A DoS attack detection method based on adversarial neural network

DoS attack and attack strategy

DoS attacks usually start a massive attack on the target system by taking advantage of weaknesses in systems, services, and transmission protocols. They also use system resources and bandwidth by sending large amounts of data packets that are larger than the target computer’s processing capacity, or they result in program buffer overflow errors, which prevent the target system from processing normal requests from legitimate users or from providing normal services, thus paralyzing network services.

Attacks against networked control systems can be broadly categorized into three categories: DoS attacks, assaults involving inaccurate data, and replay attacks. DoS attacks are the most typical of them. DoS attacks cause packet loss in the system by flooding important nodes in the communication network with a high number of pointless packets that prevent the receiver from responding to legitimate packets in time. Attackers can also increase the bit error rate of the data packet by interfering with the channel, which will cause the original data packet to be deleted owing to transmission problems and decrease the signal-to-interference plus noise ratio (SINR) of the network control system.

There are three types of DoS assaults that are frequently used: disseminated, IP spoofing, and direct. (1) A direct attack occurs when a significant number of falsified Transmission Control Protocol (TCP) packets are sent directly by the attacker. Because the attacker in this type of assault does not mask their IP address, the attack originates from a single source, making it simple to identify and stop the attacker. (2) IP spoofing assaults involve attackers fabricating IP addresses, which makes it harder for defenders to track down their targets. IP address forging technology can be implemented in a simple manner. Prior to writing the message to the output device and sending it to the target host, a structure with an IP message format is first formed, followed by the filling in of the structure’s source address with a fictitious IP address. DDoS: It is nearly impossible to pinpoint the origin of an attack when the attacker is in possession of a large number of infected machines and uses botnets. Some attackers may even instruct each device to fake its IP address, combining the two attack strategies and doing irreparable harm to the victim. The DDoS attack principle is depicted in Fig. 2.

Figure 2 illustrates the interaction and relationships among various roles and elements. These elements include industrial equipment, sensors, network connections, monitoring/attack, malicious attackers, attackers, control terminals, receivers, remote controllers, puppets, attack zombies, and target hosts. Firstly, elements such as “industrial equipment,” “sensors,” “control terminals,” “receivers,” and “remote controllers” in Fig. 2 represent actual components of networked control systems. They carry out functions related to information gathering, data processing, and command execution. The graphic design of these elements is based on depictions created legitimately for actual devices and is in the public domain. Secondly, the “network connections” show the communication links between various components within the network control system. This design is a symbolic representation based on a simplified version of common network topology structures. “Monitoring/attack,” “malicious attackers,” “attackers,” “puppets,” and “attack zombies” depict the actors and techniques involved in DDoS attacks. “Monitoring/attack” may symbolize the attacker’s monitoring and attacking actions against the target system. “Malicious attackers” and “attackers” refer to the unauthorized individuals initiating the attack. “Puppets” and “attack zombies” represent infected hosts controlled by the attacked party. They are typically incorporated into a botnet through malicious software to assist in executing DDoS attacks. Finally, the “target host” represents the ultimate goal of the DDoS attack—the server or network facility hosting the service that the attack aims to disrupt. Criminals call a lot of regular services from a lot of zombie hosts, which renders the service inoperable. A huge number of hosts are used in this type of attack, which is harder to defend against and has a greater success rate. When these types of network attacks happen, they are typically accompanied by a deluge of access requests, an increase in the access rate, the appearance of new Internet Protocol (IP) addresses, a decline in the number of original users, and sometimes even the appearance of data packets with special fields and functions. These anomalies represent the global state of the current network, which can help us judge whether a DoS attack is taking place or not and can also help people trace back to the IP address of the attacker.

DDoS attack detection system based on deep learning

An attack detection system is required in order to quickly determine whether the network system is being attacked by DoS. One of those that is particularly challenging to identify is a DDoS attack. The network or system state will change when this assault happens, making it possible to identify DDoS attacks based on their unique characteristics. Among them, the detection method of machine learning, is to transform the detection problem into the problem of categorizing network data by using classifiers, and divide network traffic into attack traffic and normal traffic, but the detection effectiveness is low. Deep learning, on the other hand, automatically extracts sample features, which is more advantageous when the volume of data is considerable. CNN has a positive impact on image processing. Therefore, this article converts the original traffic into the data form equal to the image on the basis of the original traffic, further processes the data, then utilizes the deep learning model to train, and ultimately completes the detection of DDoS attacks. The three stages of data processing, model training, and attack detection make up the total attack detection architecture. The schematic is displayed in Fig. 3.

