Windower: Feature Extraction for Real-Time DDoS Detection Using Machine Learning

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F63839172%3A_____%2F24%3A10133620" target="_blank" >RIV/63839172:_____/24:10133620 - isvavai.cz</a>

Výsledek na webu

<a href="https://ieeexplore.ieee.org/document/10575699" target="_blank" >https://ieeexplore.ieee.org/document/10575699</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/NOMS59830.2024.10575699" target="_blank" >10.1109/NOMS59830.2024.10575699</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Windower: Feature Extraction for Real-Time DDoS Detection Using Machine Learning

Popis výsledku v původním jazyce

Distributed Denial of Service (DDoS) attacks are an ever-increasing type of security incident on modern computer networks. To tackle the issue, we propose Windower, a feature-extraction method for real-time network-based intrusion (particularly DDoS) detection. Our stream data mining module employs a sliding window principle to compute statistical information directly from network packets. Furthermore, we summarize several such windows and compute inter-window statistics to increase detection reliability. Summarized statistics are then fed into an ML-based attack discriminator. If an attack is recognized, we drop the consequent attacking source&apos;s traffic using simple ACL rules. The experimental results evaluated on several datasets indicate the ability to reliably detect an ongoing attack within the first six seconds of its start and mitigate 99 % of flood and 92 % of slow attacks while maintaining false positives below 1 %. In contrast to state-of-the-art, our approach provides greater flexibility by achieving high detection performance and low resources as flow-based systems while offering prompt attack detection known from packet-based solutions. Windower thus brings an appealing trade-off between attack detection performance, detection delay, and computing resources suitable for real-world deployments.

Název v anglickém jazyce

Windower: Feature Extraction for Real-Time DDoS Detection Using Machine Learning

Popis výsledku anglicky

Distributed Denial of Service (DDoS) attacks are an ever-increasing type of security incident on modern computer networks. To tackle the issue, we propose Windower, a feature-extraction method for real-time network-based intrusion (particularly DDoS) detection. Our stream data mining module employs a sliding window principle to compute statistical information directly from network packets. Furthermore, we summarize several such windows and compute inter-window statistics to increase detection reliability. Summarized statistics are then fed into an ML-based attack discriminator. If an attack is recognized, we drop the consequent attacking source&apos;s traffic using simple ACL rules. The experimental results evaluated on several datasets indicate the ability to reliably detect an ongoing attack within the first six seconds of its start and mitigate 99 % of flood and 92 % of slow attacks while maintaining false positives below 1 %. In contrast to state-of-the-art, our approach provides greater flexibility by achieving high detection performance and low resources as flow-based systems while offering prompt attack detection known from packet-based solutions. Windower thus brings an appealing trade-off between attack detection performance, detection delay, and computing resources suitable for real-world deployments.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/LM2023054" target="_blank" >LM2023054: e-Infrastruktura CZ</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2024

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

PROCEEDINGS OF 2024 IEEE/IFIP NETWORK OPERATIONS AND MANAGEMENT SYMPOSIUM, NOMS 2024

ISBN

979-8-3503-2793-9

ISSN

1542-1201

e-ISSN

—

Počet stran výsledku

10

Strana od-do

1-10

Název nakladatele

IEEE

Místo vydání

Seoul, Republic of Korea

Místo konání akce

Seoul, South Korea

Datum konání akce

6. 5. 2024

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

001270140300170