Distributed Denial-of-Service(DDoS)attacks pose severe threats to Industrial Control Networks(ICNs),where service disruption can cause significant economic losses and operational risks.Existing signature-based methods...Distributed Denial-of-Service(DDoS)attacks pose severe threats to Industrial Control Networks(ICNs),where service disruption can cause significant economic losses and operational risks.Existing signature-based methods are ineffective against novel attacks,and traditional machine learning models struggle to capture the complex temporal dependencies and dynamic traffic patterns inherent in ICN environments.To address these challenges,this study proposes a deep feature-driven hybrid framework that integrates Transformer,BiLSTM,and KNN to achieve accurate and robust DDoS detection.The Transformer component extracts global temporal dependencies from network traffic flows,while BiLSTM captures fine-grained sequential dynamics.The learned embeddings are then classified using an instance-based KNN layer,enhancing decision boundary precision.This cascaded architecture balances feature abstraction and locality preservation,improving both generalization and robustness.The proposed approach was evaluated on a newly collected real-time ICN traffic dataset and further validated using the public CIC-IDS2017 and Edge-IIoT datasets to demonstrate generalization.Comprehensive metrics including accuracy,precision,recall,F1-score,ROC-AUC,PR-AUC,false positive rate(FPR),and detection latency were employed.Results show that the hybrid framework achieves 98.42%accuracy with an ROC-AUC of 0.992 and FPR below 1%,outperforming baseline machine learning and deep learning models.Robustness experiments under Gaussian noise perturbations confirmed stable performance with less than 2%accuracy degradation.Moreover,detection latency remained below 2.1 ms per sample,indicating suitability for real-time ICS deployment.In summary,the proposed hybrid temporal learning and instance-based classification model offers a scalable and effective solution for DDoS detection in industrial control environments.By combining global contextual modeling,sequential learning,and instance-based refinement,the framework demonstrates strong adaptability across datasets and resilience against noise,providing practical utility for safeguarding critical infrastructure.展开更多
Distributed Denial of Service(DDoS)attacks are one of the severe threats to network infrastructure,sometimes bypassing traditional diagnosis algorithms because of their evolving complexity.PresentMachine Learning(ML)t...Distributed Denial of Service(DDoS)attacks are one of the severe threats to network infrastructure,sometimes bypassing traditional diagnosis algorithms because of their evolving complexity.PresentMachine Learning(ML)techniques for DDoS attack diagnosis normally apply network traffic statistical features such as packet sizes and inter-arrival times.However,such