Evaluation DDoS Attack Detection Through the Application of Machine Learning Techniques on the CICIDS2017 Dataset in the Field of Information Security

Malliga et al. [7] explored the nature and characteristics of DoS/DDoS attacks, which aim to overwhelm a target with redundant traffic. This understanding is vital as the tactics and tools utilized in such attacks are constantly evolving. The study proposed a taxonomy for identifying DoS/DDoS attacks and provided deep learning techniques for their detection. It also discussed contemporary defenses against DoS/DDoS attacks that leverage deep learning algorithms, and the factors contributing to their effectiveness. Given the importance of datasets for deep learning methods, the paper also examined both historic and current datasets documenting DDoS and DDoS-like attacks. The study concluded by emphasizing the importance of improving existing state-of-the-art strategies to counteract the unpredictable behaviors of attackers.

Le et al. [8] noted the increasing number of individuals accessing the internet due to the widespread availability of smartphones and tablets. They pointed out that most online attacks on servers, websites, and services take the form of distributed denial of service attacks. These attacks quickly deplete resources due to the massive demand from numerous attackers. Thus, it's critical to identify these attacks and prevent network security breaches before they occur. The study carried out a comparison of supervised learning-based DDoS detection methods using the CIC-IDS 2017 dataset, employing various performance metrics to compare the ability of different methods to detect DDoS attacks.

Ahsan et al. [9] highlighted the growing significance of machine learning in cybersecurity. Machine learning aspires to enhance malware detection over existing methods by making it more actionable, scalable, and effective. However, the application of machine learning in the cybersecurity sector requires rigorous theoretical and methodological management. The study focused on the potential of applying machine learning techniques to cybersecurity data to enhance the security of existing infrastructure. It recognized the capacity of machine learning techniques to mitigate cyber threats and examined the evolution of attacks over the past decade and the limitations of these advanced models. Given the increasing concern over keeping the internet safe from malware, this research aimed to evaluate the effectiveness of current machine learning technologies in this area.

Qu et al. [10] discussed the increasing importance of implementing preventative measures to protect data, IT infrastructure, and online resources as the frequency of cyberattacks and network intrusions continues to rise. Organizations are responsible for preventing security incidents and data breaches, as well as monitoring and responding to threats or any actions that could compromise a system or network. This study delves into the intricacies of the intrusion detection system (IDS), a common perimeter security tool. Traditional security practices such as user authentication, access control, virus prevention, firewalls, cryptographic systems, and data encryption may not be sufficient in modern cyber organizations. The scalability of IDSs depends on the network size and file system. However, the most commonly used theoretical intrusion detection methods are misuse detection, signature-based IDS, and anomaly-based IDS. Given the efficacy of misuse detection against prevalent attack vectors, knowledge of intrusive activities is essential. SNORT is one of the most recognized methods for identifying abusive behavior.

Ahsan et al. [11] noted that cybersecurity dataset standards can be inconsistent, noisy, incomplete, irrelevant, or contain inconsistent instances of a specific security violation. These issues can negatively impact both learning and machine learning-based models. It is vital to address these data problems before utilizing machine learning techniques to develop a data-driven cybersecurity solution. Understanding the challenges associated with cybersecurity data and effectively addressing these issues using existing or newly developed algorithms is crucial for operations such as malware and intrusion detection. These data challenges must be rectified before using machine learning techniques to build a data-driven cybersecurity solution. Recognizing the difficulties posed by cybersecurity data and addressing these effectively using either existing or newly developed algorithms is crucial before undertaking tasks like virus and intrusion detection.

Sarker et al. [12] demonstrated that hybrid learning could enhance the performance of signature-based intrusion detection systems, a standard in the cybersecurity industry. However, these algorithms might fail to detect some attacks or events due to missing features, excessive feature reduction, or insufficient profiling. They suggest that these issues can be addressed using anomaly-based or hybrid methods, such as a combination of signature-based and anomaly-based detection strategies.

Guezzaz et al. [13] discussed how services like telephony, Industry 4.0, and industrial IoT have been dramatically transformed with the rise of cloud computing and IoT settings. Ensuring the security of these advanced technologies is crucial. IoT security presents a significant challenge for both commercial entities and academic institutions. The role of an IDS is to monitor behavior, recognize an intrusion in real-time, and respond accordingly. Many modern IDSs leverage machine learning (ML) techniques to improve their detection rate, accuracy (ACC), and precision (DR). In their research, they introduced a hybrid IDS that operates at the network's edge and uses machine learning techniques to secure IoT devices. They combined Principal Component Analysis (PCA) and the K-Nearest Neighbor method (K-NN) to identify anomalies and instances of misuse. While PCA was used to enhance feature engineering and training, the K-NN classifier was developed to improve detection accuracy and expedite decision-making. The results demonstrated the superiority of their proposed framework over alternative approaches, achieving excellent performance on the NSL-KDD dataset with a 99.10% ACC, 98.4% DR, 2.7% False Alarm Rate (FAR), and 99.2%, and on the Bot-IoT dataset with a 98.2%.