The data is handled in two directions at Fig. 3’s data processing stage. The first step is to convert the original traffic data into binary values, with each data frame producing a corresponding binary bit string before producing a binary matrix. The original traffic data can also be used to generate decimal numbers according to bytes, with each data frame producing a string of decimal numbers that come together to form a decimal matrix. The modified genetic algorithm is utilized to design the topology of the CNN during the model training stage, where the already-existing data sets are used for training. The trained neural network model is used in the attack detection step to find attacks and record the classification outcomes.

This article proposes the design of a DDoS attack detection system based on deep learning, which can detect the DDoS traffic in the network to be detected in time and accurately, and then send an alarm signal to the system in time, so that the detection system can react in time and record the attack traffic in the log file. However, preventing DDoS attacks and detecting all traffic at once takes a lot of time. As a result, when the network system notices that the network traffic has suddenly changed significantly, it can conserve computational and storage resources by returning to the network attack detection state. As a result, the design of the DDoS attack detection system incorporates the following features: capturing and collecting network traffic, preprocessing the traffic collected, using genetic algorithm to determine the network structure parameters training model of CNN, and employing the trained CNN to detect attack traffic. Figure 4 displays the particular structure.

Attack detection method of incomplete samples based on GAN

In the real network system environment, different attack methods will lead to the loss of network packets. These lost data packets will lead to abnormal and incomplete traffic data, which will lead to missing and abnormal feature attributes extracted from network traffic. These incomplete network traffic eigenvalues will directly affect the detection performance of existing network system attack detection models. The main structure of generative adversarial network (GAN) includes a G (Generator) and a D (Discriminator). The expression is: (1)min G max D V D , G = E x ∼ p data x log D x + E z ∼ p z z log 1 − D G z

where D and G represent Generator and Discriminator networks, which can be understood as the mapping of two functions. D is used to judge whether the data is true or not, that is, the probability D(x) that data X is true is obtained, and G generates data G(z) from noise Z. V is Value, which can be understood as Variation between real samples and generated samples. min_Gmax_D means: firstly, G is fixed, and adjust the parameters of D so that it can judge whether the sample is real or generated to the maximum extent. Then, D is fixed, and the parameters of G are adjusted to minimize the difference between the generated sample and the real sample. By repeating G, data very close to the discriminator D can be generated, and D has better discriminating ability.

Wasserstein generative adversarial network-gradient penalty (WGAN-GP) is put forward to solve the existing problems of Wasserstein generative adversarial network (WGAN), and the Lipschitz constraint condition is constrained by gradient penalty instead of weight clipping method. Combining the advantages of Conditional GAN (CGAN) to specify the class samples, this article proposes an improved Conditional Wasserstein GAN-GP (CWGAN-GP), with the objective function as follows: (2)L = E x̀ − P z D x̀ | y − E x − P r D x | y ︸ Original critic loss + λ E x̀ − P x ∇ x̀ D x̀ | y 2 − 1 2 ︸ Gradien penalty (3)x̀ = G z | y (4)x̀ = ϵ X + 1 − ϵ x̀

where ϵ represents a random variable and ϵ ∼ 𝕌[0, 1]. λ represents the penalty factor and is set to 10. ℙ_x̀ represents a uniform sampling distribution along a straight line between the true data distribution ℙ_r and the false data distribution ℙ_g. Then, combining CWGAN-GP and WGANInverter, this article proposes an ICWGANInverter.

First, the training sample set (X, Y) is used to train a CWGAN-GP, and then an inverse generator I r is trained to inverse the given real sample x to the potential space vector z′ of the pre-trained CWGAN-GP model, and then the generator G θ of CWGAN-GP can reconstruct the image x̀ from the inverse potential coding z′. The loss function of CWGAN-GP is composed of discriminator loss, generator loss and reconstruction loss, and its discriminator loss function is: (5)L dis = E x = P s D φ x̀ | y − E x − P p D φ x | y ︸ Original critic loss + λ E x̀ − P x̀ ∇ x̀ D φ x´ | y 2 − 1 2 ︸ Gradient penally

The loss function L g e n of the generator is calculated as follows: (6)L g e n = − E z ∼ p t z D φ G θ z | y

The reconstruction loss L rec is calculated as follows: (7)L rec = min y E x − p x x G θ I y x | y − x + λ ⋅ E z − p z = L z , I γ G θ z | y (8)x̀ = G θ z | y

where ℙ_r represents the distribution of real sample data, ℙ_g represents the distribution of generated sample data, and ℙ_x̀ represents the uniform sampling from the straight line between two points of real data distribution ℙ_r and generator generated data distribution ℙ_g. If L₂ distance is used as the loss of L z , I y G θ z | y, the λ value is 0.1. If Jensen–Shannon (JS) divergence is used as the loss of L z , I γ G θ z | y, λ is 1.