techniques sometimes fail to capture complicated relations among various traffic flows.In this paper,we present a new multi-scale ensemble strategy given the Graph Neural Networks(GNNs)for improving DDoS detection.Our technique divides traffic into macro-and micro-level elements,letting various GNN models to get the two corase-scale anomalies and subtle,stealthy attack models.Through modeling network traffic as graph-structured data,GNNs efficiently learn intricate relations among network entities.The proposed ensemble learning algorithm combines the results of several GNNs to improve generalization,robustness,and scalability.Extensive experiments on three benchmark datasets—UNSW-NB15,CICIDS2017,and CICDDoS2019—show that our approach outperforms traditional machine learning and deep learning models in detecting both high-rate and low-rate(stealthy)DDoS attacks,with significant improvements in accuracy and recall.These findings demonstrate the suggested method’s applicability and robustness for real-world implementation in contexts where several DDoS patterns coexist.展开更多
With an increase in internet-connected devices and a dependency on online services,the threat of Distributed Denial of Service(DDoS)attacks has become a significant concern in cybersecurity.The proposed system follows...With an increase in internet-connected devices and a dependency on online services,the threat of Distributed Denial of Service(DDoS)attacks has become a significant concern in cybersecurity.The proposed system follows a multi-step process,beginning with the collection of datasets from different edge devices and network nodes.To verify its effectiveness,experiments were conducted using the CICDoS2017,NSL-KDD,and CICIDS benchmark datasets alongside other existing models.Recursive feature elimination(RFE)with random forest is used to select features from the CICDDoS2019 dataset,on which a BiLSTM model is trained on local nodes.Local models are trained until convergence or stability criteria are met while simultaneously sharing the updates globally for collaborative learning.A centralised server evaluates real-time traffic using the global BiLSTM model,which triggers alerts for potential DDoS attacks.Furthermore,blockchain technology is employed to secure model updates and to provide an immutable audit trail,thereby ensuring trust and accountability among network nodes.This research introduces a novel decentralized method called Federated Random Forest Bidirectional Long Short-Term Memory(FRF-BiLSTM)for detecting DDoS attacks,utilizing the advanced Bidirectional Long Short-Term Memory Networks(BiLSTMs)to analyze sequences in both forward and backward directions.The outcome shows the proposed model achieves a mean accuracy of 97.1%with an average training delay of 88.7 s and testing delay of 21.4 s.The model demonstrates scalability and the best detection performance in large-scale attack scenarios.展开更多
