Abstract:The cybersecurity landscape presents daunting challenges, particularly in the face of Denial of Service (DoS) attacks such as DoS Http Unbearable Load King (HULK) attacks and DoS GoldenEye attacks. These malicious tactics are designed to disrupt critical services by overwhelming web servers with malicious requests. In contrast to DoS attacks, there exists nefarious Operating System (OS) scanning, which exploits vulnerabilities in target systems. To provide further context, it is essential to clarify that NMAP, a widely utilized tool for identifying host OSes and vulnerabilities, is not inherently malicious but a dual-use tool with legitimate applications, such as asset inventory services in company networks. Additionally, Domain Name System (DNS) botnets can be incredibly damaging as they harness numerous compromised devices to inundate a target with malicious DNS traffic. This can disrupt online services, leading to downtime, financial losses, and reputational damage. Furthermore, DNS botnets can be used for other malicious activities like data exfiltration, spreading malware, or launching other cyberattacks, making them a versatile tool for cybercriminals. As attackers continually adapt and modify specific attributes to evade detection, our paper introduces an automated detection method that requires no expert input. This innovative approach identifies the distinct characteristics of DNS botnet attacks, DoS HULK attacks, DoS GoldenEye attacks, and OS-Scanning, explicitly using the NMAP tool, even when attackers alter their tactics. By harnessing a representative dataset, our proposed method ensures robust detection of such attacks against varying attack parameters or behavioral shifts. This heightened resilience significantly raises the bar for attackers attempting to conceal their malicious activities. Significantly, our approach delivered outstanding outcomes, with a mid 95% accuracy in categorizing NMAP OS scanning and DNS botnet attacks, and 100% for DoS HULK attacks and DoS GoldenEye attacks, proficiently discerning between malevolent and harmless network packets. Our code and the dataset are made publicly available.

Genetic Algorithm Rule Definition for Denial of Services Network Intrusion Detection

Attribute Selection Based Genetic Network Programming for Intrusion Detection System

An Implementation of Intrusion Detection System Using Genetic Algorithm

Application of Decision Tree Classifier in Detection of Specific Denial of Service Attacks with Genetic Algorithm Based Feature Selection on NSL-KDD

An evolutionary KNN model for DDoS assault detection using genetic algorithm based optimization

Application of improved genectic algorithm in IDS

An Online Rule Generation Model for Intrusion Detection

Knowledge discovery of interesting classification rules based on adaptive genetic algorithm

A Rough Set Theory Based Genetic Algorithm

Intrusion Detection for IoT Based on Improved Genetic Algorithm and Deep Belief Network.

An Evolution Strategy Approach toward Rule-set Generation for Network Intrusion Detection Systems (IDS)

Generating Adaptation Rules Of Software Systems: A Method Based On Genetic Algorithm

IDSGAN: Generative Adversarial Networks for Attack Generation Against Intrusion Detection

Automated Network Incident Identification through Genetic Algorithm-Driven Feature Selection

An Improved Quantum Genetic Algorithms and Application for DDoS Attack Detection

In-Network Filtering of Distributed Denial-of-Service Traffic with Near-Optimal Rule Selection.

Intrusion detection using enhanced genetic sine swarm algorithm based deep meta-heuristic ANN classifier on UNSW-NB15 and NSL-KDD dataset

Cognitive Diagnostic Model Made More Practical by Genetic Algorithm.

Automatic firewall rules generator for anomaly detection systems with Apriori algorithm

ML-Based Detection of DDoS Attacks Using Evolutionary Algorithms Optimization

Denial of service detection with hybrid fuzzy set based feed forward neural network