Detection of Distributed Denial of Service Attacks

Abstract

The use of network-connected devices is expanding quickly in the digital age, in- creasing the number of cyber attacks. The Distributed Denial of Service (DDoS) at- tacks are one type of such cyber-attacks that are getting harder to resist, costing its victims or targets in terms of their revenue, customers, reputation etc. According to Gartner, the moderate expense of IT services downtime is $5,600 per minute. It can range from $140,000 to $300,000 per hour on average and go as high as $540,000 per hour. Cisco forecasts that the maximum count of DDoS attacks may double between the years 2018 to 2023, from 7.9 to over 15 million. In addition, DDoS attacks are becoming more sophisticated causing devastation. In recent years, several models for identifying such attacks have been described in the literature. However, it remains a tough problem due to multiple traffic signatures and attack volume variations. newlineTo address this problem, this thesis proposes various detection approaches by handling traffic noises, class imbalances, optimizing memory utilization, reducing training times, and provides the explanations that lead to the particular decisions in the model. Initially, a promising new automatic DDoS detection methodology is designed by condensing the feature space that minimizes model overfitting and improve the model s generalization. Then, a fast processing and robust DDoS detection model is developed, using memory optimization to improve the processing speed and designed extreme learning machines model by varying the parameters such as activation functions, weights, and neurons. Further, an autoencoder-based light gradient boost model is implemented to detect massive volumes of anonymous attacks, capable of detecting un- known or zero-day network attacks while maintaining a high-efficiency level. Thus, the model is analyzed in balanced and imbalanced data scenarios. Finally, an explainable AI framework is designed to provide transparency in the decisions made in the feature selection process and extracts the m