Abstract:Since its inception, the Internet has been rapidly evolving. With the advancement of science and technology and the explosive growth of the population, the demand for the Internet has been on the rise. Many applications in education, healthcare, entertainment, science, and more are being increasingly deployed based on the internet. Concurrently, malicious threats on the internet are on the rise as well. Distributed Denial of Service (DDoS) attacks are among the most common and dangerous threats on the internet today. The scale and complexity of DDoS attacks are constantly growing. Intrusion Detection Systems (IDS) have been deployed and have demonstrated their effectiveness in defense against those threats. In addition, the research of Machine Learning (ML) and Deep Learning (DL) in IDS has gained effective results and significant attention. However, one of the challenges when applying ML and DL techniques in intrusion detection is the identification of unknown attacks. These attacks, which are not encountered during the system’s training, can lead to misclassification with significant errors. In this research, we focused on addressing the issue of Unknown Attack Detection, combining two methods: Spatial Location Constraint Prototype Loss (SLCPL) and Fuzzy C-Means (FCM). With the proposed method, we achieved promising results compared to traditional methods. The proposed method demonstrates a very high accuracy of up to 99.8% with a low false positive rate for known attacks on the Intrusion Detection Evaluation Dataset (CICIDS2017) dataset. Particularly, the accuracy is also very high, reaching 99.7%, and the precision goes up to 99.9% for unknown DDoS attacks on the DDoS Evaluation Dataset (CICDDoS2019) dataset. The success of the proposed method is due to the combination of SLCPL, an advanced Open-Set Recognition (OSR) technique, and FCM, a traditional yet highly applicable clustering technique. This has yielded a novel method in the field of unknown attack detection. This further expands the trend of applying DL and ML techniques in the development of intrusion detection systems and cybersecurity. Finally, implementing the proposed method in real-world systems can enhance the security capabilities against increasingly complex threats on computer networks.

Fuzzy Classification Of Ddos Flood Attacks Packets

Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

A feature selection-based method for DDoS attack flow classification

Towards Detecting Flooding DDOS Attacks Over Software Defined Networks Using Machine Learning Techniques

An Online Entropy-based DDoS Flooding Attack Detection System with Dynamic Threshold

Unknown DDoS Attack Detection with Fuzzy C-Means Clustering and Spatial Location Constraint Prototype Loss

FIDS: Fuzzy Intrusion Detection System for simultaneous detection of DoS/DDoS attacks in Cloud computing

Design a Hybrid Flooding Attack Defense Scheme under the Cloud Computing Environment

Attack based DoS attack detection using multiple classifier

A Lightweight Ddos Flooding Attack Detection Algorithm Based On Synchronous Long Flows

Identifying Hybrid DDoS Attacks in Deterministic Machine-to-Machine Networks on a Per-Deterministic-Flow Basis

Weighted Fuzzy Clustering for Online Detection of Application DDoS Attacks in Encrypted Network Traffic

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

A Hybrid Deep Learning Model for Detecting DDoS Flooding Attacks in SIP-Based Systems

Detection and mitigation of DDoS attacks based on multi-dimensional characteristics in SDN

TCP/UDP-Based Exploitation DDoS Attacks Detection Using AI Classification Algorithms with Common Uncorrelated Feature Subset Selected by Pearson, Spearman and Kendall Correlation Methods

Dynamic and Auto Responsive Solution for Distributed Denial-of-Service Attacks Detection in ISP Network

DDoS detection and analysis system based on comprehensive scoring