Research Article
Hiatus: Unsupervised Generative Approach for Detection of DoS and DDoS Attacks
@INPROCEEDINGS{10.1007/978-3-031-25538-0_28, author={Sivaanandh Muneeswaran and Vinay Sachidananda and Rajendra Patil and Hongyi Peng and Mingchang Liu and Mohan Gurusamy}, title={Hiatus: Unsupervised Generative Approach for Detection of DoS and DDoS Attacks}, proceedings={Security and Privacy in Communication Networks. 18th EAI International Conference, SecureComm 2022, Virtual Event, October 2022, Proceedings}, proceedings_a={SECURECOMM}, year={2023}, month={2}, keywords={Denial of Service Distributed Denial of Service Unsupervised learning VAE GAN UNSW-NB15 CICDDoS2019}, doi={10.1007/978-3-031-25538-0_28} }- Sivaanandh Muneeswaran
Vinay Sachidananda
Rajendra Patil
Hongyi Peng
Mingchang Liu
Mohan Gurusamy
Year: 2023
Hiatus: Unsupervised Generative Approach for Detection of DoS and DDoS Attacks
SECURECOMM
Springer
DOI: 10.1007/978-3-031-25538-0_28
Abstract
Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks pose a serious threat to the internet community by disrupting the availability of services. The current methods for detecting DoS and DDoS attacks have several drawbacks including a high false-positive rate and are mostly supervised techniques. The datasets used lack recent attack types. To overcome these limitations, we proposeHiatus: two independent generative models as anomaly detectors: (1) Variational Auto Encoder (VAE), and (2) Generative Adversarial Network (GAN) to classify the traffic flow as either benign or DoS or DDoS. We make the following contributions: (1) two learning algorithms (VAE and GAN) are trained in an unsupervised fashion to detect DoS and DDoS traffic without the involvement of labeled data, (2) avoid external feature engineering, (3) both the learning algorithms are trained and tested on CICDDoS2019 dataset which consists of latest exploitation and reflection based attacks, and the models are benchmarked by testing them with CICIDS2017 and UNSW-NB15 dataset. With the evaluated results, the proposed approaches outperform existing state-of-the-art techniques and could be used for effective DoS and DDoS detection.
