Detection of Unknown DDoS Attacks with Deep Learning and Gaussian Mixture Model
Source abstract
Abstract
DDoS (Distributed Denial of Service) attacks have become a pressing threat to the security and integrity of computer networks and information systems, which are indispensable infrastructures of modern times. The detection of DDoS attacks is a challenging issue before any mitigation measures can be taken. ML/DL (Machine Learning/Deep Learning) has been applied to the detection of DDoS attacks with satisfactory achievement. However, full-scale success is still beyond reach due to an inherent problem with ML/DL-based systems—the so-called Open Set Recognition (OSR) problem. This is a problem where an ML/DL-based system fails to deal with new instances not drawn from the distribution model of the training data. This problem is particularly profound in detecting DDoS attacks since DDoS attacks’ technology keeps evolving and has changing traffic characteristics. This study investigates the impact of the OSR problem on the detection of DDoS attacks. In response to this problem, we propose a new DDoS detection framework featuring Bi-Directional Long Short-Term Memory (BI-LSTM), a Gaussian Mixture Model (GMM), and incremental learning. Unknown traffic captured by the GMM are subject to discrimination and labeling by traffic engineers, and then fed back to the framework as additional training samples. Using the data sets CIC-IDS2017 and CIC-DDoS2019 for training, testing, and evaluation, experiment results show that the proposed BI-LSTM-GMM can achieve recall, precision, and accuracy up to 94%. Experiments reveal that the proposed framework can be a promising solution to the detection of unknown DDoS attacks.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Electronic Engineering, National Kaohsiung University of Science and Technology, Kaohsiung 807618, Taiwan
Genie Networks Ltd., Taipei 11444, Taiwan
References (25)
Show source-provided references
1. Mahjabin, T., Xiao, Y., Sun, G., and Jiang, W. (2017). A survey of distributed denial-of-service attack, prevention, and mitigation techniques. Int. J. Distrib. Sens. Netw., 13.10.1177/1550147717741463 ↗
2. Genie-Networks (2021, May 06). DDoS Attack Statistics and Trends Report for 2020. Available online: https://www.genie-networks.com/gnnews/ddos-attack-statistics-and-trends-report-for-h1-2020/.
3. Jonker, M., Sperotto, A., and Pras, A. (2020). DDoS Mitigation: A measurement-based approach. NOMS 2020–2020 IEEE/IFIP Network Operations and Management Symposium, IEEE.10.1109/NOMS47738.2020.9110320 ↗
4. Priya, S.S., Sivaram, M., Yuvaraj, D., and Jayanthiladevi, A. (2020, January 12–14). Machine learning based DDoS detection. Proceedings of the 2020 International Conference on Emerging Smart Computing and Informatics, Pune, India.10.1109/ESCI48226.2020.9167642 ↗
5. A survey on deep learning: Algorithms, techniques, and applications
6. Bi-directional Long Short-Term Memory using Quantized data of Deep Belief Networks for Sleep Stage Classification10.1016/j.procs.2017.10.042 ↗
7. Recent advances in open set recognition: A survey
8. Cao, A., Luo, Y., and Klabjan, D. (2020). Open-set recognition with Gaussian mixture variational autoencoders. arXiv, Available online: https://arxiv.org/abs/2006.02003.
9. Cheng, J., Yin, J., Liu, Y., Cai, Z., and Wu, C. (2010, January 24–26). DDoS attack detection using IP address feature interaction. Proceedings of the IEEE International Conference on Intelligent Networking and Collaborative Systems, Thessalonika, Greece.10.1109/INCOS.2009.34 ↗
10. Vu, N.H. (2008, January 16–18). DDoS attack detection using K-Nearest Neighbor classifier method. Proceedings of the International Conference on Telehealth/Assistive Technologies, Baltimore, Maryland, USA.
11. Review of detection DDoS attack detection using Naïve Bayes classifier for network forensics10.11591/eei.v6i2.605 ↗
12. Wang, C., Zheng, J., and Li, X. (2017, January 9–12). Research on DDoS attacks detection based on RDF-SVM. Proceedings of the 10th International Conference on Intelligent Computation Technology and Automation, Changsha, China.10.1109/ICICTA.2017.43 ↗
13. Dincalp, U. (2018, January 19–21). Anomaly based distributed denial of service attack detection and prevention with machine learning. Proceedings of the 2nd International Symposium on Multidisciplinary Studies and Innovative Technologies, Ankara, Turkey.10.1109/ISMSIT.2018.8567252 ↗
14. Ahanger, T.A. (2017, January 22–24). An effective approach of detecting DDoS using artificial neural networks. Proceedings of the 2017 International Conference on Wireless Communications, Signal Processing and Networking, Chennai, India.10.1109/WiSPNET.2017.8299853 ↗
15. Li, Y., and Lu, Y. (2019, January 21–22). LSTM-BA: DDoS detection approach combining LSTM and Bayes. Proceedings of the 7th International Conference on Advanced Cloud and Big Data, Suzhou, China.10.1109/CBD.2019.00041 ↗
16. Yang, K., Zhang, J., Xu, Y., and Chao, J. (2020). DDoS attack detection with AutoEncoder. IEEE/IFIP Operations and Management Symposium, IEEE.10.1109/NOMS47738.2020.9110372 ↗
17. LUCID: A practical, lightweight deep learning solution for DDoS attack detection10.1109/TNSM.2020.2971776 ↗
18. Yong, B., Wei, W., Li, K.-C., Shen, J., Zhou, Q., Wozniak, M., Połap, D., and Damaševičius, R. (2020). Ensemble machine learning approaches for webshell detection in Internet of things environments. Trans. Emerg. Telecommun. Technol., 30.10.1002/ett.4085 ↗
19. Hemalatha, J., Roseline, S.A., Geetha, S., Kadry, S., and Damaševiˇcius, R. (2021). An efficient DenseNet-based deep learning model for malware detection. Entropy, 23.10.3390/e23030344 ↗
20. Bendale, A., and Boult, T.E. (2016, January 27–30). Towards open set deep networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.10.1109/CVPR.2016.173 ↗
21. Sabeel, U., Heydari, S.S., Mohanka, H., Bendhaou, Y., Elgazzar, K., and El-Khatib, K. (2019, January 17–19). Evaluation of deep learning in detecting unknown network attacks. Proceedings of the 2019 International Conference on Smart Applications, Communications and Networking, Sharm El Sheik, Egypt.10.1109/SmartNets48225.2019.9069788 ↗
22. The extreme value machine10.1109/TPAMI.2017.2707495 ↗
23. University of New Brunswick (2021, May 06). Intrusion Detection Evaluation Dataset (CIC-IDS2017). Available online: https://www.unb.ca/cic/datasets/ids-2017.html.
24. University of New Brunswick (2021, May 06). DDoS Evaluation Dataset (CIC-DDoS2019). Available online: https://www.unb.ca/cic/datasets/ddos-2019.html.
25. Canadian Institute for Cybersecurity (2021, May 06). CICFlowMeter (4.0) [Source Code]. Available online: https://github.com/CanadianInstituteForCybersecurity/CICFlowMeter.