物联网(Internet of Things,IoT)技术的发展给工业界和日常生活带来便利的同时,海量易受到各种攻击和破坏的IoT设备也降低了分布式拒绝服务(Distributed Denial of Service,DDoS)攻击发起的成本,使被攻击方无法响应正常用户访问.为了在...物联网(Internet of Things,IoT)技术的发展给工业界和日常生活带来便利的同时,海量易受到各种攻击和破坏的IoT设备也降低了分布式拒绝服务(Distributed Denial of Service,DDoS)攻击发起的成本,使被攻击方无法响应正常用户访问.为了在物联网边缘中快速、准确地完成DDoS攻击检测,弥补现有方法资源开销大、不精确的缺陷,本文提出了一种基于轻量化卷积神经网络(Lightweight Convolutional Neural Networks,LCNN)的DDoS检测方法.面向物联网流量特性,方法首先提取包级特征和经冗余分析筛选得到的流级特征.之后设计了低参数和运算量的卷积神经网络LCNN,最后基于变维后的特征,快速检测定位攻击.实验结果表明,方法检测准确率达99.4%.同时LCNN在FPGA中能够以较少的资源消耗,保证在1ms时间内完成对一条流的推理判断.展开更多
网络流量分类在网络管理和安全中至关重要,尤其是精准识别分布式拒绝服务(Distributed Denial of Service,DDoS)攻击这一威胁。DDoS攻击会导致服务中断、资源耗尽和经济损失,严重影响服务质量(QoS)。尽管集中式模型在DDoS攻击检测中取...网络流量分类在网络管理和安全中至关重要,尤其是精准识别分布式拒绝服务(Distributed Denial of Service,DDoS)攻击这一威胁。DDoS攻击会导致服务中断、资源耗尽和经济损失,严重影响服务质量(QoS)。尽管集中式模型在DDoS攻击检测中取得了一定成效,但在实际应用中存在挑战:数据分布不均、数据集中传输困难,以及异构设备和动态网络环境的限制,从而难以实现实时检测。为应对这些问题,本文提出了一种基于异步个性化联邦学习的DDoS攻击检测与缓解方法AdaPerFed(Adaptive Personalized Federated Learning)。首先,通过定制的ResNet架构高效处理一维流量数据,并集成Net模块增强特征提取能力。然后,通过软件定义网络(SDN,Software-Defined Networking)模拟复杂动态网络环境,并引入完善的缓解系统应对多样化攻击场景。个性化联邦学习框架有效处理了非独立同分布(Non-IID,Non-Independent and Identically Distributed)数据问题,并通过异步学习机制适应异构设备和网络条件的差异,提升了系统的鲁棒性和扩展性。实验结果表明,AdaPerFed在CICDDoS2019、CIC-IDS2017和InSDN等数据集上均优于其他联邦学习算法,在不同客户端数量下展现出更快的收敛速度和更强的鲁棒性,DDoS检测准确率提升了15%~20%。消融实验进一步验证了个性化聚合模块对系统性能的显著提升。展开更多
软件定义网络(Software Defined Network,SDN)通过控制平面和数据平面的解耦实现了网络的集中控制和灵活调度,但是这种架构设计也给可靠性、负载均衡和安全性等方面带来了挑战.其中,针对SDN环境中的分布式拒绝服务攻击(Distributed Deni...软件定义网络(Software Defined Network,SDN)通过控制平面和数据平面的解耦实现了网络的集中控制和灵活调度,但是这种架构设计也给可靠性、负载均衡和安全性等方面带来了挑战.其中,针对SDN环境中的分布式拒绝服务攻击(Distributed Denial of Service,DDoS),本文提出了一种结合门控循环单元(Gated Recurrent Unit,GRU)和注意力机制的DDoS攻击检测与缓解模型.相较于近期众多先进的DDoS攻击检测方法,本研究所提出的模型在检测性能上表现出了优越性,在数据集InSDN、CICIDS2018和CICDDoS2019上的检测准确率达到了100%、100%和99.62%.同时,为了进一步验证模型的有效性,本文在基于Mininet的SDN模拟环境中模拟DDoS攻击场景并对模型的缓解模块进行了检验.实验结果显示,该模型的缓解模块能够在检测到攻击后迅速采取有效的防御措施,显著减轻DDoS攻击对网络造成的影响.展开更多
[目的]DDoS攻击作为一种破坏性极强的网络威胁,严重影响电力系统的稳定运行。由于电力监控局域网中的数据流量复杂多变,DDoS攻击流量与正常流量在表现形式上存在较高相似性,导致二者难以有效区分。传统的静态阈值方法虽能在一定程度上...[目的]DDoS攻击作为一种破坏性极强的网络威胁,严重影响电力系统的稳定运行。由于电力监控局域网中的数据流量复杂多变,DDoS攻击流量与正常流量在表现形式上存在较高相似性,导致二者难以有效区分。传统的静态阈值方法虽能在一定程度上实现流量监测,但因无法适应流量的动态变化,常出现误判,从而削弱了对DDoS攻击的检测效果,难以为电力监控局域网提供可靠的安全保障。为此,提出一种基于动态阈值的电力监控局域网DDoS攻击检测方法。[方法]通过网络流量采集设备实时获取电力监控局域网的流量数据,并利用信息熵理论计算流量熵值。信息熵可反映数据的混乱程度:正常流量通常具有一定规律性,熵值相对稳定;而DDoS攻击流量因异常数据包的大量涌入,导致熵值显著波动。基于此特性,本文设定动态阈值,当流量熵值超过阈值时判定为异常流量。随后,提取异常流量的六元组特征集(包括平均流包数、平均字节数、源IP地址增速、流表生存时间变化、端口增速以及对流比),并将其输入预训练的最小二乘支持向量机(least squares support vector machine,LSSVM)分类器中。LSSVM通过对已知样本的学习建立特征与类别的映射关系,从而实现对异常流量的分类与判断,确定其是否为DDoS攻击流量。[结果]实验结果表明,本文方法在ROC曲线和PR曲线上均表现较好,ROC-AUC和PR-AUC值均较传统方法有所提高。这表明该方法在检测DDoS攻击时具备更高的准确率与召回率,能够有效识别隐藏于正常流量中的攻击流量,并显著降低误判率。[结论]基于动态阈值与LSSVM分类器的检测方法能够有效应对电力监控局域网中DDoS攻击与正常流量难以区分的问题,提升检测的准确性与可靠性,为电力监控局域网提供更为有效的DDoS攻击防护手段,有助于增强电力系统的安全性与稳定性,保障电力供应的可靠运行,对电力行业网络安全防护具有重要的实际应用价值。展开更多
基金supported by the Extral High Voltage Power Transmission Company,China Southern Power Grid Co.,Ltd.
