网络流量分类在网络管理和安全中至关重要,尤其是精准识别分布式拒绝服务(Distributed Denial of Service,DDoS)攻击这一威胁。DDoS攻击会导致服务中断、资源耗尽和经济损失,严重影响服务质量(QoS)。尽管集中式模型在DDoS攻击检测中取...网络流量分类在网络管理和安全中至关重要,尤其是精准识别分布式拒绝服务(Distributed Denial of Service,DDoS)攻击这一威胁。DDoS攻击会导致服务中断、资源耗尽和经济损失,严重影响服务质量(QoS)。尽管集中式模型在DDoS攻击检测中取得了一定成效,但在实际应用中存在挑战:数据分布不均、数据集中传输困难,以及异构设备和动态网络环境的限制,从而难以实现实时检测。为应对这些问题,本文提出了一种基于异步个性化联邦学习的DDoS攻击检测与缓解方法AdaPerFed(Adaptive Personalized Federated Learning)。首先,通过定制的ResNet架构高效处理一维流量数据,并集成Net模块增强特征提取能力。然后,通过软件定义网络(SDN,Software-Defined Networking)模拟复杂动态网络环境,并引入完善的缓解系统应对多样化攻击场景。个性化联邦学习框架有效处理了非独立同分布(Non-IID,Non-Independent and Identically Distributed)数据问题,并通过异步学习机制适应异构设备和网络条件的差异,提升了系统的鲁棒性和扩展性。实验结果表明,AdaPerFed在CICDDoS2019、CIC-IDS2017和InSDN等数据集上均优于其他联邦学习算法,在不同客户端数量下展现出更快的收敛速度和更强的鲁棒性,DDoS检测准确率提升了15%~20%。消融实验进一步验证了个性化聚合模块对系统性能的显著提升。展开更多
物联网(Internet of Things,IoT)技术的发展给工业界和日常生活带来便利的同时,海量易受到各种攻击和破坏的IoT设备也降低了分布式拒绝服务(Distributed Denial of Service,DDoS)攻击发起的成本,使被攻击方无法响应正常用户访问.为了在...物联网(Internet of Things,IoT)技术的发展给工业界和日常生活带来便利的同时,海量易受到各种攻击和破坏的IoT设备也降低了分布式拒绝服务(Distributed Denial of Service,DDoS)攻击发起的成本,使被攻击方无法响应正常用户访问.为了在物联网边缘中快速、准确地完成DDoS攻击检测,弥补现有方法资源开销大、不精确的缺陷,本文提出了一种基于轻量化卷积神经网络(Lightweight Convolutional Neural Networks,LCNN)的DDoS检测方法.面向物联网流量特性,方法首先提取包级特征和经冗余分析筛选得到的流级特征.之后设计了低参数和运算量的卷积神经网络LCNN,最后基于变维后的特征,快速检测定位攻击.实验结果表明,方法检测准确率达99.4%.同时LCNN在FPGA中能够以较少的资源消耗,保证在1ms时间内完成对一条流的推理判断.展开更多
The primary concern of modern technology is cyber attacks targeting the Internet of Things.As it is one of the most widely used networks today and vulnerable to attacks.Real-time threats pose with modern cyber attacks...The primary concern of modern technology is cyber attacks targeting the Internet of Things.As it is one of the most widely used networks today and vulnerable to attacks.Real-time threats pose with modern cyber attacks that pose a great danger to the Internet of Things(IoT)networks,as devices can be monitored or service isolated from them and affect users in one way or another.Securing Internet of Things networks is an important matter,as it requires the use of modern technologies and methods,and real and up-to-date data to design and train systems to keep pace with the modernity that attackers use to confront these attacks.One of the most common types of attacks against IoT devices is Distributed Denial-of-Service(DDoS)attacks.Our paper makes a unique contribution that differs from existing studies,in that we use recent data that contains real traffic and real attacks on IoT networks.And a hybrid method for selecting relevant features,And also how to choose highly efficient algorithms.What gives the model a high ability to detect distributed denial-of-service attacks.the model proposed is based on a two-stage process:selecting essential features and constructing a detection model using the K-neighbors algorithm with two classifier algorithms logistic regression and Stochastic Gradient Descent classifier(SGD),combining these classifiers through ensemble machine learning(stacking),and optimizing parameters through Grid Search-CV to enhance system accuracy.Experiments were conducted to evaluate the effectiveness of the proposed model using the CIC-IoT2023 and CIC-DDoS2019 datasets.Performance evaluation demonstrated the potential of our model in robust intrusion detection in IoT networks,achieving an accuracy of 99.965%and a detection time of 0.20 s for the CIC-IoT2023 dataset,and 99.968%accuracy with a detection time of 0.23 s for the CIC-DDoS 2019 dataset.Furthermore,a comparative analysis with recent related works highlighted the superiority of our methodology in intrusion detection,showing improvements in accuracy,recall,and detection time.展开更多
