Evaluating Machine Learning and Deep Learning Models for Enhanced DDoS Attack Detection

The study at hand notably advances the field of DDoS detection by building upon prior research. While previous studies have recognized the potential of deep learning and ensemble machine learning models in enhancing the accuracy and robustness of DDoS detection, this research marks a pioneering effort in integrating these two methodologies to formulate a comprehensive detection system. It addresses the limitations inherent in individual models by employing a synergistic approach, combining ensemble methods with deep learning techniques. This integration not only augments the detection capabilities but also introduces a more robust method for identifying DDoS attacks than relying solely on either approach. Moreover, this research extends beyond previous works by placing significant emphasis on feature engineering. Recognizing the importance of a representative and balanced training dataset, this study meticulously approaches data cleaning and enhancement. Prior research has acknowledged the necessity of a high-quality dataset for accurate DDoS detection; however, this study introduces a comprehensive methodology to ensure dataset quality, a critical factor for precise detection. By meticulously addressing the dataset's quality, this research provides a robust foundation for the proposed models, contributing a vital aspect to the domain of DDoS attack detection.

2.png

Figure 2. Schematic representation of the Bi-LSTM model for detecting DDoS [1]

DDoS attacks, known for causing service disruptions, financial losses, and reputational damage, pose a severe threat to network security. Traditional detection solutions, predominantly based on rule-based methodologies and signature matching, struggle to adapt to evolving attack tactics. To counter this challenge, the integration of ensemble machine learning and deep learning models has emerged as a promising solution, enhancing detection accuracy and robustness. Ensemble models, distinct from deep learning models, combine predictions from various base models, while deep learning models employ neural networks to autonomously recognize and extract complex patterns from network traffic data. Zhang et al. [1] proposed a bidirectional long short-term memory (BiLSTM)-based methodology for detecting DDoS attacks within edge computing environments. The BiLSTM model, proficient in capturing temporal relationships within data, is trained using network traffic information. This approach has demonstrated reliability in detecting DDoS attacks, a fact exemplified in Figure 2. Liu et al. [2] delved into the development of a DDoS detection method tailored for Software-Defined Networks (SDNs), employing machine learning algorithms. This method effectively discerns DDoS attacks in SDN systems by extracting pertinent data from network traffic and deploying machine learning models to differentiate between legitimate and malicious traffic.

Varghese and Muniyal [3] introduced a comprehensive framework for an Intrusion Detection System (IDS) to identify DDoS attacks in SDN environments. This framework integrates traffic analysis, anomaly detection, and machine learning algorithms, thereby equipping it to recognize and mitigate DDoS attacks in SDN infrastructures. Mikhail et al. [4] suggested a machine learning-based technique for DDoS attack detection, which combines the random forest (RF) feature importance method with mutual information. This technique proficiently identifies DDoS attacks by analyzing patterns in network traffic data, assessing feature relevance through mutual information, and implementing a RF classifier.

Ali et al. [5] discussed the increased susceptibility of SDNs to DDoS attacks, attributed to their dynamic nature and centralized control. Traditional DDoS detection methods in SDNs are critiqued for their inadequacies, highlighting the imperative need for advanced machine learning techniques to augment detection accuracy and mitigate attack impacts. This detailed investigation evaluates various machine learning approaches for identifying DDoS attacks in SDN environments. The study categorizes these techniques into supervised and unsupervised learning models, examining their respective strengths and limitations within the context of SDN. The investigation encompasses a range of techniques, including support vector machine (SVM), RF, artificial neural networks (ANNs), and deep learning models such as CNNs and RNNs. Mansoor et al. [6] underscored the escalating threat of DDoS attacks on SDN controllers, noting their potential to compromise network security and disrupt operations. The limitations of conventional detection systems are highlighted, with the authors advocating for the adoption of deep learning approaches to refine the precision and efficacy of DDoS detection. Specifically, the utilization of CNNs is proposed for analyzing network traffic data to detect patterns indicative of DDoS attacks. The authors elaborate on the architecture and design of the CNN-based detection system, encompassing preprocessing stages, feature extraction, and model training. An empirical study is conducted using a publicly available DDoS dataset, with the findings compared against existing detection methodologies. Key performance metrics such as recall, accuracy, precision, and F1-score are employed to validate the effectiveness of the deep learning-based approach in accurately identifying DDoS attacks.

