doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> The capacity to learn from examples is one of the most desirable features of neural network models. We present a learning algorithm for the recurrent random network model (Gelenbe 1989, 1990) using gradient descent of a quadratic error function. The analytical properties of the model lead to a "backpropagation" type algorithm that requires the solution of a system of n linear and n nonlinear equations each time the n-neuron network "learns" a new input-output pair. <s> BIB001 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> The security of computer networks plays a strategic role in modern computer systems. In order to enforce high protection levels against threats, a number of software tools have been currently developed. Intrusion Detection Systems aim at detecting intruders who elude "first line" protection. In this paper, a pattern recognition approach to network intrusion detection based on the fusion of multiple classifiers is proposed. Five decision fusion methods are assessed by experiments and their performances compared. The potentialities of classifier fusion for the development of effective intrusion detection systems are evaluated and discussed. <s> BIB002 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> As the complexity of Internet is scaled up, it is likely for the Internet resources to be exposed to Distributed Denial of Service (DDoS) flooding attacks on TCP-based Web servers. There has been a lot of related work which focuses on analyzing the pattern of the DDoS attacks to protect users from them. However, none of these studies takes all the flags within TCP header into account, nor do they analyze relationship between the flags and the TCP packets. To analyze the features of the DDoS attacks, therefore, this paper presents a network traffic analysis mechanism which computes the ratio of the number of TCP flags to the total number of TCP packets. Based upon the calculation of TCP flag rates, we compile a pair of the TCP flag rates and the presence (or absence) of the DDoS attack into state-action rules using machine learning algorithms. We endow alarming agents with a tapestry of the compiled rules. The agents can then detect network flooding attacks against a Web server. We validate our framework with experimental results in a simulated TCP-based network setting. The experimental results show a distinctive and predictive pattern of the DDoS attacks, and our alarming agents can successfully detect various DDoS attacks. <s> BIB003 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> Recently, as the serious damage caused by DDoS attacks increases, the rapid detection and the proper response mechanisms are urgent. However, existing security mechanisms do not provide effective defense against these attacks, or the defense capability of some mechanisms is only limited to specific DDoS attacks. It is necessary to analyze the fundamental features of DDoS attacks because these attacks can easily vary the used port/protocol, or operation method. In this paper, we propose a combined data mining approach for modeling the traffic pattern of normal and diverse attacks. This approach uses the automatic feature selection mechanism for selecting the important attributes. And the classifier is built with the theoretically selected attribute through the neural network. And then, our experimental results show that our approach can provide the best performance on the real network, in comparison with that by heuristic feature selection and any other single data mining approaches. <s> BIB004 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> In our present work we introduce the use of data fusion in the field of DoS anomaly detection. We present Dempster-Shafer's Theory of Evidence (D-S) as the mathematical foundation for the development of a novel DoS detection engine. Based on a data fusion paradigm, we combine multiple evidence generated from simple heuristics to feed our D-S inference engine and attempt to detect flooding attacks.Our approach has as its main advantages the modeling power of Theory of Evidence in expressing beliefs in some hypotheses, the ability to add the notions of uncertainty and ignorance in the system and the quantitative measurement of the belief and plausibility in our detection results.We evaluate our detection engine prototype through a set of experiments, that were conducted with real network traffic and with the use of common DDoS tools. We conclude that data fusion is a promising approach that could increase the DoS detection rate and decrease the false alarm rate. <s> BIB005 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> Cyber security is a serious global concern. The potential of cyber terrorism has posed a threat to national security; meanwhile the increasing prevalence of malware and incidents of cyber attacks hinder the utilization of the Internet to its greatest benefit and incur significant economic losses to individuals, enterprises, and public organizations. This paper presents some recent advances in intrusion detection, feature selection, and malware detection. ::: ::: In intrusion detection, stealthy and low profile attacks that include only few carefully crafted packets over an extended period of time to delude firewalls and the intrusion detection system (IDS) have been difficult to detect. In