The Smart Grid is an enhancement of the traditional grid system and employs new technologies and sophisticated communication techniques for electrical power transmission and distribution. The Smart Grid’s communicati...The Smart Grid is an enhancement of the traditional grid system and employs new technologies and sophisticated communication techniques for electrical power transmission and distribution. The Smart Grid’s communication network shares information about status of its several integrated IEDs (Intelligent Electronic Devices). However, the IEDs connected throughout the Smart Grid, open opportunities for attackers to interfere with the communications and utilities resources or take clients’ private data. This development has introduced new cyber-security challenges for the Smart Grid and is a very concerning issue because of emerging cyber-threats and security incidents that have occurred recently all over the world. The purpose of this research is to detect and mitigate Distributed Denial of Service [DDoS] with application to the Electrical Smart Grid System by deploying an optimized Stealthwatch Secure Network analytics tool. In this paper, the DDoS attack in the Smart Grid communication networks was modeled using Stealthwatch tool. The simulated network consisted of Secure Network Analytic tools virtual machines (VMs), electrical Grid network communication topology, attackers and Target VMs. Finally, the experiments and simulations were performed, and the research results showed that Stealthwatch analytic tool is very effective in detecting and mitigating DDoS attacks in the Smart Grid System without causing any blackout or shutdown of any internal systems as compared to other tools such as GNS3, NeSSi2, NISST Framework, OMNeT++, INET Framework, ReaSE, NS2, NS3, M5 Simulator, OPNET, PLC & TIA Portal management Software which do not have the capability to do so. Also, using Stealthwatch tool to create a security baseline for Smart Grid environment, contributes to risk mitigation and sound security hygiene.展开更多
软件定义网络(Software Defined Network,SDN)通过控制平面和数据平面的解耦实现了网络的集中控制和灵活调度,但是这种架构设计也给可靠性、负载均衡和安全性等方面带来了挑战.其中,针对SDN环境中的分布式拒绝服务攻击(Distributed Deni...软件定义网络(Software Defined Network,SDN)通过控制平面和数据平面的解耦实现了网络的集中控制和灵活调度,但是这种架构设计也给可靠性、负载均衡和安全性等方面带来了挑战.其中,针对SDN环境中的分布式拒绝服务攻击(Distributed Denial of Service,DDoS),本文提出了一种结合门控循环单元(Gated Recurrent Unit,GRU)和注意力机制的DDoS攻击检测与缓解模型.相较于近期众多先进的DDoS攻击检测方法,本研究所提出的模型在检测性能上表现出了优越性,在数据集InSDN、CICIDS2018和CICDDoS2019上的检测准确率达到了100%、100%和99.62%.同时,为了进一步验证模型的有效性,本文在基于Mininet的SDN模拟环境中模拟DDoS攻击场景并对模型的缓解模块进行了检验.实验结果显示,该模型的缓解模块能够在检测到攻击后迅速采取有效的防御措施,显著减轻DDoS攻击对网络造成的影响.展开更多
分布式拒绝服务(Distribute Denial of Service,DDoS)攻击是常见的网络攻击手段之一,对于影响力日益增长的区块链网络构成了较大的威胁。包含堆叠法(Stacking)在内的集成学习模型在DDoS攻击检测方面有很大前景,而Stacking在面对不同类...分布式拒绝服务(Distribute Denial of Service,DDoS)攻击是常见的网络攻击手段之一,对于影响力日益增长的区块链网络构成了较大的威胁。包含堆叠法(Stacking)在内的集成学习模型在DDoS攻击检测方面有很大前景,而Stacking在面对不同类型数据集时需要调整学习器组合。该文使用Stacking方法检测区块链DDoS攻击,利用贝叶斯优化确定各学习器超参数,同时还使用算术优化算法(Arithmetic Optimization Algorithm,AOA)选择基学习器的组合,来解决需要手动调节学习器的问题。在区块链网络攻击流量数据集和比特币交易所交易数据上分别进行了实验,通过准确率、攻击数据漏报率和宏平均精准率三种评价指标进行对比,该方法在这两种不同类型数据集上的性能均优于其他三种常见的集成学习算法。还通过改变实验数据集大小探究出攻击检测性能会随着数据集的增大而上升。通过实验可以证明该方法可以有效检测不同类型数据集上的区块链DDoS攻击。展开更多
文摘物联网(Internet of Things,IoT)技术的发展给工业界和日常生活带来便利的同时,海量易受到各种攻击和破坏的IoT设备也降低了分布式拒绝服务(Distributed Denial of Service,DDoS)攻击发起的成本,使被攻击方无法响应正常用户访问.为了在物联网边缘中快速、准确地完成DDoS攻击检测,弥补现有方法资源开销大、不精确的缺陷,本文提出了一种基于轻量化卷积神经网络(Lightweight Convolutional Neural Networks,LCNN)的DDoS检测方法.面向物联网流量特性,方法首先提取包级特征和经冗余分析筛选得到的流级特征.之后设计了低参数和运算量的卷积神经网络LCNN,最后基于变维后的特征,快速检测定位攻击.实验结果表明,方法检测准确率达99.4%.同时LCNN在FPGA中能够以较少的资源消耗,保证在1ms时间内完成对一条流的推理判断.
