Haseeb-Ur-Rehman Rana M Abdul, Aman Azana Hafizah Mohd, Hasan Mohammad Kamrul, Ariffin Khairul Akram Zainol, Namoun Abdallah, Tufail Ali, Kim Ki-Hyung
Center for Cyber Security, Faculty of Information Science and Technology, University Kebangsaan Malaysia (UKM), Bangi 43600, Malaysia.
Faculty of Computer and Information Systems, Islamic University of Madinah, Madinah 42351, Saudi Arabia.
Sensors (Basel). 2023 Aug 1;23(15):6850. doi: 10.3390/s23156850.
Having a large number of device connections provides attackers with multiple ways to attack a network. This situation can lead to distributed denial-of-service (DDoS) attacks, which can cause fiscal harm and corrupt data. Thus, irregularity detection in traffic data is crucial in detecting malicious behavior in a network, which is essential for network security and the integrity of modern Cyber-Physical Systems (CPS). Nevertheless, studies have shown that current techniques are ineffective at detecting DDoS attacks on networks, especially in the case of high-speed networks (HSN), as detecting attacks on the latter is very complex due to their fast packet processing. This review aims to study and compare different approaches to detecting DDoS attacks, using machine learning (ML) techniques such as k-means, K-Nearest Neighbors (KNN), and Naive Bayes (NB) used in intrusion detection systems (IDSs) and flow-based IDSs, and expresses data paths for packet filtering for HSN performance. This review highlights the high-speed network accuracy evaluation factors, provides a detailed DDoS attack taxonomy, and classifies detection techniques. Moreover, the existing literature is inspected through a qualitative analysis, with respect to the factors extracted from the presented taxonomy of irregular traffic pattern detection. Different research directions are suggested to support researchers in identifying and designing the optimal solution by highlighting the issues and challenges of DDoS attacks on high-speed networks.
拥有大量设备连接为攻击者提供了多种攻击网络的方式。这种情况可能导致分布式拒绝服务（DDoS）攻击，从而造成财务损失并破坏数据。因此，流量数据中的异常检测对于检测网络中的恶意行为至关重要，这对于网络安全和现代网络物理系统（CPS）的完整性至关重要。然而，研究表明，当前技术在检测网络DDoS攻击方面效率低下，尤其是在高速网络（HSN）的情况下，因为由于其快速的数据包处理，检测后者的攻击非常复杂。本综述旨在研究和比较使用机器学习（ML）技术（如用于入侵检测系统（IDS）和基于流的IDS中的k均值、K近邻（KNN）和朴素贝叶斯（NB））检测DDoS攻击的不同方法，并表达用于HSN性能的数据包过滤的数据路径。本综述突出了高速网络准确性评估因素，提供了详细的DDoS攻击分类法，并对检测技术进行了分类。此外，通过定性分析检查现有文献，分析从所提出的不规则流量模式检测分类法中提取的因素。通过突出高速网络上DDoS攻击的问题和挑战，提出了不同的研究方向，以支持研究人员识别和设计最佳解决方案。
