Detecting DDoS Attack: A Machine-Learning-Based Approach

Introduction

Network provides communication between two parties using various communication protocol (TCP/IP) suite to link devices and transmission medium. Legitimate and authorized users are allowed to use the network. Illegal users or the attackers try to exploit the network by pretending themselves as authentic and access the others data. To admittance others data, attacker use many strategies which are classified as Active and Passive attacks. The attacker endeavors control access on data or the hardware it resides is known as active attack. Whereas the intruder monitors the communications and listens the aspects of the network devices is known as passive attack. A few attacks DDoS (Distributed Denial of Service) attack which comes under Denial of Service (DoS) attack, masquerade attack and session replay attacks falls under this passive attack category. Machine learning model is preferred to identify and classify these complex attacks.

The network technology was also improved to achieve better performance in communication. But it also opens a great loop hole for the attackers to conduct DDoS more effectively. DDoS is a security problem which degrades the services of the legitimate users. This attack targets the resources which may be a victim’s single machine (personal computer) or server or a collection of servers. Since the network is capable of sending large number of packets in small time, the DDoS attackers can easily send a flood of packets to the target through the network, which causes severe damage to the target. The DDoS attack makes the target machine to slow down it’s process and make it to hang. If the target machine is a server, then the server will over flow with requests. So the server can’t responds to the legitimate requests. It also restarts if the attack conduct for a long period of time. During restart the server is not able to filter the requests. The server’s firewall and anti-virus software takes some time to start after server start. At that period of time, the attacker sends malicious files to the target machine to exploit. After exploitation the attacker stops the attack if he wants the data only from the server. Otherwise, the attacker continuously attack the target machine to denial the services provided by the server to the legitimate users. There are many types of DDoS attacks available. But the most famous attacks are, ICMP flood and TCP flood(SYN). Both are capable of denial of service of any type of server. There are many different protection mechanism such as machine learning approach used to prevent the attack as shown in figure1.

Figure 1.

DDoS attack detection