网络流量分类在网络管理和安全中至关重要,尤其是精准识别分布式拒绝服务(Distributed Denial of Service,DDoS)攻击这一威胁。DDoS攻击会导致服务中断、资源耗尽和经济损失,严重影响服务质量(QoS)。尽管集中式模型在DDoS攻击检测中取...网络流量分类在网络管理和安全中至关重要,尤其是精准识别分布式拒绝服务(Distributed Denial of Service,DDoS)攻击这一威胁。DDoS攻击会导致服务中断、资源耗尽和经济损失,严重影响服务质量(QoS)。尽管集中式模型在DDoS攻击检测中取得了一定成效,但在实际应用中存在挑战:数据分布不均、数据集中传输困难,以及异构设备和动态网络环境的限制,从而难以实现实时检测。为应对这些问题,本文提出了一种基于异步个性化联邦学习的DDoS攻击检测与缓解方法AdaPerFed(Adaptive Personalized Federated Learning)。首先,通过定制的ResNet架构高效处理一维流量数据,并集成Net模块增强特征提取能力。然后,通过软件定义网络(SDN,Software-Defined Networking)模拟复杂动态网络环境,并引入完善的缓解系统应对多样化攻击场景。个性化联邦学习框架有效处理了非独立同分布(Non-IID,Non-Independent and Identically Distributed)数据问题,并通过异步学习机制适应异构设备和网络条件的差异,提升了系统的鲁棒性和扩展性。实验结果表明,AdaPerFed在CICDDoS2019、CIC-IDS2017和InSDN等数据集上均优于其他联邦学习算法,在不同客户端数量下展现出更快的收敛速度和更强的鲁棒性,DDoS检测准确率提升了15%~20%。消融实验进一步验证了个性化聚合模块对系统性能的显著提升。展开更多
物联网(Internet of Things,IoT)技术的发展给工业界和日常生活带来便利的同时,海量易受到各种攻击和破坏的IoT设备也降低了分布式拒绝服务(Distributed Denial of Service,DDoS)攻击发起的成本,使被攻击方无法响应正常用户访问.为了在...物联网(Internet of Things,IoT)技术的发展给工业界和日常生活带来便利的同时,海量易受到各种攻击和破坏的IoT设备也降低了分布式拒绝服务(Distributed Denial of Service,DDoS)攻击发起的成本,使被攻击方无法响应正常用户访问.为了在物联网边缘中快速、准确地完成DDoS攻击检测,弥补现有方法资源开销大、不精确的缺陷,本文提出了一种基于轻量化卷积神经网络(Lightweight Convolutional Neural Networks,LCNN)的DDoS检测方法.面向物联网流量特性,方法首先提取包级特征和经冗余分析筛选得到的流级特征.之后设计了低参数和运算量的卷积神经网络LCNN,最后基于变维后的特征,快速检测定位攻击.实验结果表明,方法检测准确率达99.4%.同时LCNN在FPGA中能够以较少的资源消耗,保证在1ms时间内完成对一条流的推理判断.展开更多
分布式拒绝服务(Distribute Denial of Service,DDoS)攻击是常见的网络攻击手段之一,对于影响力日益增长的区块链网络构成了较大的威胁。包含堆叠法(Stacking)在内的集成学习模型在DDoS攻击检测方面有很大前景,而Stacking在面对不同类...分布式拒绝服务(Distribute Denial of Service,DDoS)攻击是常见的网络攻击手段之一,对于影响力日益增长的区块链网络构成了较大的威胁。包含堆叠法(Stacking)在内的集成学习模型在DDoS攻击检测方面有很大前景,而Stacking在面对不同类型数据集时需要调整学习器组合。该文使用Stacking方法检测区块链DDoS攻击,利用贝叶斯优化确定各学习器超参数,同时还使用算术优化算法(Arithmetic Optimization Algorithm,AOA)选择基学习器的组合,来解决需要手动调节学习器的问题。在区块链网络攻击流量数据集和比特币交易所交易数据上分别进行了实验,通过准确率、攻击数据漏报率和宏平均精准率三种评价指标进行对比,该方法在这两种不同类型数据集上的性能均优于其他三种常见的集成学习算法。还通过改变实验数据集大小探究出攻击检测性能会随着数据集的增大而上升。通过实验可以证明该方法可以有效检测不同类型数据集上的区块链DDoS攻击。展开更多
The explosive expansion of the Internet of Things(IoT)systems has increased the imperative to have strong and robust solutions to cyber Security,especially to curtail Distributed Denial of Service(DDoS)attacks,which c...The explosive expansion of the Internet of Things(IoT)systems has increased the imperative to have strong and robust solutions to cyber Security,especially to curtail Distributed Denial of Service(DDoS)attacks,which can cripple critical infrastructure.The proposed framework presented in the current paper is a new hybrid scheme that induces deep learning-based traffic classification and blockchain-enabledmitigation tomake intelligent,decentralized,and real-time DDoS countermeasures in an IoT network.The proposed model fuses the extracted deep features with statistical features and trains them by using traditional machine-learning algorithms,which makes them more accurate in detection than statistical features alone,based on the Convolutional Neural Network(CNN)architecture,which can extract deep features.A permissioned blockchain will be included to record the threat cases immutably and automatically execute mitigation measures through smart contracts to provide transparency and resilience.When tested on two test sets,BoT-IoT and IoT-23,the framework obtains a maximum F1-score at 97.5 percent and only a 1.8 percent false positive rate,which compares favorably to other solutions regarding effectiveness and the amount of time required to respond.Our findings support the feasibility of our method as an extensible and secure paradigm of nextgeneration IoT security,which has constrictive utility in mission-critical or resource-constrained settings.The work is a substantial milestone in autonomous and trustful mitigation against DDoS attacks through intelligent learning and decentralized enforcement.展开更多