To summarize the studies mentioned in this section, the research conducted by various scholars suggests that the practical application of ML and IoT can significantly enhance the accuracy of cyber threat detection and the identification of diverse DDoS attacks, which can be extremely challenging for traditional methods. It can also be inferred that over the past decades, the complexity of cyber threats and their detection has risen remarkably due to the rapid development of technologies and the massive growth of databases. Therefore, innovative methods and intelligent approaches for cyber threat detection should be employed for a more accurate, flexible, and highly effective identification process.

4.1 Introduction

In this chapter, we covered the precision, accuracy, recall, and f1-score metrics used to assess the performance of machine learning algorithms. Further, we detailed the results of each machine learning algorithm's experiments (binary classification experiment and Multiclass classification experiment) using the aforementioned four assessment criteria. Finally, we compared our results with those of previous studies with regards to the dataset employed, the preprocessing processes taken, the treatment of categorical and numeric data, the machine learning algorithms employed, and the evaluation metrics utilized to gauge the effectiveness of the algorithms.

4.2 Evaluation metrics

Accuracy, precision, recall, and f1-score are used to evaluate machine learning algorithms.

These metrics' formulas are as follows:

TP=True Positives, TN=True Negative, FP=False Positives, and FN=False Negative.

Following are the equations for these metrics:

Accuracy: The ratio of correctly predicted samples to all samples, or simply the ratio of correctly predicted samples to all samples, is the most intuitive performance metric.

Accuracy $=\frac{\mathrm{TP}+\mathrm{TN}}{\mathrm{TP}+\mathrm{TN}+\mathrm{FP}+\mathrm{FN}}$          (1)

Precision can be viewed as the proportion of confirmed positive samples relative to the total number of confirmed positive samples projected.

Precision $=\frac{T P}{T P+F P}$     (2)

Recall is the proportion of accurately anticipated positive samples to the total number of positive samples predicted.

Recall $=\frac{T P}{T P+F N}$    (3)

F1-score is the weighted average of Precision and Recall.

Fl-score $=2 * \frac{\text { Precision } * \text { Recall }}{\text { Precision }+ \text { Recall }}$               (4)

4.3 Our results

The experimental findings from two tests on each machine learning method are presented in this section: determine between a normal attack and a DoS attack in the first experiment and between two DoS attacks in the second experiment. In this dataset, we applied two experiments to detect several types of attacks, Figure 10 shows Total Number of Samples in Each Category in the First Experiment Binary classification (normal and malicious attacks).

10.jpg

Figure 10. Total number of samples in each category in the first experiment

4.4 Binary classification experiment

Machine learning methods are used in this experiment to determine if the sample in this dataset represents a legitimate attack or a malicious one. The performance results for the machine learning methods utilized are based on four metrics: precision, accuracy, f1-score, and recall, as shown in Table 4 and Figure 11. In these metrics, all algorithms fared better during the detecting procedure. These findings suggest that machine learning algorithms are capable of effectively detecting and differentiating between standard and DoS attacks.

11.jpg

Figure 11. Performance results of binary classification

The experimental results for each machine learning technique utilizing a cybersecurity dataset are summarized in this section based on four evaluation metrics.

Table 4. Performance results of binary classification

4.5 Multiclass classification experiment

In this study, machine learning methods were applied to the DoS Attacks-Hulk and DoS Attacks-SlowHTTPTest datasets to identify harmful activities. Precision, accuracy, f1-score, and recall are the four measures that were used to evaluate the performance of the machine learning algorithms, as indicated in Table 5. In terms of these detection metrics, all algorithms performed at or near the top. According to these findings, machine learning algorithms can efficiently identify and differentiate between two types of DoS attacks.

Table 5. Performance results of multiclass classification

4.6 Discussions

In this paper, we applied eight ML algorithms to detect the DoS attacks with two types: DT, RF, MLP, GB, AdaBoost, XGB, Ridge, and NB. Then, the findings of two trials conducted for each machine learning algorithm are done to determine between a normal attack and a DoS attack in the first experiment and between two DoS attacks in the second experiment. In this dataset, we applied two experiments to detect several types of attacks: 1) Binary classification (normal and malicious attacks); 2) Multiclass classification (malicious attacks types). These experiments are done to know if each algorithm is able to distinguish between the DoS attack types in the dataset. The results in both experiments show as following: in the first one, all algorithms achieved better performance results in these metrics in the detection process. These results indicate that the machine learning algorithms can detect and distinguish between normal and DoS attacks effectively. While in second experiment, all algorithms achieved the higher performance results in these metrics in the detection process. These results indicate that the machine learning algorithms can detect and distinguish between two DoS attacks effectively.

It is worth mentioning that the major the managerial implications and practical contributions of this research are reflected in helping computer decision-makers, cyber-attacks policy actors, communication experts, cyber security professionals, and network specialists choose the optimum method and the most suitable mechanisms that can be implemented to detect highly complex and challenging DDoS detection threats that cannot be identified easily using conventional approaches. Thus, quick responses and active decisions could be selected with the help of ML and IoT concepts to facilitate the detection of severe DDoS attacks and harmful cyber threats to accomplish higher extents of privacy and security for organizations and individuals’ databases.