In detecting DDoS, deep learning faces challenges and difficulties such as high computational demands, long training times, and complex model interpretation. This research focuses on overcoming these challenges by proposing an effective strategy for detecting DDoS attacks in unbalanced network environments. This research uses SMOTE to increase the class distribution of the data set by allowing models using LSTM to learn time anomalies effectively when DDoS attacks occur. The experiments carried out have shown significant improvement in the performance of the LSTM model when integrated with SMOTE. These include validation loss results of 0.048 for LSTM SMOTE and 0.1943 for LSTM without SMOTE, accuracy of 99.50 and 97.50. Apart from that, there was an increase in the f1 score from 93.4% to 98.3%. In this research, it is proven that SMOTE can be used as an effective strategy to improve model performance in detecting DDoS attacks on heterogeneous networks, as well as increasing model robustness and reliability.

Cloud robot is becoming popular and security of cloud robot is important. However, the researches of cloud robot safety are a few. This work develops a security policy to defense DDoS attack of cloud robot. In this policy, complex, but accurate calculation models are deployed on the cloud, simple but efficient calculation models are deployed on the robot. In the cloud, there are master server and standby server. The master server transfers parameters of complex but accurate models to the standby server periodically and the master executes the start-stop backup policy. Specifically, this work proposes and proves an algorithm to dynamically adjust the interval of parameter transfer. According to a PDRA feature of Netflow, when DDoS attacks, the master server sends warning signals to the robot and standby server. The robot runs local models to avoid stopping work until it is connected to the standby server. Then, standby server provides service to the robot until the master server recover. Finally, this work implemented a gesture recognition cloud robot based on convolutional neural network, hidden Markov model and PDRA feature of Netflow to verify the policy. Experiment shows that the security policy to defense DDoS attack for cloud robot is effective.

With all the sophisticated threats to network security, intrusion detection is a section of the security technology industry that is becoming increasingly significant. In this research paper, we have discussed in detail the detection, effects, and prevention protocols of security issues. Security issues are a wide range of elements. Hence, we narrowed our research to two main sectors which are malware attacks and distributed denial of service (DDOS). To make the research more informative, we looked at three selected real-life cases of security intrusion that occurred around the world in recent years. Malware attacks and DDOS are constantly being developed creatively to challenge all the current security systems. In addition, we have analysed and highlighted the potential threats of the security issue and included proposed countermeasure ideas to avoid the security issues. The research findings also show us that malware is evolving simultaneously with our security technology growth. This gives us an understanding that prevention is significantly a continual improvement process.

Typical modern information systems are required to process copious data. Conventional manual approaches can no longer effectively analyze such massive amounts of data, and thus humans resort to smart techniques and tools to complement human effort. Currently, network security events occur frequently, and generate abundant log and alert files. Processing such vast quantities of data particularly requires smart techniques. This study reviewed several crucial developments of existent data mining algorithms, including those that compile alerts generated by heterogeneous IDSs into scenarios and employ various HMMs to detect complex network attacks. Moreover, sequential pattern mining algorithms were examined to develop multi-step intrusion detection. These studies can focus on applying these algorithms in practical settings to effectively reduce the occurrence of false alerts. This article researched the application of data mining algorithms in network security. The academic community has recently generated numerous studies on this topic.

Software-Defined Networking (SDN) is a network implementation paradigm of great importance, as it has a profound impact on the pace of technological progress. While SDN doesn’t directly address the technical complexities of routing, congestion control, traffic engineering, security, mobility, reliability, or real-time communication, it paves the way for innovative solutions to emerge for these and similar challenges. Security is of utmost importance in SDN with Distributed Denial of Service (DDoS) being an attack which creates large scale problems. DDoS creates malicious traffic that resembles normal traffic in order to create service problems. As such, mechanisms that distinguish between benign and malicious traffic is essential, since this is the first step to mitigate the problem of DDoS. In this paper, we take a dataset onboard which exhibits benign and malicious traffic in SDN. There are 23 features that are used for classification purposes. Here we utilise classification procedure based on three methods based Grammatical Evolution applied on the aforementioned data. We provide results that show the efficiency of our approach and show that all three methods exhibits satisfactory results.