文摘The primary concern of modern technology is cyber attacks targeting the Internet of Things.As it is one of the most widely used networks today and vulnerable to attacks.Real-time threats pose with modern cyber attacks that pose a great danger to the Internet of Things(IoT)networks,as devices can be monitored or service isolated from them and affect users in one way or another.Securing Internet of Things networks is an important matter,as it requires the use of modern technologies and methods,and real and up-to-date data to design and train systems to keep pace with the modernity that attackers use to confront these attacks.One of the most common types of attacks against IoT devices is Distributed Denial-of-Service(DDoS)attacks.Our paper makes a unique contribution that differs from existing studies,in that we use recent data that contains real traffic and real attacks on IoT networks.And a hybrid method for selecting relevant features,And also how to choose highly efficient algorithms.What gives the model a high ability to detect distributed denial-of-service attacks.the model proposed is based on a two-stage process:selecting essential features and constructing a detection model using the K-neighbors algorithm with two classifier algorithms logistic regression and Stochastic Gradient Descent classifier(SGD),combining these classifiers through ensemble machine learning(stacking),and optimizing parameters through Grid Search-CV to enhance system accuracy.Experiments were conducted to evaluate the effectiveness of the proposed model using the CIC-IoT2023 and CIC-DDoS2019 datasets.Performance evaluation demonstrated the potential of our model in robust intrusion detection in IoT networks,achieving an accuracy of 99.965%and a detection time of 0.20 s for the CIC-IoT2023 dataset,and 99.968%accuracy with a detection time of 0.23 s for the CIC-DDoS 2019 dataset.Furthermore,a comparative analysis with recent related works highlighted the superiority of our methodology in intrusion detection,showing improvements in accuracy,recall,and detection time.
文摘The Smart Grid is an enhancement of the traditional grid system and employs new technologies and sophisticated communication techniques for electrical power transmission and distribution. The Smart Grid’s communication network shares information about status of its several integrated IEDs (Intelligent Electronic Devices). However, the IEDs connected throughout the Smart Grid, open opportunities for attackers to interfere with the communications and utilities resources or take clients’ private data. This development has introduced new cyber-security challenges for the Smart Grid and is a very concerning issue because of emerging cyber-threats and security incidents that have occurred recently all over the world. The purpose of this research is to detect and mitigate Distributed Denial of Service [DDoS] with application to the Electrical Smart Grid System by deploying an optimized Stealthwatch Secure Network analytics tool. In this paper, the DDoS attack in the Smart Grid communication networks was modeled using Stealthwatch tool. The simulated network consisted of Secure Network Analytic tools virtual machines (VMs), electrical Grid network communication topology, attackers and Target VMs. Finally, the experiments and simulations were performed, and the research results showed that Stealthwatch analytic tool is very effective in detecting and mitigating DDoS attacks in the Smart Grid System without causing any blackout or shutdown of any internal systems as compared to other tools such as GNS3, NeSSi2, NISST Framework, OMNeT++, INET Framework, ReaSE, NS2, NS3, M5 Simulator, OPNET, PLC & TIA Portal management Software which do not have the capability to do so. Also, using Stealthwatch tool to create a security baseline for Smart Grid environment, contributes to risk mitigation and sound security hygiene.
文摘软件定义网络(Software Defined Network,SDN)通过控制平面和数据平面的解耦实现了网络的集中控制和灵活调度,但是这种架构设计也给可靠性、负载均衡和安全性等方面带来了挑战.其中,针对SDN环境中的分布式拒绝服务攻击(Distributed Denial of Service,DDoS),本文提出了一种结合门控循环单元(Gated Recurrent Unit,GRU)和注意力机制的DDoS攻击检测与缓解模型.相较于近期众多先进的DDoS攻击检测方法,本研究所提出的模型在检测性能上表现出了优越性,在数据集InSDN、CICIDS2018和CICDDoS2019上的检测准确率达到了100%、100%和99.62%.同时,为了进一步验证模型的有效性,本文在基于Mininet的SDN模拟环境中模拟DDoS攻击场景并对模型的缓解模块进行了检验.实验结果显示,该模型的缓解模块能够在检测到攻击后迅速采取有效的防御措施,显著减轻DDoS攻击对网络造成的影响.
