of CUMSUM for detecting DDoS attacks in an IoT network. The algorithm has a good detection rate for high-rate attacks but is poor for low-intensity attacks.…”

Section: Statistical Forecasting Modelsmentioning

confidence: 99%

DDoS Attack and Detection Methods in Internet-Enabled Networks: Concept, Research Perspectives, and Challenges

Adedeji

Abu‐Mahfouz

Kurien

2023

JSAN

View full text Add to dashboard Cite

In recent times, distributed denial of service (DDoS) has been one of the most prevalent security threats in internet-enabled networks, with many internet of things (IoT) devices having been exploited to carry out attacks. Due to their inherent security flaws, the attacks seek to deplete the resources of the target network by flooding it with numerous spoofed requests from a distributed system. Research studies have demonstrated that a DDoS attack has a considerable impact on the target network resources and can result in an extended operational outage if not detected. The detection of DDoS attacks has been approached using a variety of methods. In this paper, a comprehensive survey of the methods used for DDoS attack detection on selected internet-enabled networks is presented. This survey aimed to provide a concise introductory reference for early researchers in the development and application of attack detection methodologies in IoT-based applications. Unlike other studies, a wide variety of methods, ranging from the traditional methods to machine and deep learning methods, were covered. These methods were classified based on their nature of operation, investigated as to their strengths and weaknesses, and then examined via several research studies which made use of each approach. In addition, attack scenarios and detection studies in emerging networks such as the internet of drones, routing protocol based IoT, and named data networking were also covered. Furthermore, technical challenges in each research study were identified. Finally, some remarks for enhancing the research studies were provided, and potential directions for future research were highlighted.

show abstract

“…CUSUM is actually the mean value of the cumulative sum of deviations from a reference µ, that represents a periodically updated value calculated in real time [33,41]. In addition, if the S i is the i-th cumulative sum, x n is the n-th observation, and µ is the mean of the process estimated in real time, then the cumulative sum S i can be calculated as follows:…”

Section: • Cumulative Sum Algorithmmentioning

confidence: 99%

Triple Modular Redundancy Optimization for Threshold Determination in Intrusion Detection Systems

Babic¹,

Miljković²,

Čabarkapa

et al. 2021

Symmetry

View full text Add to dashboard Cite

This paper presents a novel approach for an Intrusion Detection System (IDS) based on one kind of asymmetric optimization which use any three already well-known IDS algorithms and Triple Modular Redundancy (TMR) algorithm together. Namely, a variable threshold which indicates an attack on an observed and protected network is determined by using all three values obtained with three known IDS algorithms i.e., on previously recorded data by making a decision by majority. For these algorithms authors used algorithm of k-nearest neighbors, cumulative sum algorithm, and algorithm of exponentially weighted moving average. Using a proposed method we can get a threshold that is more precisely determined than in the case of any method individual. Practically, using TMR we obtain a dynamically threshold adjustment of IDS software, which reduces the existence of false alarms and undetected attacks, so the efficiency of such IDS software is notably higher and can get better results. Today, Denial of Service attacks (DoS) are one of the most present type of attacks and the reason for the special attention paid to them in this paper. In addition, the authors of the proposed method for IDS software used a known CIC-DDoS2019 dataset, which contains various data recordings of such attacks. Obtained results with the proposed solution showed better characteristics than each individual used algorithm in this solution. IDS software with the proposed method worked precisely and timely, which means alarms were triggered properly and efficiently.

show abstract

Using the Cumulative Sum Algorithm Against Distributed Denial of Service Attacks in Internet of Things

Cited by 10 publications

References 20 publications

Internet of things security: A top-down survey

Internet of things security: A top-down survey

DDoS Attack and Detection Methods in Internet-Enabled Networks: Concept, Research Perspectives, and Challenges

Triple Modular Redundancy Optimization for Threshold Determination in Intrusion Detection Systems

Contact Info

Product

Resources

About