The era of big data brings new challenges for information network systems(INS),simultaneously offering unprecedented opportunities for advancing intelligent intrusion detection systems.In this work,we propose a data-d...The era of big data brings new challenges for information network systems(INS),simultaneously offering unprecedented opportunities for advancing intelligent intrusion detection systems.In this work,we propose a data-driven intrusion detection system for Distributed Denial of Service(DDoS)attack detection.The system focuses on intrusion detection from a big data perceptive.As intelligent information processing methods,big data and artificial intelligence have been widely used in information systems.The INS system is an important information system in cyberspace.In advanced INS systems,the network architectures have become more complex.And the smart devices in INS systems collect a large scale of network data.How to improve the performance of a complex intrusion detection system with big data and artificial intelligence is a big challenge.To address the problem,we design a novel intrusion detection system(IDS)from a big data perspective.The IDS system uses tensors to represent large-scale and complex multi-source network data in a unified tensor.Then,a novel tensor decomposition(TD)method is developed to complete big data mining.The TD method seamlessly collaborates with the XGBoost(eXtreme Gradient Boosting)method to complete the intrusion detection.To verify the proposed IDS system,a series of experiments is conducted on two real network datasets.The results revealed that the proposed IDS system attained an impressive accuracy rate over 98%.Additionally,by altering the scale of the datasets,the proposed IDS system still maintains excellent detection performance,which demonstrates the proposed IDS system’s robustness.展开更多
The rapid advancement of the Internet ofThings(IoT)has heightened the importance of security,with a notable increase in Distributed Denial-of-Service(DDoS)attacks targeting IoT devices.Network security specialists fac...The rapid advancement of the Internet ofThings(IoT)has heightened the importance of security,with a notable increase in Distributed Denial-of-Service(DDoS)attacks targeting IoT devices.Network security specialists face the challenge of producing systems to identify and offset these attacks.This researchmanages IoT security through the emerging Software-Defined Networking(SDN)standard by developing a unified framework(RNN-RYU).We thoroughly assess multiple deep learning frameworks,including Convolutional Neural Network(CNN),Long Short-Term Memory(LSTM),Feed-Forward Convolutional Neural Network(FFCNN),and Recurrent Neural Network(RNN),and present the novel usage of Synthetic Minority Over-Sampling Technique(SMOTE)tailored for IoT-SDN contexts to manage class imbalance during training and enhance performance metrics.Our research has significant practical implications as we authenticate the approache using both the self-generated SD_IoT_Smart_City dataset and the publicly available CICIoT23 dataset.The system utilizes only eleven features to identify DDoS attacks efficiently.Results indicate that the RNN can reliably and precisely differentiate between DDoS traffic and benign traffic by easily identifying temporal relationships and sequences in the data.展开更多
文摘物联网(Internet of Things,IoT)技术的发展给工业界和日常生活带来便利的同时,海量易受到各种攻击和破坏的IoT设备也降低了分布式拒绝服务(Distributed Denial of Service,DDoS)攻击发起的成本,使被攻击方无法响应正常用户访问.为了在物联网边缘中快速、准确地完成DDoS攻击检测,弥补现有方法资源开销大、不精确的缺陷,本文提出了一种基于轻量化卷积神经网络(Lightweight Convolutional Neural Networks,LCNN)的DDoS检测方法.面向物联网流量特性,方法首先提取包级特征和经冗余分析筛选得到的流级特征.之后设计了低参数和运算量的卷积神经网络LCNN,最后基于变维后的特征,快速检测定位攻击.实验结果表明,方法检测准确率达99.4%.同时LCNN在FPGA中能够以较少的资源消耗,保证在1ms时间内完成对一条流的推理判断.