文摘Distributed Denial-of-Service(DDoS)attacks pose severe threats to Industrial Control Networks(ICNs),where service disruption can cause significant economic losses and operational risks.Existing signature-based methods are ineffective against novel attacks,and traditional machine learning models struggle to capture the complex temporal dependencies and dynamic traffic patterns inherent in ICN environments.To address these challenges,this study proposes a deep feature-driven hybrid framework that integrates Transformer,BiLSTM,and KNN to achieve accurate and robust DDoS detection.The Transformer component extracts global temporal dependencies from network traffic flows,while BiLSTM captures fine-grained sequential dynamics.The learned embeddings are then classified using an instance-based KNN layer,enhancing decision boundary precision.This cascaded architecture balances feature abstraction and locality preservation,improving both generalization and robustness.The proposed approach was evaluated on a newly collected real-time ICN traffic dataset and further validated using the public CIC-IDS2017 and Edge-IIoT datasets to demonstrate generalization.Comprehensive metrics including accuracy,precision,recall,F1-score,ROC-AUC,PR-AUC,false positive rate(FPR),and detection latency were employed.Results show that the hybrid framework achieves 98.42%accuracy with an ROC-AUC of 0.992 and FPR below 1%,outperforming baseline machine learning and deep learning models.Robustness experiments under Gaussian noise perturbations confirmed stable performance with less than 2%accuracy degradation.Moreover,detection latency remained below 2.1 ms per sample,indicating suitability for real-time ICS deployment.In summary,the proposed hybrid temporal learning and instance-based classification model offers a scalable and effective solution for DDoS detection in industrial control environments.By combining global contextual modeling,sequential learning,and instance-based refinement,the framework demonstrates strong adaptability across datasets and resilience against noise,providing practical utility for safeguarding critical infrastructure.
文摘Distributed Denial of Service(DDoS)attacks are one of the severe threats to network infrastructure,sometimes bypassing traditional diagnosis algorithms because of their evolving complexity.PresentMachine Learning(ML)techniques for DDoS attack diagnosis normally apply network traffic statistical features such as packet sizes and inter-arrival times.However,such techniques sometimes fail to capture complicated relations among various traffic flows.In this paper,we present a new multi-scale ensemble strategy given the Graph Neural Networks(GNNs)for improving DDoS detection.Our technique divides traffic into macro-and micro-level elements,letting various GNN models to get the two corase-scale anomalies and subtle,stealthy attack models.Through modeling network traffic as graph-structured data,GNNs efficiently learn intricate relations among network entities.The proposed ensemble learning algorithm combines the results of several GNNs to improve generalization,robustness,and scalability.Extensive experiments on three benchmark datasets—UNSW-NB15,CICIDS2017,and CICDDoS2019—show that our approach outperforms traditional machine learning and deep learning models in detecting both high-rate and low-rate(stealthy)DDoS attacks,with significant improvements in accuracy and recall.These findings demonstrate the suggested method’s applicability and robustness for real-world implementation in contexts where several DDoS patterns coexist.
基金supported by the Ministry of Education of the Republic of Korea and the National Research Foundation of Korea(NRF-2025S1A5A2A01005171)by the BK21 programat Chungbuk National University(2025).
文摘With an increase in internet-connected devices and a dependency on online services,the threat of Distributed Denial of Service(DDoS)attacks has become a significant concern in cybersecurity.The proposed system follows a multi-step process,beginning with the collection of datasets from different edge devices and network nodes.To verify its effectiveness,experiments were conducted using the CICDoS2017,NSL-KDD,and CICIDS benchmark datasets alongside other existing models.Recursive feature elimination(RFE)with random forest is used to select features from the CICDDoS2019 dataset,on which a BiLSTM model is trained on local nodes.Local models are trained until convergence or stability criteria are met while simultaneously sharing the updates globally for collaborative learning.A centralised server evaluates real-time traffic using the global BiLSTM model,which triggers alerts for potential DDoS attacks.Furthermore,blockchain technology is employed to secure model updates and to provide an immutable audit trail,thereby ensuring trust and accountability among network nodes.This research introduces a novel decentralized method called Federated Random Forest Bidirectional Long Short-Term Memory(FRF-BiLSTM)for detecting DDoS attacks,utilizing the advanced Bidirectional Long Short-Term Memory Networks(BiLSTMs)to analyze sequences in both forward and backward directions.The outcome shows the proposed model achieves a mean accuracy of 97.1%with an average training delay of 88.7 s and testing delay of 21.4 s.The model demonstrates scalability and the best detection performance in large-scale attack scenarios.