Yaser et al. [7] addressed the escalating threat of DDoS attacks and the urgent need for effective detection systems. An innovative architecture is proposed, combining feedforward and deep neural networks, and utilizing the autoencoder concept to enhance DDoS detection. This novel approach involves training feedforward and deep neural networks as autoencoders with benign network traffic data. These models are designed to discern underlying patterns and features by reconstructing the input data. During the detection phase, significant deviations between the reconstructed data and the original input signal the presence of DDoS attacks. Furthermore, the dynamic and programmable nature of SDNs renders them vulnerable to a spectrum of attacks. The authors discussed the challenges inherent in detecting DDoS attacks within SDN environments. A hybrid approach was suggested, amalgamating the benefits of autoencoders with one-class SVMs to detect DDoS attacks while minimizing false positives. The method involves training an autoencoder with standard network traffic data to learn patterns and features. The reconstruction error is then computed by rebuilding the input data using the autoencoder. A threshold based on the reconstruction error is established to distinguish between regular traffic and DDoS attacks [8]. The reconstructed data is further analyzed using a one-class SVM, trained on standard traffic data, to identify deviations from normal patterns. This combination of autoencoder and one-class SVM offers a robust and precise detection mechanism for DDoS attacks in SDN contexts.

Sumathi et al. [9] recognized the increasing threat of DDoS attacks and the necessity for efficient detection systems to safeguard network infrastructures. The potential of deep learning models and RNNs for detecting and mitigating DDoS attacks is explored. The study provides a comprehensive overview of DDoS attacks, delineating their characteristics and impact on network performance. It also critiques conventional detection methods and underscores the advantages of employing RNNs and deep learning models for DDoS attack detection. The research introduces long short-term memory (LSTM) and CNN models based on neural networks. The LSTM model is proficient in capturing temporal dependencies and sequential patterns in network traffic data, whereas the CNN model is focused on extracting spatial features from packet payloads.

Table 1. Comparison of several methodologies

The study provides a comprehensive summary of various deep learning architectures employed in the detection of DDoS attacks. It encompasses an array of models including LSTM, Autoencoders, CNNs, RNNs, and generative adversarial networks (GANs). Each methodology is described, with a focus on its specific advantages in identifying DDoS attacks. The report elucidates on the evaluation metrics used to assess the effectiveness of these deep learning models in DDoS detection. Common metrics such as accuracy, precision, recall, F1-score, and the area under the Receiver Operating Characteristic curve (AUC-ROC) are detailed. The literature review includes findings from various experimental studies that have applied deep learning techniques to detect DDoS attacks. It presents results from this body of research, outlining the efficacy of different deep learning models and offering a comparative analysis of their outcomes [10]. This comparison is instrumental in elucidating the relative strengths and weaknesses of each model in the context of DDoS attack detection (Table 1).

This section presents an exploration and development of a machine learning-based methodology for the detection of DRDoS within DNS environments, utilizing a meticulously curated dataset. The detection model, underpinning this research, underwent comprehensive training, testing, and evaluation phases using this dataset. Despite the absence of explicit dataset details in the referenced link, the publication is presumed to delineate the dataset's characteristics and composition [22]. The dataset is characterized by the following attributes:

• Dataset characteristics and composition: The dataset is inferred to be composed of DNS logs and real-world network traffic data, sourced from diverse network configurations. This composition ensures diversity and enhances the generalizability of the model.
• Dataset specification: The study likely delineates the dataset's size, encompassing the number of samples (network traffic incidents) and features (attributes) per sample. The significance of a sizable dataset for effective training of machine learning models is acknowledged.
• Attributes: It is anticipated that the dataset comprises a multitude of attributes extracted from DNS logs and network traffic, encompassing various aspects of DNS packet behavior and communication patterns.
• Labeling: The dataset is expected to be categorized, with samples distinctly labeled as part of a DRDoS DNS attack or regular traffic. Such labeling is crucial for the application of supervised machine learning techniques in training the detection model.
• Data preprocessing: The preprocessing steps employed for refining, normalizing, and transforming the dataset into a format amenable to machine learning algorithms are likely detailed in the study.
• Data segmentation: A typical approach involves dividing the dataset into training, validation, and testing subsets. This division, adhering to a specific ratio, facilitates an unbiased evaluation of the model's performance.
• Evaluation metrics: The study is expected to elaborate on the evaluation metrics used, such as accuracy, precision, recall, F1-score, and AUC-ROC, to assess the efficacy of the detection model.

