Modelling DDoS Attacks in IoT Networks using Machine Learning

Abstract

In current Internet-of-Things (IoT) deployments, a mix of traditional IP networking and IoT specific protocols, both relying on the TCP protocol, can be used to transport data from a source to a destination. Therefore, TCP-specific attacks, such as the Distributed Denial of Service (DDoS) using the TCP SYN attack, are one of the most plausible tools that attackers can use on Cyber-Physical Systems (CPS). This may be done by launching an attack from its IoT subsystem, here referred to as the "CPS-IoT", with potential propagation to the different servers located in both fog and the cloud infrastructures of the CPS. This study compares the effectiveness of supervised, unsupervised, and semi-supervised machine learning algorithms for detecting DDoS attacks in CPS-IoT, particularly during data transmission to and from the physical space to the cyber space via the Internet. The algorithms considered are broadly grouped into two: i) Detection algorithms, which include Logistic Regression (LGR), K-Means, and Artificial Neural Networks (ANN). We also looked into the effectiveness of semi-supervised hybrid learning models, which use unsupervised K-Means to label data, then feed the output to a supervised learning model for attack detection. ii.) Prediction algorithms - LGR, Kernel Ridge Regression (KRR) and Support Vector Regression (SVR), which were used to predict imminent attacks. Experimental tests were carried out and obtained results showed that the hybrid model was able to achieve 100% accuracy with zero false positives; while all the prediction models were able to achieve over 94% attack prediction accuracy.