Analysis of Machine Learning Classifiers for Early Detection of DDoS Attacks on IoT Devices

High-Speed Network DDoS Attack Detection: A Survey

Having a large number of device connections provides attackers with multiple ways to attack a network. This situation can lead to distributed denial-of-service (DDoS) attacks, which can cause fiscal harm and corrupt data. Thus, irregularity detection in traffic data is crucial in detecting malicious behavior in a network, which is essential for network security and the integrity of modern Cyber-Physical Systems (CPS). Nevertheless, studies have shown that current techniques are ineffective at detecting DDoS attacks on networks, especially in the case of high-speed networks (HSN), as detecting attacks on the latter is very complex due to their fast packet processing. This review aims to study and compare different approaches to detecting DDoS attacks, using machine learning (ML) techniques such as k-means, K-Nearest Neighbors (KNN), and Naive Bayes (NB) used in intrusion detection systems (IDSs) and flow-based IDSs, and expresses data paths for packet filtering for HSN performance. This review highlights the high-speed network accuracy evaluation factors, provides a detailed DDoS attack taxonomy, and classifies detection techniques. Moreover, the existing literature is inspected through a qualitative analysis, with respect to the factors extracted from the presented taxonomy of irregular traffic pattern detection. Different research directions are suggested to support researchers in identifying and designing the optimal solution by highlighting the issues and challenges of DDoS attacks on high-speed networks.

A DDoS Detection Method Based on Feature Engineering and Machine Learning in Software-Defined Networks

Distributed denial-of-service (DDoS) attacks pose a significant cybersecurity threat to software-defined networks (SDNs). This paper proposes a feature-engineering- and machine-learning-based approach to detect DDoS attacks in SDNs. First, the CSE-CIC-IDS2018 dataset was cleaned and normalized, and the optimal feature subset was found using an improved binary grey wolf optimization algorithm. Next, the optimal feature subset was trained and tested in Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbor (k-NN), Decision Tree, and XGBoost machine learning algorithms, from which the best classifier was selected for DDoS attack detection and deployed in the SDN controller. The results show that RF performs best when compared across several performance metrics (e.g., accuracy, precision, recall, F1 and AUC values). We also explore the comparison between different models and algorithms. The results show that our proposed method performed the best and can effectively detect and identify DDoS attacks in SDNs, providing a new idea and solution for the security of SDNs.

Role-Driven Clustering of Stakeholders: A Study of IoT Security Improvement

This study aims to address the challenges of managing the vast amount of data generated by Internet of Things (IoT) devices by categorizing stakeholders based on their roles in IoT security. As the number of connected devices increases, so do the associated security risks, highlighting the need for skilled stakeholders to mitigate these risks and prevent potential attacks. The study proposes a two-part approach, which involves clustering stakeholders according to their responsibilities and identifying relevant features. The main contribution of this research lies in enhancing decision-making processes within IoT security management. The proposed stakeholder categorization provides valuable insights into the diverse roles and responsibilities of stakeholders in IoT ecosystems, enabling a better understanding of their interrelationships. This categorization facilitates more effective decision making by considering the specific context and responsibilities of each stakeholder group. Additionally, the study introduces the concept of weighted decision making, incorporating factors such as role and importance. This approach enhances the decision-making process, enabling stakeholders to make more informed and context-aware decisions in the realm of IoT security management. The insights gained from this research have far-reaching implications. Not only will they benefit stakeholders involved in IoT security, but they will also assist policymakers and regulators in developing effective strategies to address the evolving challenges of IoT security.

Efficient Intelligent Intrusion Detection System for Heterogeneous Internet of Things (HetIoT)

Moving towards a more digital and intelligent world equipped with internet-of-thing (IoT) devices creates many security issues. A distributed denial of service (DDoS) attack is one of the most formidable and challenging security threats that has taken hold with the emergence of the heterogeneous IoT (HetIoT). The massive DDoS attacks have exhibited their impact by continuously destroying a variety of infrastructures, resulting in huge losses, and endangering the overall availability of the digital world. The emphasis of this research is to identify and mitigate various DDoS attacks for HetIoT. The research proposes an intelligent intrusion detection system (IDS) using a convolutional neural network (CNN), i.e., HetIoT-CNN IDS, a novel deep learning-based convolutional neural network for the HetIoT environment. The proposed intelligent IDS successfully identifies and mitigates various DDoS attacks in the HetIoT infrastructure. The feasibility of the new proposed HetIoT-CNN IDS is assessed by considering binary and multi-class (8- and 13-classes) classification. The performance of the proposed intelligent IDS is compared with two state-of-the-art deep learning approaches for HetIoT, and the results reveal that the proposed HetIoT-CNN IDS outperforms it. The proposed HetIoT-CNN IDS successfully identifies various DDoS attacks with an accuracy rate of 99.75% for binary classes, 99.95% for 8-classes, and 99.99% for 13-classes. The work also compares the individual accuracy of binary classes, 8-classes, and 13-classes with state-of-the-art work.