Abstract:The cybersecurity landscape presents daunting challenges, particularly in the face of Denial of Service (DoS) attacks such as DoS Http Unbearable Load King (HULK) attacks and DoS GoldenEye attacks. These malicious tactics are designed to disrupt critical services by overwhelming web servers with malicious requests. In contrast to DoS attacks, there exists nefarious Operating System (OS) scanning, which exploits vulnerabilities in target systems. To provide further context, it is essential to clarify that NMAP, a widely utilized tool for identifying host OSes and vulnerabilities, is not inherently malicious but a dual-use tool with legitimate applications, such as asset inventory services in company networks. Additionally, Domain Name System (DNS) botnets can be incredibly damaging as they harness numerous compromised devices to inundate a target with malicious DNS traffic. This can disrupt online services, leading to downtime, financial losses, and reputational damage. Furthermore, DNS botnets can be used for other malicious activities like data exfiltration, spreading malware, or launching other cyberattacks, making them a versatile tool for cybercriminals. As attackers continually adapt and modify specific attributes to evade detection, our paper introduces an automated detection method that requires no expert input. This innovative approach identifies the distinct characteristics of DNS botnet attacks, DoS HULK attacks, DoS GoldenEye attacks, and OS-Scanning, explicitly using the NMAP tool, even when attackers alter their tactics. By harnessing a representative dataset, our proposed method ensures robust detection of such attacks against varying attack parameters or behavioral shifts. This heightened resilience significantly raises the bar for attackers attempting to conceal their malicious activities. Significantly, our approach delivered outstanding outcomes, with a mid 95% accuracy in categorizing NMAP OS scanning and DNS botnet attacks, and 100% for DoS HULK attacks and DoS GoldenEye attacks, proficiently discerning between malevolent and harmless network packets. Our code and the dataset are made publicly available.

Application of Decision Tree Classifier in Detection of Specific Denial of Service Attacks with Genetic Algorithm Based Feature Selection on NSL-KDD

Detecting DDoS Attacks in Software-Defined Networks Through Feature Selection Methods and Machine Learning Models

Distributed denial of service attacks detection for software defined networks based on evolutionary decision tree model

Intrusion detection using enhanced genetic sine swarm algorithm based deep meta-heuristic ANN classifier on UNSW-NB15 and NSL-KDD dataset

An evolutionary KNN model for DDoS assault detection using genetic algorithm based optimization

Intrusion detection system using classification algorithms with feature selection mechanism over real-time data traffic

Genetic Algorithm Rule Definition for Denial of Services Network Intrusion Detection

Intrusion detection system over real-time data traffic using machine learning methods with feature selection approaches

Leveraging Metaheuristics for Feature Selection With Machine Learning Classification for Malicious Packet Detection in Computer Networks

Automated Network Incident Identification through Genetic Algorithm-Driven Feature Selection

Network Intrusion Detection using Decision Tree and Random Forest

Anomaly-based intrusion detection system through feature selection analysis and building hybrid efficient model

Genetic Algorithm based feature selection and Naïve Bayes for anomaly detection in fog computing environment

A generalized machine learning model for DDoS attacks detection using hybrid feature selection and hyperparameter tuning

Using machine learning techniques to identify rare cyber‐attacks on the UNSW‐NB15 dataset

A Feature Selection Model for Network Intrusion Detection System Based on PSO, GWO, FFA and GA Algorithms

A Framework for Detecting Distributed Denial of Services Attack in Cloud Enviorment using Machine Learning Techniques

Detection of DDoS Attacks in Software Defined Networking Using Machine Learning Models

An intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection

Feature Selection Algorithm For Intrusion Detection Using Cuckoo Search Algorithm

Framework for Detecting Distributed Denial of Services Attack in Cloud Environment