Software Defined Networking (SDN) is positioning the standard for the management of networks due to its scalability and flexibility to program the network. The SDN provides many advantages but it also involves some specific security problems take down the controller using cyber attack and in result the whole network will shut down which makes it a single point of failure. In this paper, the DDoS attacks in SDN were detected using AI-enabled, machine and deep learning, models with some specific features for data-set under normal and DDoS traffic. In our approach, initial data-set is collected from 84 features on kaggle and then the 20 top most features are selected using permutation importance algorithm. The data-set were learned and tested with AI-enabled 5 models. Our experimental results showed that the use of machine learning based random forest model has achieved the highest accuracy rate of 99.97%, in DDoS attack detection in SDN. Our contributions through this study are, first, we found highest 20 attacks that absolutely contributed to DDoS attacks. Secondly, it can reduce the time and cost of comparing various learning models and performance required for determining a learning model suitable for DDoS detection. Finally, various experimental methods for evaluating the performance of the learning model are presented so that related researchers can utilize them.

The escalating reliance of modern society on information and communication technology has rendered it vulnerable to an array of cyber-attacks, with distributed denial-of-service (DDoS) at-tacks emerging as one of the most prevalent threats. This paper delves into the intricacies of DDoS attacks, which exploit compromised machines numbering in the thousands or more to disrupt data services and online commercial platforms, resulting in significant downtime and financial losses. Recognizing the gravity of this issue, various detection techniques have been explored, yet the quantitative and prior detection of DDoS attacks has seen a decline in recent methods. This research introduces an innovative approach by integrating evolutionary optimization algorithms and machine learning techniques. Specifically, the study proposes XGB-GA Optimization, RF-GA Optimization, and SVM-GA Optimization methods, employing Evolutionary Algorithms Opti-mization with TOPOT-Genetic Programming. Datasets pertaining to DDoS attacks were utilized to train machine learning models based on XGB, RF, and SVM algorithms, and 10-fold cross-validation was employed. The models were further optimized using evolutionary algo-rithms, achieving remarkable accuracy scores: 99.99% with the XGB-GA method, 99.50% with RF-GA, and 99.99% with SVM-GA. Furthermore, the study employed TPOT to identify the optimal algorithm for constructing a machine learning model, with the genetic algorithm pinpointing XGB-GA as the most effective choice. This research significantly advances the field of DDoS attack detection by presenting a robust and accurate methodology, thereby enhancing the cybersecurity landscape and fortifying digital infrastructures against these pervasive threats.

Due to rising cyber threats, IoT devices’ security vulnerabilities are expanding. However, these devices cannot run complicated security algorithms locally due to hardware restrictions. Data must be transferred to cloud nodes for processing, giving attackers an entry point. This research investigates distributed computing on the edge, using AI-enabled IoT devices and container orchestration tools to process data in real time at the network edge. The purpose is to identify and mitigate DDoS assaults while minimizing CPU usage to improve security. It compares typical IoT devices with and without AI-enabled chips, container orchestration, and and assesses their performance in running machine learning models with different cluster settings. The proposed architecture aims to empower IoT devices to process data locally, minimizing the reliance on cloud transmission and bolstering security in IoT environments. The results correlate with the update in the architecture. With the addition of AI-enabled IoT device and container orchestration, there is a difference of 60% between the new architecture and traditional architecture where only Raspberry Pi were being used.