Then ICWGANInverter is used to build a DoS attack detection model, which automatically learns the high-level abstract information of the original data, and then uses the reconstruction error method to identify the best classification label. The specific architecture diagram is shown in Fig. 5.

In Fig. 5, the original test sample and the prediction category label are utilized as the input of the model, and the input test sample can be reconstructed after the prediction category label of the test sample with partial characteristics is achieved in feature reconstruction. In specifically, the attacker wants to lower the far-end estimator’s estimation accuracy by causing packet loss through the assault. DoS attacks can involve obstructing communication lines or sending a lot of pointless data packets. An attacker who can listen in on the system channel can find out some important information that is transmitted there by watching the channel and using other methods.

Experimental design

The NSL-KDD dataset is utilized as intrusion detection data to test the efficacy of the aforementioned DoS attack detection approach. Despite the fact that this data set might not accurately reflect the current real network, it can nevertheless be used as a benchmark to help researchers compare various intrusion detection strategies. Also, there are no duplicate records in either the training set or the test set, and the distribution of data across both sets is more evenly distributed. To assess the efficacy of the aforementioned model and contrast it with other well-known network attack detection models, some discrete properties of the dataset NSL-KDD are eliminated from the experiment. Protocol, flag, and service are the three symbolic elements included in the NSL-KDD dataset. By removing one of the feature values at random, an incomplete feature data set is created. KDDTest+ and KDDTest-21 are two of the NSL-KDD dataset’s sub-datasets. The NSL-KDD dataset offers several advantages over the original KDD dataset: it does not contain redundant records in the training set, preventing classifiers from favoring more frequent records. The proposed test set does not include duplicate records, ensuring that the learner’s performance is not biased towards methods with better detection rates for frequent records. The number of records selected from each difficulty level group is inversely proportional to the percentage of records in the original KDD dataset. This results in a larger variation in classification rates for different machine learning methods, making it more effective to accurately assess different learning techniques. The number of records in both the training and test sets is reasonable, allowing experiments to be run on the entire set without the need for random selection of a small portion. Consequently, evaluation results from different research efforts are consistent and comparable. The NSL-KDD dataset includes the following files:

KDDTrain+.ARFF: The complete NSL-KDD training set with binary labels in Attribute-Relation File Format (ARFF) format.

KDDTrain+.TXT: The complete NSL-KDD training set, including Comma Separate Values (CSV) formatted attack type labels and difficulty levels.

KDDTrain+_20Percent.ARFF: A 20% subset of the KDDTrain+.arff file.

KDDTrain+_20Percent.TXT: A 20% subset of the KDDTrain+.txt file.

KDDTest+.ARFF: The complete NSL-KDD test set with binary labels in ARFF format.

KDDTest+.TXT: The complete NSL-KDD test set, including CSV formatted attack type labels and difficulty levels.

KDDTest-21. ARFF: A subset of the KDDTest+.arff file excluding records with difficulty level 21 (out of 21 levels).

KDDTest-21.TXT: A subset of the KDDTest+.txt file excluding records with difficulty level 21 (out of 21 levels).

The dataset can be accessed at: https://www.kaggle.com/datasets/hassan06/nslkdd. The NSL-KDD dataset includes five types of network data: Normal, DoS, User to Root (U2R), Remote to Local (R2L) and Probe. The data can be found at Mendeley: DOI 10.17632/pcfccfnvj2.1.

In this article, KDDTest+ and KDDTest-21 datasets have the problem of category imbalance, that is, the number of positive (DoS attack) and negative (non-attack) samples is quite different. In order to deal with this challenge effectively, the method of adjusting the category weight is adopted, and the sample weight is adjusted when training the deep learning model, so that the model pays more attention to a few categories, thus improving the accuracy of its recognition. Specifically, the concept of class weights is used to balance the attention of the model to different types of samples in the training process by giving different weights to different categories. This method can introduce the weight term into the loss function, which makes the model pay more attention to the learning of a few categories, thus improving the performance on unbalanced datasets. The calculation of category weight is usually based on the frequency of category, and the specific calculation is shown in (Eq. 9): (9)w c = N K × n c

In Eq. 9, w_c is the weight of category c. N is the total number of samples, K is the total number of categories, and n_c is the number of samples of category c. In the training process, these category weights are used for the loss items of the corresponding categories, so that the model can learn the characteristics of each category more evenly. This strategy of weight adjustment is helpful to improve the sensitivity of the model to a few categories to better adapt to the imbalance of data. In the experiment of this article, the category weights are calculated according to KDDTest+ and KDDTest-21 datasets, and applied to the training process of deep learning model to improve the detection performance of DoS attacks.

