Abstract:The article considers the possibility of early prediction of cyberattacks based on the analysis of suspicious activity in the network, which will provide additional opportunities for information protection services in countering such attacks. A feature of a slow DDoS attack is the use of a vulnerability in the TCP protocol, where interruptions can be caused intentionally or unintentionally as a result of delays in the communication channel. It is well known that detection of slow DDoS attacks is significantly different from volume-based attacks, as slow attacks do not increase network traffic. The general problem is to detect the start time of such an attack, since traffic parameters do not change dramatically. An assumption is made about the dependence of the slow attack on the user’s behavior. Using machine learning methods based on the analysis of similar situations in the past, it is possible to create an integrated system for transforming large volumes of publicly available data to predict the behavior of attackers in the network. A method of detecting such attacks based on research and prediction of suspicious user activity is proposed. The possibilities of using this method have been proven on the basis of modeling RUDY attacks on HTTP services. The characteristics of forecasting accuracy depending on the accumulated traffic and attack statistics are given. It is concluded that this method can be used to detect different types of slow DDoS attacks. Predicting suspicious traffic provides a solution to the problem of detecting slow DDoS attacks based on an algorithm for finding unknown future values for a time series of traffic parameters. The proposed method combines the advantages of artificial intelligence and statistical analysis and is capable of self-learning in case of replenishment of attack statistics. This approach allows you to accurately determine the random process at the control points and ensure a minimum of the mean square error of approximation in the intervals between these points.

Predictive Blacklisting as an Implicit Recommendation System

ELBlocker: Predicting blocking bugs with ensemble imbalance learning

Building and Measuring Privacy-Preserving Predictive Blacklists

Honeynet-based collaborative defense using improved highly predictive blacklisting algorithm

Prediction of dynamics of suspicious network activity based on network traffic analysis

Attacking Black-box Recommendations via Copying Cross-domain User Profiles

Black-box Adversarial Attacks on Network-wide Multi-step Traffic State Prediction Models

Enhancing the Robustness of Neural Collaborative Filtering Systems under Malicious Attacks

Evaluating IP Blacklists Effectiveness

Predict And Prevent DDOS Attacks Using Machine Learning and Statistical Algorithms

Prediction Approach against DDoS Attack based on Machine Learning Multiclassfier

Membership Inference Attacks Against Latent Factor Model

Forecasting Suspicious Account Activity at Large-Scale Online Service Providers

Adversarial Attacks for Black-Box Recommender Systems Via Copying Transferable Cross-Domain User Profiles

Knowledge-enhanced Black-box Attacks for Recommendations

Multi-agent Attacks for Black-box Social Recommendations

Towards Comprehensive Recommender Systems: Time-Aware UnifiedcRecommendations Based on Listwise Ranking of Implicit Cross-Network Data

Netflix Movies Recommendation System

Efficient Detection of DDoS Attacks Using a Hybrid Deep Learning Model with Improved Feature Selection

A holistic and proactive approach to forecasting cyber threats

Statistical Attack Detection