The study is expected to provide an exhaustive description of the dataset attributes, including diverse network traffic scenarios and types of DNS attacks, along with any data privacy concerns. Such detailed documentation is pivotal in fostering reproducibility and further research in network security and DRDoS DNS attack detection. Utilizing scikit-learn's train_test_split function, the dataset is bifurcated into training and testing sets. The target (label) is binary, classified as DrDoS_DNS=1 and BENIGN=0, with the test set constituting 20% of the total data. Repeatability is ensured through the use of a predetermined random seed (random_state). A range of models, including decision tree (DT), SVM, RF, CNN, and transfer learning with AlexNet, are applied in the proposed detection approach.

The RF classifier's predictions are quantified for accuracy, and this metric is stored in the variable RF_accuracy. Post the discovery of optimal hyperparameters, a new SGD classifier is trained, and its efficacy is evaluated using the test data, culminating in the determination of model accuracy with these hyperparameters. SVM models are subjected to testing with different kernels on a test dataset to ascertain their performance. The accuracy of each model is tracked, and the kernel yielding the highest accuracy is identified. The SVM model with this optimal kernel is then retrained using all training data, and its final accuracy is presented. A 1D CNN, tailored for the binary classification task, is deployed. It utilizes convolutional and pooling operations on input data of dimensions (15, 1), followed by fully connected layers for outcome prediction. The model is developed and trained employing suitable loss and optimization methods for the DRDoS detection task. A binary classification neural network, akin to AlexNet, is prepared using binary cross-entropy loss and the Adam optimizer. The model is trained on the training data and evaluated on various metrics, including accuracy, using the test data.

The performance of various models including CNN 1D, Alex Net, SGD, SVM, and logistic regression (LR) is quantified using standard metrics such as accuracy, precision, recall, and F1-score. These metrics are fundamental in evaluating the models' prediction capabilities:

• Accuracy is measured as the ratio of correctly predicted instances to the total number of instances, reflecting the overall effectiveness of the model's predictions.
• Precision indicates the proportion of correct positive predictions out of all positive predictions made by the model.
• Recall, also termed sensitivity, evaluates the fraction of correct positive predictions among instances of positive behavior.
• F1-score, the harmonic mean of precision and recall, provides a balanced comparison of these two metrics.

Table 2 succinctly encapsulates the performance of each model/method. For instance, CNN 1D manifests an F1-score of 1, with accuracy, precision, and recall each at 0.999. In a similar vein, the effectiveness of other models is appraised using these criteria. Results from other studies [23-25], are also included in the table, albeit without precise metric values. This inclusion is vital for a comprehensive comparison.

Table 2. Comparative analysis of proposed models

Table 2 serves as an efficient and clear summary of each proposed model's performance, providing a basis for an in-depth comparative analysis of the models in terms of accuracy, precision, recall, and F1-score.

Table 2's results offer a detailed evaluation of various deep learning and machine learning models applied in the detection of DRDoS DNS attacks. Key metrics such as precision, recall, accuracy, and F1-score provide insights into each model's performance. Notably, the CNN 1D and Alex Net models exhibited exceptional performance, achieving scores of 0.999 or 1 in all evaluated metrics. This suggests a near-perfect capability of these models in accurately predicting and identifying DDoS DNS attacks. The results underscore the enhanced effectiveness of machine learning and deep learning models in detecting DDoS DNS attacks compared to other approaches. The high F1-score and accuracy of these models demonstrate their proficiency in distinguishing between legitimate and malicious network traffic, underlining their value in augmenting DNS security. The findings correspond with the study's goal of developing efficient detection techniques for DRDoS DNS attacks. Moreover, these results contribute to the existing body of research, showcasing the potential of deep learning and machine learning models in addressing the unique challenges posed by DDoS DNS attacks.

While the effectiveness of the models in identifying DRDoS DNS threats is established, the study's reliance on a specific dataset might raise questions about the generalizability of the findings to other datasets and network environments. Future research could explore the performance of these models across diverse datasets from different network settings to assess their robustness and applicability in real-world scenarios. The study focused on a particular set of evaluation metrics, namely accuracy, precision, recall, and F1-score. Future research endeavors could broaden the range of evaluation metrics, offering a more comprehensive assessment of model performance and capturing the nuances of DRDoS DNS attack detection more accurately. Such an expansion would deepen the understanding of the models' strengths and limitations, guiding their practical implementation in network security.