The evaluation indexes are accuracy, recall, precision, false positive rate (FPR), F1-score, G-mean and Area Under ROC Curve (AUC).

The calculation equation is as follows:

(10)FPR = F P T N + F P (11)Accuracy = TP T P + F P (12)Recall = T P T N + F P (13)Precision = F P T N + F P (14)F 1 = 2 ∗ Precision*Recall Precision + Recal .

In order to evaluate the performance of ICWGANInverter model more comprehensively, Matthews correlation coefficient (MCC) is introduced as an additional evaluation index. MCC is an evaluation standard that comprehensively considers the indexes of binary confusion matrix, and its range is between −1 and 1. The closer the value is to 1, the better the classification performance, 0 means random classification, and −1 means completely opposite classification. Equation 15 shows the calculation method of MCC: (15)MCC = T P × T N − F P × F N T P + F P T P + F N T N + F P T N + F N .

In the above equation, TP is the number of positive samples correctly classified, TN is the number of negative samples correctly classified, FP is the number of positive samples wrongly classified, and FN is the number of positive samples wrongly classified as negative samples.

Experimental environment and parameter setting

The experiment runs in Windows 10 64-bit operating system (64 GB RAM, Intel 5-2620 CPU, ThinkStation workstation). Using Python programming language and TensorFlow deep learning framework, it is used to build, train and evaluate deep learning models. Pandas and Matplotlib are used to process and visualize experimental data. Jupyter Notebooks are used to organize and run the experimental code in an interactive way, which is convenient for the visualization and debugging of the experimental process. (n_x, n_z × 8, n_z × 4, n_z × 2, n_z); The number of units in each layer of the decoder (n_z + n_y, n_z × 2, n_z × 4, n_z × 8, n_x); Number of units in each layer of discriminator (40,20,10). In order to ensure the repeatability of the experiment and the reliability of the results, the following hyperparameters in Table 1 are used when training the ICWGANInverter model:

Detection results of continuous incomplete feature attacks

On the NLS-KDD dataset, the continuous eigenvalues are noisy, and the noisy training set and test set are created. The ICWGANInverter model is trained using the noisy data set after performing feature reconstruction and classification under various noise factors. The mean square error is obtained when the eigenvalues of the reconstructed continuous features are tested on the sub-datasets KDDTest+ and KDDTest-21, and the results are displayed in Fig. 6.

In Fig. 6, with the increase of noise factor, the mean square error of continuous feature reconstruction of ICWGANInverter model on KDDTest+ and KDDTest-21 noisy test sets also increases gradually, which shows that the feature reconstruction ability of ICWGANInverter model is inversely proportional to the noise intensity. When λ value is 0, there is no noise and the model error is the smallest. When λ value is 1, there is no noise and the model error is the largest. It shows that the model has approximately equal feature reconstruction ability for different noises and has high robustness. The overall test performance is shown in Fig. 7.

In Fig. 7, with the increase of the value of noise factor λ, the values of Accuracy, Recall, Precision, F1-score, G-mean and FPR all fluctuate to a certain extent, and generally show a downward trend. It shows that the stronger the noise, the lower the attack detection performance of the test samples, which shows that ICWGANInverter model is sensitive to the deviation of continuous eigenvalues.

On KDDTest+ and KDDTest-21 noisy test sets of ICWGANInverter model, the receiver operating characteristic curve (ROC) and AUC value under different noise factors are shown in Figs. 8 and 9.

The overall AUC values of macro-average and micro-average are over 0.8 in Figs. 8 and 9, and the ROC curves are shown in the upper end of the diagonal. This shows that the ICWGANInverter model has good detection performance in both single-class attack detection and overall attack detection. Moreover, the AUC value of a single category decreases with increasing noise factor values, demonstrating that detection performance declines with increasing noise intensity.

Performance comparison of different attack detection models

In order to further verify the DoS attack detection performance of the ICWGANInverter model proposed in this article, the performance of similar methods proposed in Wang et al. (2022) and Aldhyani & Alkahtani (2023) on NSL-KDD noisy (λ =0) datasets is compared. The result is shown in Fig. 10.

Figure 10’s results demonstrate that, in comparison to other models, the ICWGANInverter model put forward in this article has an accuracy of 87.79%, a recall value of 83.79%, an F1-score value of 87.37%, and an FPR value of 8.26% on KDDTest+ data sets. For the KDDTest-21 dataset, the DoS attack detection accuracy is 75.93%, the recall value is 77.15%, the F1-score value is 83.10%, and the FPR value is 28.16%. The advantages of the detection model in this article are demonstrated by the fact that it outperforms the detection models in Wang et al. (2022) and Aldhyani & Alkahtani (2023) in every way.

