Abstract:The pernicious impact of malicious Slow DoS (Denial of Service) attacks on the application layer and web-based Open Systems Interconnection model services like Hypertext Transfer Protocol (HTTP) has given impetus to a range of novel detection strategies, many of which use machine learning (ML) for computationally intensive full packet capture and post-event processing. In contrast, existing detection mechanisms, such as those found in various approaches including ML, artificial intelligence, and neural networks neither facilitate real-time detection nor consider the computational overhead within resource-constrained Internet of Things (IoT) networks. Slow DoS attacks are notoriously difficult to reliably identify, as they masquerade as legitimate application layer traffic, often resembling nodes with slow or intermittent connectivity. This means they often evade detection mechanisms because they appear as genuine node activity, which increases the likelihood of mistakenly being granted access by intrusion-detection systems. The original contribution of this paper is an innovative Guardian Node (GN) Slow DoS detection model, which analyses the two key network attributes of packet length and packet delta time in real time within a live IoT network. By designing the GN to operate within a narrow window of packet length and delta time values, accurate detection of all three main Slow DoS variants is achieved, even under the stealthiest malicious attack conditions. A unique feature of the GN model is its ability to reliably discriminate Slow DoS attack traffic from both genuine and slow nodes experiencing high latency or poor connectivity. A rigorous critical evaluation has consistently validated high, real-time detection accuracies of more than 98% for the GN model across a range of demanding traffic profiles. This performance is analogous to existing ML approaches, whilst being significantly more resource efficient, with computational and storage overheads being over 96% lower than full packet capture techniques, so it represents a very attractive alternative for deployment in resource-scarce IoT environments.

Metric Learning-based Few-Shot Malicious Node Detection for IoT Backhaul/Fronthaul Networks

A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework

Few-Shot Learning-Based Malicious IoT Traffic Detection with Prototypical Graph Neural Networks

A detection mechanism on malicious nodes in IoT

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

Machine Learning Based Malicious Node Detection in IoT Environment

IoT Malicious Traffic Detection Based on Federated Learning

Detecting While Accessing:A Semi-Supervised Learning-Based Approach for Malicious Traffic Detection in Internet of Things

Detecting while accessing: A semi-supervised learning-based approach for malicious traffic detection in Internet of Things

Classifying attack traffic in IoT environments via few-shot learning

A lightweight model design approach for few-shot malicious traffic classification

An Adaptive Real-Time Malicious Node Detection Framework Using Machine Learning in Vehicular Ad-Hoc Networks (VANETs)

Model-agnostic generation-enhanced technology for few-shot intrusion detection

Strengthening Network Intrusion Detection in IoT Environments with Self-Supervised Learning and Few Shot Learning

MASiNet: Network Intrusion Detection for IoT Security Based on Meta-Learning Framework

The Guardian Node Slow DoS Detection Model for Real-Time Application in IoT Networks

An Easily Scalable Docker-based Privacy-Preserving Malicious Traffic Detection Architecture for IoT Environments

Machine Learning Based Low-Rate DDoS Attack Detection for SDN Enabled IoT Networks

Towards Novel Malicious Packet Recognition: A Few-Shot Learning Approach

A Hybrid Few-Shot Learning Based Intrusion Detection Method for Internet of Vehicles.

An Interpretable Intrusion Detection Method Based on Few-Shot Learning in Cloud-Ground Interconnection