Distributed Denial of Service (DDoS) is among the commonly used type of network attacks, particularly aimed at the IoT devices in the emerging future wireless services specially for strictly latency-limited applications. DDoS attacks pose serious threats for many entrepreneurial businesses as they can prevent legitimate customers from accessing network resources of corporate websites, demanding intelligent analytics prior to entertaining a service request. DDoS involves exploiting the vulnerability of IoT devices by launching distributed multi-point attacks to generate high traffic by flooding the network of victims. The consequences of DDoS attacks could be worst in any Software-Defined Networking (SDN) than in traditional networks because SDN is configured as centralised architecture, failing to address the weaknesses current paradigm. However, SDN can play a crucial role in mitigating the effects of DDoS attacks as it bears the features of easy programmability, manageability, flexibility, and scalability. In this manuscript preliminary framework to detect DDoS attacks by mitigating their threats in an SDN architecture is presented. The authors propose a defense mechanism that uses OpenFlow and sFlow to mitigate the effects of DDoS attacks. The initial results show that the proposed model can minimize efficiently the consequences of DDoS attacks in an SDN type of architectural paradigm.

Recently, cloud technology has become popular for smart societies. The Cloud technology has made dynamical network changes by enabling the construction of a logical network without building a physical network. Despite recent research on the cloud, it is necessary to study security functions for the identification of fake VNFs and the encryption of communication between entities. In this paper, we proposed an LW_PKI mechanism that detects a fake VNF and guarantees data security through mutual authentication between VNFs. To evaluate the LW_PKI, we built a MANO environment to test the performance of authentication and key generation for data security. In addition, we applied the artificial intelligence algorithm to detect abnormal behavior by using real attack data in the MANO environment. The LW_PKI guaranteed the reliability of a smart service by enhancing the security of the cloud environment.

Nowadays, the Internet of Things (IoT) concept plays a pivotal role in society and brings new capabilities to different industries. The number IoT solutions in areas such as transportation and healthcare is increasing and new services are under development. In the last decade, society has experienced a drastic increase in IoT connections. In fact, IoT connections will increase in the next few years across different areas. Conversely, despite these benefits, several challenges still need to be faced to enable efficient and secure operations (e.g., interoperability, security, standards, and server technologies). Furthermore, although efforts have been made to produce datasets composed of attacks against IoT devices, several possible attacks are not considered. Most existing efforts do not consider an extensive network topology with real IoT devices. The main goal of this research is to propose a novel and extensive IoT attack dataset to foster the development of security analytics applications in real IoT operations. To accomplish this, 33 attacks are executed in an IoT topology composed of 105 devices. These attacks are classified into seven categories, namely DDoS, DoS, Recon, Web-based, Brute Force, Spoofing, and Mirai. Finally, all attacks are executed by malicious IoT devices targeting other IoT devices.

As the world increasingly becomes more interconnected, the demand for safety and security is ever-increasing, particularly for industrial networks. This has prompted numerous researchers to investigate different methodologies and techniques suitable for intrusion detection systems (IDS) requirements. Over the years, many studies have proposed various solutions in this regard including signature-based and machine-learning (ML) based systems. More recently, researchers are considering deep learning (DL) based anomaly detection approaches. Most proposed works in this research field aimed to achieve either one or a combination of high accuracy, considerably low false alarm rates (FARs), high classification specificity and detection sensitivity, achieving lightweight DL models, or other ML and DL-related performance measurement metrics. In this study, we propose a novel method to convert a raw dataset to an image dataset to magnify patterns. Based on this we devise an anomaly detection for IDS using a lightweight convolutional neural network (CNN) that classifies denial of service and distributed denial of service. The proposed methods were evaluated using a modern dataset, CSE-CIC-IDS2018, and a legacy dataset, NSL-KDD. We have also applied a combined dataset to assess the generalization of the proposed model across various datasets. Our experimental results have demonstrated that the proposed methods achieved high accuracy and considerably low FARs with high specificity and sensitivity. The resulting loss and accuracy curves have also demonstrated the excellent generalization of the proposed lightweight CNN model, effectively avoiding overfitting. This holds for both the modern and legacy datasets, including their mixed version.