Abstract:The internet, a cornerstone of modern life, has profound implications across personal, business, and society. However, its widespread use has posed challenges, especially concerning privacy and cybersecurity. Besides, the threats on the internet are increasing in terms of danger, intensity, and complexity. Distributed denial-of-service (DDoS) attacks have emerged as a common and dangerous cybersecurity threat capable of disabling the network systems of targeted organizations and services. Therefore, various security strategies, such as firewalls and intrusion detection systems (IDS), are employed to protect against DDoS attacks. Enhancing the defensive capabilities of IDS systems through machine learning (ML) and deep learning (DL) technologies is a significant trend nowadays. However, despite notable successes, detecting DDoS attacks using ML and DL technologies still faces challenges, especially with Unknown DDoS Attacks. In this research, the primary goal is to address the unknown DDoS detection problem through efficient and advanced techniques. Our proposed method, CNN-RPL, integrates Convolutional Neural Network (CNN) with Reciprocal Points Learning (RPL), a novel Open-Set Recognition (OSR) technology. This model can effectively handle both known and unknown attacks. The CNN-RPL model demonstrates excellent results, achieving an accuracy exceeding 99.93% against known attacks in the CICIDS2017 dataset. Simultaneously, the model achieves a commendable average accuracy of up to 98.51% against unknown attacks in the CICDDoS2019 dataset. In particular, the CNN-RPL model simplifies the architecture of the deep neural network by significantly reducing the number of training parameters without compromising defense capabilities. Therefore, our proposed method is genuinely efficient, particularly flexible, and lightweight compared to traditional methods. This can equip organizations and businesses with a highly applicable yet powerful security approach against the evolving complexities in the network space.

OpenSMax: Unknown Domain Generation Algorithm Detection.

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

CNN-based DGA Detection with High Coverage

Uit-DGAdetector: detect domains generated by algorithms using machine learning

VAEMax: Open-Set Intrusion Detection based on OpenMax and Variational Autoencoder

DGA botnet detection method based on capsule network and k-means routing

Domain-Embeddings Based DGA Detection with Incremental Training Method

Unknown network attack detection based on open‐set recognition and active learning in drone network

Botnet DGA Domain Name Classification Using Transformer Network with Hybrid Embedding

Open-Set Intrusion Detection with MinMax Autoencoder and Pseudo Extreme Value Machine

HAGDetector: Heterogeneous DGA domain name detection model

CL-GAN: A GAN-based Continual Learning Model for Generating and Detecting AGDs

D3N: DGA Detection with Deep-Learning Through NXDomain

Open Set Domain Adaptation With Soft Unknown-Class Rejection

DGA domain embedding with deep metric learning

Model Evaluation for Domain Identification of Unknown Classes in Open-World Recognition: A Proposal

Open-Set Recognition in Unknown DDoS Attacks Detection With Reciprocal Points Learning

Detecting Domain Names Generated by DGAs With Low False Positives in Chinese Domain Names

KDTM: Multi-Stage Knowledge Distillation Transfer Model for Long-Tailed DGA Detection

Real-Time Detection of Dictionary DGA Network Traffic using Deep Learning

Unsupervised Clustering for a Comparative Methodology of Machine Learning Models to Detect Domain-Generated Algorithms Based on an Alphanumeric Features Analysis