MCC evaluation of ICWGANInverter model shows that the model has excellent DoS attack detection performance on KDDTest+ and KDDTest-21 data sets. Compared with the models in Wang et al. (2022) and Aldhyani & Alkahtani (2023), the proposed model shows obvious advantages in many evaluation indexes. In terms of Matthews correlation coefficient (MCC), the MCC value of ICWGANInverter model on KDDTest+ data set is 0.750, which is significantly higher than 0.680 in Wang et al. (2022) and 0.720 in Aldhyani & Alkahtani (2023). On the KDDTest-21 dataset, the MCC value of this model is 0.650, which is also higher than the other two models (0.610 and 0.630 respectively). These results fully prove the excellent performance of ICWGANInverter model in dealing with distributed DoS attack traffic.

In addition, the training time of the model on KDDTest+ dataset is 12 min, the detection time is 5.6 ms, and the detection speed reaches 180 samples per millisecond. On KDDTest-21 dataset, although the training time is slightly longer (14 min) and the detection time is increased to 8.2 ms, the detection speed is still as high as 150 samples per millisecond. This is a very rare and valuable performance in the current DoS attack detection field. To sum up, ICWGANInverter model is superior to the existing similar research in comprehensive performance of DoS attack detection, which not only shows outstanding detection accuracy, but also has advantages in practical application efficiency.

Figure 11 shows the detection results of different types of data in NSL-KDD dataset by different models. ICWGANInverter model performs well in Normal type, reaching the detection accuracy of 97.21%, but it drops slightly in DoS type, reaching 84.77%. On the types of Probe and R2L, the performance of ICWGANInverter model is obviously lower than the other two algorithms, which are 66.25% and 21.37% respectively. On U2R type, the detection accuracy of ICWGANInverter model is 7.00%. In contrast, Wang et al. (2022) performs relatively well in Normal and Probe types, accounting for 97.37% and 68.86% respectively, but its performance in DoS and R2L types is poor, accounting for 81.47% and 2.73% respectively. Aldhyani & Alkahtani (2023) has a relatively high accuracy rate (97.27%) in Normal type, but the detection accuracy rate in DoS, Probe and U2R types is relatively low, which are 79.38%, 62.21% and 4.50% respectively. Different algorithms have obvious differences in different types, which shows that various classification algorithms do not have advantages for all types of data, but each has its own advantages. Considering the advantages of each algorithm, people can try to optimize the combination of algorithms in the future to improve the overall detection effect.

The detection performance of ICWGANInverter model on NSL-KDD dataset for different types of network attacks and normal traffic is evaluated separately. In particular, the following five types of data are analyzed in detail: Normal, DoS, U2R, R2L and Probe. For each type of network data, a confusion matrix is generated to visually show the performance of the model.

There are 1,250 samples actually classified as DoS attacks, 1,200 samples correctly predicted as DoS attacks by ICWGANInverter model, and 50 samples predicted as non-DoS attacks. There are 1,250 samples which are actually classified as non-DoS attacks, 1,180 samples are correctly predicted as non-DoS attacks and 70 samples are predicted as DoS attacks by ICWGANInverter model. Similarly, a confusion matrix will be constructed for normal traffic, U2R, R2L and Probe attacks. Table 2 shows the confusion matrix under different conditions:

According to the confusion matrix, the calculated evaluation indexes include accuracy, recall, precision, F1 score, false positive rate (FPR) and G-means. The following are the evaluation results of various traffic and attacks: normal traffic: accuracy: 96.29%, recall: 96.43%, precision: 95.00%, F1 score: 95.21%, false alarm rate: 5.38%, G-means: 95.77%. U2R attack: accuracy: 97.86%, recall: 84.62%, precision: 78.57%, F1 score: 81.75%, FPR: 2.36%, G-means: 92.07%. R2L attack: accuracy: 98.57%, recall: 90.00%, precision: 81.82%, F1 score: 85.33%, FPR: 1.59%, G-means: 94.52%. Probe attack: accuracy: 97.50%, recall: 79.31%, precision: 85.19%, F1 score: 82.86%, FPR: 1.60%, G-mean: 89.07. To sum up, ICWGANInverter model is excellent in detecting different types of network attacks and normal traffic. Specifically, the model performs best in detecting normal traffic and R2L attacks, followed by U2R attacks and Probe attacks.