protection against malware (trojans, worms, viruses, etc.), how to detect polymorphic and metamorphic versions of recognized malware using static scanners is a great challenge. ::: ::: We present in this paper an agent based IDS architecture that is capable of detecting probe attacks at the originating host and denial of service (DoS) attacks at the boundary controllers. We investigate and compare the performance of different classifiers implemented for intrusion detection purposes. Further, we study the performance of the classifiers in real-time detection of probes and DoS attacks, with respect to intrusion data collected on a real operating network that includes a variety of simulated attacks. ::: ::: Feature selection is as important for IDS as it is for many other modeling problems. We present several techniques for feature selection and compare their performance in the IDS application. It is demonstrated that, with appropriately chosen features, both probes and DoS attacks can be detected in real time or near real time at the originating host or at the boundary controllers. ::: ::: We also briefly present some encouraging recent results in detecting polymorphic and metamorphic malware with advanced static, signature-based scanning techniques. <s> BIB006 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> Although the prevention of Distributed Denial of Service (DDoS) attacks is not possible, detection of such attacks plays main role in preventing their progress. In the flooding attacks, especially new sophisticated DDoS, the attacker floods the network traffic toward the target computer by sending pseudo-normal packets. Therefore, multi-purpose IDSs do not offer a good performance (and accuracy) in detecting such kinds of attacks. ::: ::: In this paper, a novel method for detection of DDoS attacks has been introduced based on a statistical pre-processor and an unsupervised artificial neural net. In addition, SPUNNID system has been designed based on the proposed method. The statistical pre-processing has been used to extract some statistical features of the traffic, showing the behavior of DDoS attacks. The unsupervised neural net is used to analyze and classify them as either a DDoS attack or normal. Moreover, the method has been more investigated using attacked network traffic, which has been provided from a real environment. The experimental results show that SPUNNID detects DDoS attacks accurately and efficiently. <s> BIB007 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> High precision and low false alarm rate are the two most important characteristics of a good Intrusion Detection System (IDS). In this work, we propose to construct a host-based IDS for detecting flooding-based Denial of Service (DoS) attacks by minimizing the generalization error bound of the IDS to reduce its false alarm rate and increase its precision. Radial basis function neural network (RBFNN) will be applied in the IDS. The generalization error bound is formulated based on the stochastic sensitivity measure of RBFNN. Experimental results using artificial datasets support our claims. <s> BIB008 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> The information security of computer networks has become a serious global issue and also a hot topic in computer networking researches. Many approaches have been proposed to tackle these problems, especially the denial of service (DoS) attacks. The Multiple Classifier System (MCS) is one of the approaches that have been adopted in the detection of DoS attacks recently. For a MCS to perform better than a single classifier, it is crucial for the base classifiers which embedded in the MCS to be diverse. Both resampling, e.g. bagging, and feature grouping could promote diversity of base classifiers. In this paper, we propose an approach to select the reduced feature group for each of the base classifiers in the MCS based on the mutual information between the features and class labels. The base classifiers being combined using the weighted sum is examined in this paper. Different feature grouping methods are evaluated theoretically and experimentally. <s> BIB009 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> The network security problem has become a critical issue and many approaches have been proposed to tackle the information security problems, especially the Denial of Service (DoS) attacks. Multiple Classifier System (MCS) is one of the approaches that have been adopted in the detection of DoS attacks recently. Fusion strategy is crucial and has great impact on the classification performance of an MCS. However the selection of the fusion strategy for an MCS in DoS problem varies widely. In this paper, we focus on the comparative study on adopting different fusion strategies for an MCS in DoS problem. <s> BIB010 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> Soft computing techniques are increasingly being used for problem solving. This paper addresses using an ensemble approach of different soft computing and hard computing techniques for intrusion detection. Due to increasing incidents of cyber attacks, building effective intrusion detection systems are essential for protecting information systems security, and yet it remains an elusive goal and a great challenge. We studied the performance of Artificial Neural Networks (ANNs), Support Vector Machines (SVMs) and