Applying AI-based techniques for DDoS anomaly detection and classification using large-scale datasets : a thesis submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy (Ph.D.) in Computer Science, Massey University

Simple item page
dc.contributor.advisorJang-Jaccard, Julian
dc.contributor.authorWei, Yuanyuan
dc.date.accessioned2024-01-19T03:17:52Z
dc.date.available2024-01-19T03:17:52Z
dc.date.issued2024-01-11
dc.description.abstractA Distributed Denial-of-Service (DDoS) attack is a type of malicious attempt to disrupt the normal traffic of a targeted server, service, or network by sending a flood of traffic to overwhelm the target or its surrounding infrastructure. DDoS attacks expose significant security vulnerabilities in network devices, allowing for malicious propagation. This presents serious security risks, including potential data loss and financial consequences. To identify and mitigate the impact of DDoS attacks, Artificial Intelligence (AI)-based techniques (e.g. machine learning or deep learning) can be deployed with the aim of improving decision-making in networked infrastructures to enhance reliability, interoperability, trust, security, and stability. Many of the studies that have deployed detection frameworks for DDoS attacks have suffered from the limitations of low detection rates, high false alarm rates, and a lack of scalability. In this context, it is important to apply AI-based techniques for classification and anomaly detection that can detect, prevent, and mitigate DDoS attacks. This research focuses on studying the detection of DDoS attacks. Traditional shallow machine learning-based techniques for DDoS attack classification tend to be ineffective when the volume and features of network traffic, potentially carrying malicious DDoS payloads, increase exponentially as they cannot extract high-importance features automatically. To overcome the limitations in extracting high-importance features, we first investigate the classification of different DDoS attacks based on a hybrid deep learning technique that combines Autoencoder (AE) and Multi-Layer Perceptron (MLP). We propose a hybrid deep learning-based approach to extract the most important features and feed them into the classifier to obtain a multi-class classification of different DDoS attacks. Then, we provide a hybrid deep learning anomaly detection technique called Long Short-Term Memory and Autoencoder (LSTM-AE) based on multivariate time series sequences that can effectively detect potential DDoS attacks. We evaluate the effectiveness of DDoS attack classification and anomaly detection. To evaluate whether the proposed hybrid deep learning-based anomaly detection is more promising, we apply the aforementioned hybrid deep learning-based LSTM-AE anomaly detection technique based on time series sequence analysis to the real-world IoT sensor data (the IoT sensor dataset of Indoor Air Quality (IAQ) from SKOol MOnitoring BOx (SKOMOBO) units deployed on a large scale across the classrooms of primary schools in New Zealand). We demonstrate the proposed hybrid deep learning-based techniques that can effectively detect anomalies in the large-scale IoT dataset. Finally, the outcomes of machine learning or deep learning performance lack transparency, posing challenges in both explaining the results to users and instilling trust in them. To address this issue, we propose a framework that can efficiently classify legitimate traffic and malicious traffic and explain the decision-making of machine learning/deep learning models by deploying Explainable Artificial Intelligence (XAI) techniques.
dc.identifier.urihttps://mro.massey.ac.nz/handle/10179/69316
dc.publisherMassey Universityen
dc.rightsThe Authoren
dc.subjectcybersecurity, machine learning, deep learning, anomaly detection, classification, explainable artificial intelligenceen
dc.subject.anzsrc460209 Planning and decision makingen
dc.subject.anzsrc460407 System and network securityen
dc.titleApplying AI-based techniques for DDoS anomaly detection and classification using large-scale datasets : a thesis submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy (Ph.D.) in Computer Science, Massey Universityen
thesis.degree.disciplineComputer Scienceen
thesis.degree.nameDoctor of Philosophy (Ph.D.)
thesis.description.doctoral-citation-abridgedMs. Wei’s research focuses on studying the detection of DDoS attacks by applying AI-based deep learning techniques for classification and anomaly detection that can detect, prevent, and mitigate DDoS attacks. The experiment results were comprehensively and extensively evaluated, demonstrating high detection rates for detecting DDoS attacks and classifying DDoS attack types correctly.
thesis.description.doctoral-citation-longA Distributed Denial-of-Service (DDoS) attack exposes significant security vulnerabilities in network devices. This presents serious security risks, including potential data loss and financial consequences. However, conventional techniques (i.e., statistical methods) for deploying detection frameworks for DDoS attacks have suffered from the limitations of low detection rates, high false alarm rates, and a lack of scalability. Ms. Wei’s research focuses on studying the detection of DDoS attacks by applying AI-based deep learning techniques for classification and anomaly detection that can detect, prevent, and mitigate DDoS attacks. The experiment results were comprehensively and extensively evaluated, demonstrating a very high detection rate for detecting DDoS attacks and classifying them into the correct attack types.
thesis.description.name-pronounciationYuanyuan Wei YUAN YUAN WEI
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
WeiPhDThesis.pdf
Size:
11.39 MB
Format:
Adobe Portable Document Format
Description:
Download
Collections
Theses and Dissertations