文摘The explosive expansion of the Internet of Things(IoT)systems has increased the imperative to have strong and robust solutions to cyber Security,especially to curtail Distributed Denial of Service(DDoS)attacks,which can cripple critical infrastructure.The proposed framework presented in the current paper is a new hybrid scheme that induces deep learning-based traffic classification and blockchain-enabledmitigation tomake intelligent,decentralized,and real-time DDoS countermeasures in an IoT network.The proposed model fuses the extracted deep features with statistical features and trains them by using traditional machine-learning algorithms,which makes them more accurate in detection than statistical features alone,based on the Convolutional Neural Network(CNN)architecture,which can extract deep features.A permissioned blockchain will be included to record the threat cases immutably and automatically execute mitigation measures through smart contracts to provide transparency and resilience.When tested on two test sets,BoT-IoT and IoT-23,the framework obtains a maximum F1-score at 97.5 percent and only a 1.8 percent false positive rate,which compares favorably to other solutions regarding effectiveness and the amount of time required to respond.Our findings support the feasibility of our method as an extensible and secure paradigm of nextgeneration IoT security,which has constrictive utility in mission-critical or resource-constrained settings.The work is a substantial milestone in autonomous and trustful mitigation against DDoS attacks through intelligent learning and decentralized enforcement.
基金supported in part by the National Nature Science Foundation of China under Project 62166047in part by the Yunnan International Joint Laboratory of Natural Rubber Intelligent Monitor and Digital Applications under Grant 202403AP140001in part by the Xingdian Talent Support Program under Grant YNWR-QNBJ-2019-270.
文摘The era of big data brings new challenges for information network systems(INS),simultaneously offering unprecedented opportunities for advancing intelligent intrusion detection systems.In this work,we propose a data-driven intrusion detection system for Distributed Denial of Service(DDoS)attack detection.The system focuses on intrusion detection from a big data perceptive.As intelligent information processing methods,big data and artificial intelligence have been widely used in information systems.The INS system is an important information system in cyberspace.In advanced INS systems,the network architectures have become more complex.And the smart devices in INS systems collect a large scale of network data.How to improve the performance of a complex intrusion detection system with big data and artificial intelligence is a big challenge.To address the problem,we design a novel intrusion detection system(IDS)from a big data perspective.The IDS system uses tensors to represent large-scale and complex multi-source network data in a unified tensor.Then,a novel tensor decomposition(TD)method is developed to complete big data mining.The TD method seamlessly collaborates with the XGBoost(eXtreme Gradient Boosting)method to complete the intrusion detection.To verify the proposed IDS system,a series of experiments is conducted on two real network datasets.The results revealed that the proposed IDS system attained an impressive accuracy rate over 98%.Additionally,by altering the scale of the datasets,the proposed IDS system still maintains excellent detection performance,which demonstrates the proposed IDS system’s robustness.
基金supported by NSTC 113-2221-E-155-055NSTC 113-2222-E-155-007,Taiwan.
文摘The rapid advancement of the Internet ofThings(IoT)has heightened the importance of security,with a notable increase in Distributed Denial-of-Service(DDoS)attacks targeting IoT devices.Network security specialists face the challenge of producing systems to identify and offset these attacks.This researchmanages IoT security through the emerging Software-Defined Networking(SDN)standard by developing a unified framework(RNN-RYU).We thoroughly assess multiple deep learning frameworks,including Convolutional Neural Network(CNN),Long Short-Term Memory(LSTM),Feed-Forward Convolutional Neural Network(FFCNN),and Recurrent Neural Network(RNN),and present the novel usage of Synthetic Minority Over-Sampling Technique(SMOTE)tailored for IoT-SDN contexts to manage class imbalance during training and enhance performance metrics.Our research has significant practical implications as we authenticate the approache using both the self-generated SD_IoT_Smart_City dataset and the publicly available CICIoT23 dataset.The system utilizes only eleven features to identify DDoS attacks efficiently.Results indicate that the RNN can reliably and precisely differentiate between DDoS traffic and benign traffic by easily identifying temporal relationships and sequences in the data.
