DDoS detection using active and idle features of revised CICFlowMeter and statistical approaches
Distributed Denial of services (DDoS) attack is one of the most dangerous attacks that targeted servers. The main consequence of this attack is to prevent users from getting their legitimate services by bringing down targeted victim. CICFlowMeter tool generates bi-directional flows from packets. Eac...
| Main Authors: | , , , , |
|---|---|
| Format: | Conference or Workshop Item |
| Published: |
IEEE
2022
|
| _version_ | 1825949102428389376 |
|---|---|
| author | Ali, Basheer Husham Sulaiman, Nasri Al-Haddad, S. A. R. Atan, Rodziah Mohd Hassan, Siti Lailatul |
| author_facet | Ali, Basheer Husham Sulaiman, Nasri Al-Haddad, S. A. R. Atan, Rodziah Mohd Hassan, Siti Lailatul |
| author_sort | Ali, Basheer Husham |
| collection | UPM |
| description | Distributed Denial of services (DDoS) attack is one of the most dangerous attacks that targeted servers. The main consequence of this attack is to prevent users from getting their legitimate services by bringing down targeted victim. CICFlowMeter tool generates bi-directional flows from packets. Each flow generates 83 of different features. The research focuses on 8 features which are active min (f1), active mean (f2), active max (f3), active std (f4), idle min (f5), idle mean (f6), idle max (f7), and idle std (f8). CICFlowMeter tool has several problems that affected on the detection accuracy of DDoS attacks. The idle and active based feature of Shannon entropy and sequential probability ratio test (SE-SPRT) approach was implemented in this research. The problems of original CICFlowMeter were presented, and the differences between original and revised version of CICFlowMeter tool were explored. The DARPA database and confusion matrix were used to evaluate the detection technique and present the comparison between two versions of CICFlowMeter. The detection method detected neptune and smurf attacks and had higher accuracy, f1-score, sensitivity, specificity, and precision when revised version of CICFlowMeter used to generate flows. However, the detection method failed to detect neptune attack and had higher miss-rate, lower accuracy, lower f1-score, and lower specificity, and lower precision when original version used in generating flows. |
| first_indexed | 2024-03-06T08:39:24Z |
| format | Conference or Workshop Item |
| id | upm.eprints-37800 |
| institution | Universiti Putra Malaysia |
| last_indexed | 2024-03-06T08:39:24Z |
| publishDate | 2022 |
| publisher | IEEE |
| record_format | dspace |
| spelling | upm.eprints-378002023-11-07T09:02:58Z http://psasir.upm.edu.my/id/eprint/37800/ DDoS detection using active and idle features of revised CICFlowMeter and statistical approaches Ali, Basheer Husham Sulaiman, Nasri Al-Haddad, S. A. R. Atan, Rodziah Mohd Hassan, Siti Lailatul Distributed Denial of services (DDoS) attack is one of the most dangerous attacks that targeted servers. The main consequence of this attack is to prevent users from getting their legitimate services by bringing down targeted victim. CICFlowMeter tool generates bi-directional flows from packets. Each flow generates 83 of different features. The research focuses on 8 features which are active min (f1), active mean (f2), active max (f3), active std (f4), idle min (f5), idle mean (f6), idle max (f7), and idle std (f8). CICFlowMeter tool has several problems that affected on the detection accuracy of DDoS attacks. The idle and active based feature of Shannon entropy and sequential probability ratio test (SE-SPRT) approach was implemented in this research. The problems of original CICFlowMeter were presented, and the differences between original and revised version of CICFlowMeter tool were explored. The DARPA database and confusion matrix were used to evaluate the detection technique and present the comparison between two versions of CICFlowMeter. The detection method detected neptune and smurf attacks and had higher accuracy, f1-score, sensitivity, specificity, and precision when revised version of CICFlowMeter used to generate flows. However, the detection method failed to detect neptune attack and had higher miss-rate, lower accuracy, lower f1-score, and lower specificity, and lower precision when original version used in generating flows. IEEE 2022 Conference or Workshop Item PeerReviewed Ali, Basheer Husham and Sulaiman, Nasri and Al-Haddad, S. A. R. and Atan, Rodziah and Mohd Hassan, Siti Lailatul (2022) DDoS detection using active and idle features of revised CICFlowMeter and statistical approaches. In: 2022 Fourth International Conference on Advanced Science and Engineering (4th ICOASE), 21-22 Sept. 2022, Zakho - Duhok, Kurdistan Region, Iraq. (pp. 148-153). https://ieeexplore.ieee.org/document/10075591 10.1109/ICOASE56293.2022.10075591 |
| spellingShingle | Ali, Basheer Husham Sulaiman, Nasri Al-Haddad, S. A. R. Atan, Rodziah Mohd Hassan, Siti Lailatul DDoS detection using active and idle features of revised CICFlowMeter and statistical approaches |
| title | DDoS detection using active and idle features of revised CICFlowMeter and statistical approaches |
| title_full | DDoS detection using active and idle features of revised CICFlowMeter and statistical approaches |
| title_fullStr | DDoS detection using active and idle features of revised CICFlowMeter and statistical approaches |
| title_full_unstemmed | DDoS detection using active and idle features of revised CICFlowMeter and statistical approaches |
| title_short | DDoS detection using active and idle features of revised CICFlowMeter and statistical approaches |
| title_sort | ddos detection using active and idle features of revised cicflowmeter and statistical approaches |
| work_keys_str_mv | AT alibasheerhusham ddosdetectionusingactiveandidlefeaturesofrevisedcicflowmeterandstatisticalapproaches AT sulaimannasri ddosdetectionusingactiveandidlefeaturesofrevisedcicflowmeterandstatisticalapproaches AT alhaddadsar ddosdetectionusingactiveandidlefeaturesofrevisedcicflowmeterandstatisticalapproaches AT atanrodziah ddosdetectionusingactiveandidlefeaturesofrevisedcicflowmeterandstatisticalapproaches AT mohdhassansitilailatul ddosdetectionusingactiveandidlefeaturesofrevisedcicflowmeterandstatisticalapproaches |