Multivariate Adaptive Regression Splines (MARS). We show that an ensemble of ANNs, SVMs and MARS is superior to individual approaches for intrusion detection in terms of classification accuracy. <s> BIB011 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> This paper introduces the combined fuzzy-based approaches to detect the anomalous network traffic such as DoS/DDoS or probing attacks, which include Adaptive Neuro-Fuzzy Inference System (ANFIS) and Fuzzy C-Means (FCM) clustering. The basic idea of the algorithm is: at first using ANFIS the original multi-dimensional (M-D) feature space of network connections is transformed to a compact one-dimensional (1-D) feature space, secondly FCM clustering is used to classify the 1-D feature space into the anomalous and the normal.PCA is also used for dimensional reduction of the original feature space during feature extraction. This algorithm combines the advantages of high accuracy in supervised learning technique and high speed in unsupervised learning technique. A publicly available DRAPA/KDD99 dataset is used to demonstrate the approaches and the results show their accuracy in detecting anomalies of the network connections. <s> BIB012 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> The rapid growth of network-based information systems has resulted in continuous research of security issues. Intrusion Detection Systems (IDS) is an area of increasing concerns in the Internet community. Recently, a number of IDS schemes have been proposed based on various technologies. However, the techniques, which have been applied in many systems, are useful only for the existing patterns of intrusion. They can not detect new patterns of intrusion. Therefore, it is necessary to develop a new IDS technology that can find new patterns of intrusion. Most of IDS sensors provide less than 10% rate of false positives. In this paper, we proposed a new network-based probe detection model using the fuzzy cognitive maps that can detect intrusion by the Denial of Service (DoS) attack detection method utilizing the packet analyses. The probe detection systems using fuzzy cognitive maps (PDSuF) capture and analyze the packet information to detect SYN flooding attack. Using the results of the analysis of decision module, which adopts the fuzzy cognitive maps, the decision module measures the degree of risk of the DoS and trains the response module to deal with attacks. For the performance evaluation, the “IDS Evaluation Data Set” created by MIT was used. From the simulation we obtained the average true positive rate of 97.094% and the average false negative rate of 2.936%. <s> BIB013 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> In legitimate traffic the correlation exists between the outgoing traffic and incoming traffic of a server network because of the request-reply actions in most protocols. When DDoS attacks occur, the attackers send packets with faked source addresses. As a result, the outgoing traffic to the faked addresses does not induce any related incoming traffic. Our main idea is to find changes in the correlation caused by DDoS. We sample network traffics using Extended First Connection Density (EFCD), and express correlation by cross-correlation function. Because network traffic in DDoS-initiating stage is much similar to legitimate traffic, we use fuzzy classification in order to guarantee the accuracy. Experiments show that DDoS traffic can be identified accurately by our algorithm. <s> BIB014 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Learning Techniques <s> This paper describes results concerning the classification capability of unsupervised and supervised machine learning techniques in detecting intrusions using network audit trails. In this paper we investigate well known machine learning techniques: Frequent Pattern Tree mining (FP-tree), classification and regression tress (CART), multivariate regression splines (MARS) and TreeNet. The best model is chosen based on the classification accuracy (ROC curve analysis). The results show that high classification accuracies can be achieved in a fraction of the time required by well known support vector machines and artificial neural networks. TreeNet performs the best for normal, probe and denial of service attacks (DoS). CART performs the best for user to super user (U2su) and remote to local (R2L). <s> BIB015
Learning paradigms, such as neural networks, radial basis functions and genetic algorithms are increasingly used in DoS detection because of the intelligent and automatic classification that they can offer. In BIB007 , a statistical pre-processor is used to extract features from packets that can indicate the existence of a DoS attack. A feature vector is changed to numerical form and feeded to an unsupervised Adaptive Resonance Theory net (ART). In ART nets, learning is accomplished by updating the cluster weights according to the relative similarity between the weights and the input. The ART is first trained with normal and attack types of input vectors and then in real-time classifies the packets using the adjusted cluster weights. Features that can be used are the ratio of types of packets and the average packet header and packet sizes. Another learning-based technique is presented in  . Appropriate data are collected from the incoming packets, a feature estimator evaluates the frequencies of