You are here
COLLECTION AND ANALYSIS OF SLOW DENIAL OF SERVICE ATTACKS USING MACHINE LEARNING ALGORITHMS
| Title: | COLLECTION AND ANALYSIS OF SLOW DENIAL OF SERVICE ATTACKS USING MACHINE LEARNING ALGORITHMS. |
 45 views 22 downloads |
|---|---|---|
| Name(s): |
Kemp, Clifford , author Khoshgoftaar, Taghi M. , Thesis advisor Florida Atlantic University, Degree grantor Department of Computer and Electrical Engineering and Computer Science College of Engineering and Computer Science |
|
| Type of Resource: | text | |
| Genre: | Electronic Thesis Or Dissertation | |
| Date Created: | 2021 | |
| Date Issued: | 2021 | |
| Publisher: | Florida Atlantic University | |
| Place of Publication: | Boca Raton, Fla. | |
| Physical Form: | application/pdf | |
| Extent: | 157 p. | |
| Language(s): | English | |
| Abstract/Description: | Application-layer based attacks are becoming a more desirable target in computer networks for hackers. From complex rootkits to Denial of Service (DoS) attacks, hackers look to compromise computer networks. Web and application servers can get shut down by various application-layer DoS attacks, which exhaust CPU or memory resources. The HTTP protocol has become a popular target to launch application-layer DoS attacks. These exploits consume less bandwidth than traditional DoS attacks. Furthermore, this type of DoS attack is hard to detect because its network traffic resembles legitimate network requests. Being able to detect these DoS attacks effectively is a critical component of any robust cybersecurity system. Machine learning can help detect DoS attacks by identifying patterns in network traffic. With machine learning methods, predictive models can automatically detect network threats. This dissertation offers a novel framework for collecting several attack datasets on a live production network, where producing quality representative data is a requirement. Our approach builds datasets from collected Netflow and Full Packet Capture (FPC) data. We evaluate a wide range of machine learning classifiers which allows us to analyze slow DoS detection models more thoroughly. To identify attacks, we look at each dataset's unique traffic patterns and distinguishing properties. This research evaluates and investigates appropriate feature selection evaluators and search strategies. Features are assessed for their predictive value and degree of redundancy to build a subset of features. Feature subsets with high-class correlation but low intercorrelation are favored. Experimental results indicate Netflow and FPC features are discriminating enough to detect DoS attacks accurately. We conduct a comparative examination of performance metrics to determine the capability of several machine learning classifiers. Additionally, we improve upon our performance scores by investigating a variety of feature selection optimization strategies. Overall, this dissertation proposes a novel machine learning approach for detecting slow DoS attacks. Our machine learning results demonstrate that a single subset of features trained on Netflow data can effectively detect slow application-layer DoS attacks. | |
| Identifier: | FA00013848 (IID) | |
| Degree granted: | Dissertation (Ph.D.)--Florida Atlantic University, 2021. | |
| Collection: | FAU Electronic Theses and Dissertations Collection | |
| Note(s): | Includes bibliography. | |
| Subject(s): |
Machine learning Algorithms Denial of service attacks |
|
| Persistent Link to This Record: | http://purl.flvc.org/fau/fd/FA00013848 | |
| Use and Reproduction: | Copyright © is held by the author with permission granted to Florida Atlantic University to digitize, archive and distribute this item for non-profit research and educational purposes. Any reuse of this item in excess of fair use or other copyright exemptions requires permission of the copyright holder. | |
| Use and Reproduction: | http://rightsstatements.org/vocab/InC/1.0/ | |
| Host Institution: | FAU | |
| Is Part of Series: | Florida Atlantic University Digital Library Collections. |