文摘物联网(Internet of Things,IoT)技术的发展给工业界和日常生活带来便利的同时,海量易受到各种攻击和破坏的IoT设备也降低了分布式拒绝服务(Distributed Denial of Service,DDoS)攻击发起的成本,使被攻击方无法响应正常用户访问.为了在物联网边缘中快速、准确地完成DDoS攻击检测,弥补现有方法资源开销大、不精确的缺陷,本文提出了一种基于轻量化卷积神经网络(Lightweight Convolutional Neural Networks,LCNN)的DDoS检测方法.面向物联网流量特性,方法首先提取包级特征和经冗余分析筛选得到的流级特征.之后设计了低参数和运算量的卷积神经网络LCNN,最后基于变维后的特征,快速检测定位攻击.实验结果表明,方法检测准确率达99.4%.同时LCNN在FPGA中能够以较少的资源消耗,保证在1ms时间内完成对一条流的推理判断.
文摘软件定义网络(Software Defined Network,SDN)通过控制平面和数据平面的解耦实现了网络的集中控制和灵活调度,但是这种架构设计也给可靠性、负载均衡和安全性等方面带来了挑战.其中,针对SDN环境中的分布式拒绝服务攻击(Distributed Denial of Service,DDoS),本文提出了一种结合门控循环单元(Gated Recurrent Unit,GRU)和注意力机制的DDoS攻击检测与缓解模型.相较于近期众多先进的DDoS攻击检测方法,本研究所提出的模型在检测性能上表现出了优越性,在数据集InSDN、CICIDS2018和CICDDoS2019上的检测准确率达到了100%、100%和99.62%.同时,为了进一步验证模型的有效性,本文在基于Mininet的SDN模拟环境中模拟DDoS攻击场景并对模型的缓解模块进行了检验.实验结果显示,该模型的缓解模块能够在检测到攻击后迅速采取有效的防御措施,显著减轻DDoS攻击对网络造成的影响.
文摘[目的]DDoS攻击作为一种破坏性极强的网络威胁,严重影响电力系统的稳定运行。由于电力监控局域网中的数据流量复杂多变,DDoS攻击流量与正常流量在表现形式上存在较高相似性,导致二者难以有效区分。传统的静态阈值方法虽能在一定程度上实现流量监测,但因无法适应流量的动态变化,常出现误判,从而削弱了对DDoS攻击的检测效果,难以为电力监控局域网提供可靠的安全保障。为此,提出一种基于动态阈值的电力监控局域网DDoS攻击检测方法。[方法]通过网络流量采集设备实时获取电力监控局域网的流量数据,并利用信息熵理论计算流量熵值。信息熵可反映数据的混乱程度:正常流量通常具有一定规律性,熵值相对稳定;而DDoS攻击流量因异常数据包的大量涌入,导致熵值显著波动。基于此特性,本文设定动态阈值,当流量熵值超过阈值时判定为异常流量。随后,提取异常流量的六元组特征集(包括平均流包数、平均字节数、源IP地址增速、流表生存时间变化、端口增速以及对流比),并将其输入预训练的最小二乘支持向量机(least squares support vector machine,LSSVM)分类器中。LSSVM通过对已知样本的学习建立特征与类别的映射关系,从而实现对异常流量的分类与判断,确定其是否为DDoS攻击流量。[结果]实验结果表明,本文方法在ROC曲线和PR曲线上均表现较好,ROC-AUC和PR-AUC值均较传统方法有所提高。这表明该方法在检测DDoS攻击时具备更高的准确率与召回率,能够有效识别隐藏于正常流量中的攻击流量,并显著降低误判率。[结论]基于动态阈值与LSSVM分类器的检测方法能够有效应对电力监控局域网中DDoS攻击与正常流量难以区分的问题,提升检测的准确性与可靠性,为电力监控局域网提供更为有效的DDoS攻击防护手段,有助于增强电力系统的安全性与稳定性,保障电力供应的可靠运行,对电力行业网络安全防护具有重要的实际应用价值。
