An intrusion detection system for DDoS flooding attacks on IPv6 networks using deep learning techniques

• Main Author: Ahmed Marwan, Idrees Aleesa
• Format: Thesis
• Language: English; English; English
• Published: 2021
• Subjects: TK5101-6720 Telecommunication. Including telegraphy, telephone, radio, radar, television
• Online Access: http://eprints.uthm.edu.my/1771/2/AHMED%20MARWAN%20IDREES%20ALEESA%20-%20declaration.pdf; http://eprints.uthm.edu.my/1771/1/AHMED%20MARWAN%20IDREES%20ALEESA%20-%2024p.pdf; http://eprints.uthm.edu.my/1771/3/AHMED%20MARWAN%20IDREES%20ALEESA%20-%20fulltext.pdf; http://eprints.uthm.edu.my/1771/

The news about distributed denial of service (DDoS) attacks is rapidly increased around the world. Many services of companies and/or governments are victims of the attack. The main purpose of DDoS attacks is to overload the service for a long time, rather than to steal money or data from the targets. Since the user might not re-use services jammed by crackers, a company attacked by the crackers will lose many benefits. Major challenges are faced by the researchers are the unavailability of the dataset such as “no labelled DDoS attacks for IPv6, no data available online for download or use, few datasets on the internet but the security institutes or researchers who own it are kept private even for the research purposes”. In this research, I developed a DDoS-IPv6 dataset from real attacks traffic that contains 96 extracted features, the generated IPv6-DDoS dataset where had been collected by capturing attacks packets can be converted into network flows that contain rich metadata about the statistics of each flow, which are composed of the captured packet data. These flows are structured in the form of tabular data and contain both continuous and categorical features. Then deployed deep learning technique as intrusion detection system on the developed dataset, moreover optimised deep learning hyperparameters (i.e. the number of hidden layers/neurons, etc.) in order to find the optimal deep learning model, and check if the optimisation of layers/neurons would contribute to improving the accuracy. Accordingly, the result of the optimal deep learning technique for the four models with the developed dataset DDoS-IPv6 are between 99.79% and 99.996% and losses are between 0.0014% and 0.781%. I found that all the techniques succeeded to classify/detect IPv6 attacks and this will lead to new further research that needs to be developed in this area.