IDS for Improving DDoS attack recognition based on attack profiles and network traffic features

• Main Authors: Sallam, Amer A., Kabir, M. Nomani, Alginahi, Yasser M., Jamal, Ahmed, Esmeel, Thamer Khalil
• Format: Conference or Workshop Item
• Language: English; English
• Published: IEEE 2020
• Subjects: QA75 Electronic computers. Computer science
• Online Access: http://umpir.ump.edu.my/id/eprint/29302/2/IDS%20for%20Improving%20DDoS%20Attack%20Recognition%20Based%20on%20Attack%20Profiles%20and%20Network%20Traffic%20Feature.pdf; http://umpir.ump.edu.my/id/eprint/29302/13/IDS%20for%20improving%20DDoS%20attack%20recognition%20based%20on%20attack%20profiles%20and%20network%20traffic%20features.pdf; http://umpir.ump.edu.my/id/eprint/29302/; https://doi.org/10.1109/CSPA48992.2020.9068679

Intrusion detection system (IDS) is one of the important parts in security domains of the present time. Distributed Denial of Service (DDoS) detection involves complex process which reduces the overall performance of the system, and consequently, it may incur inefficiency or failure to the network. In this paper, the attacks database is split into a set of groups by classifying the attack types in terms of the most dominant features that define the profile of each attack along with the sensitive network traffic features. Decision Tree, AdaBoost, Random Forest, K-Nearest Neighbors and Naive Bayes are then used to classify each attack according to their profile features. DDoS attack was considered for all chosen classifiers. It is found that the average classification accuracy for the above-mentioned algorithms is 95.31% , 95.68%, 95.69%, 92.61% and 83.11%, respectively, providing plausible results when comparing to other existing models.