their appearance, and a RBFNN detector classifies them as normal or DoS. Experiments with TCP traffic show that the TTL, window size and some of the TCP flags do not necessarily provide useful information about the occurrence of a DoS attack. The success of the approach varies considerably depending on the choice of time frame, set of input features, number of hidden neurons and training data. As a natural continuation of this work, the same authors have used genetic algorithms to study the optimum feature selection problem  . With the same detection technique, they present a method to determine the importance of each input feature in DoS detection, by first selecting an initial set of 44 statistical features and then evaluating the most relevant features with a genetic algorithm. The usefulness of selected features vary with the number of hidden neurons and with the selection and mutation probabilities. Generally, the SYN and URG flags, as well as some specific ranges of ports are the most significant for the identification of a DoS attack. Similar detection techniques can be found in BIB008 , where flooding attacks are detected by minimisation of the generalisation error bound of the RBFNN, and in BIB009 BIB010 , where RBFNNs are used as classifiers for an entropy-based feature grouping in a multiple classifier system (MCS). MCS systems are also proposed in BIB002 and BIB011 . In BIB003 , DoS attacks are detected with traffic rate analysis (TRA) and three machine learning algorithms, namely C4.5, CN2 and a Bayesian classifier. The TRA system classifies IP packets into TCP, UDP or ICMP packets and further sums up the SYN, FIN, RST, ACK, PSH and URG flags for TCP packets. For a specific sampling period, the rate of a certain type of flag is determined by dividing the total number of this flag's occurrences to the total number of TCP packets observed while the ratio of the number of TCP, UDP or ICMP packets to the total number of IP packets gives the protocol rate. The authors provide experimental results in a simulated TCP-based network, which show that SYN and ACK flag rates for inbound traffic provide significant information for detection of SYN flooding attacks, while the best performance is obtained by the Bayesian classifier. The usefulness of Bayesian classifiers for DoS detection is also investigated in  , where likelihood estimation is combined with a feedforward implementation of the Random Neural Network (RNN) BIB001 . The approach is evaluated for different traffic data in a large networking test-bed. The authors use a combination of statistical features collected in real-time from the incoming traffic, namely the bitrate, the increase in bitrate, the entropy, the Hurst parameter, the delay and the increase of the delay. Another method to identify and select the useful features in DoS detection is presented in BIB004 , which describes a data mining approach based on an automatic feature selection mechanism combined with a neural network classifier. The authors use a decision tree to select the best out of a set of candidate features, which are then used in the neural network classifier. In their investigation, the packet count per flow and the source port variance of TCP traffic are the most suitable. In BIB005 , a data fusion system is presented, which aggregates information about the Internet traffic collected by different sensors and combines it using the Dempster-Shafer Theory of Evidence. In the DS framework one can state hypotheses, define membership, belief, plausibility and doubt functions regarding these hypotheses and eventually use a rule to combine all evidence and obtain a single conclusion. The proposed system is tested on a university network where information is collected with a Snort plugin and MIB entries. Fuzzy techniques have also been proposed for DoS detection. In BIB012 , an Adaptive Neuro-Fuzzy Inference System is used together with the Fuzzy C-Means Clustering Algorithm to detect DoS attacks; the authors test the method by performing experiments on the DARPA/KDD99 dataset. In the detection scheme presented in BIB013 , the contents of the incoming packets are analysed with a probe detection system of fuzzy cognitive maps and a black list of IP addresses is constructed accordingly. In another fuzzybased technique BIB014 , the detection process uses crosscorrelation functions between incoming and outgoing traffic as inputs to a fuzzy classifier. The authors discuss the resulting tradeoff between the accuracy of the detector and the increase in the computational demands when opting for higher dimension in the fuzzy classification. In  , three computational intelligence techniques for DoS detection, namely support vector machines, multivariate adaptive regression splines and linear genetic programs, are compared in a multi-agent setting. The same authors address also the feature selection problem with feature ranking algorithms in BIB006 and continue this work in BIB015 , where they discuss alternative approaches, including Frequent Pattern tree mining, classification and regression trees, and TreeNet. A vital issue in using learning-based detection is the selection of the set of input features that will provide useful and significant information about the incoming traffic. Despite the existence of a number of relevant papers, there is still no consensus on a standardised set of features.