TY - JOUR
T1 - Locally weighted classifiers for detection of neighbor discovery protocol distributed denial-of-service and replayed attacks
AU - Alsadhan, Abeer
AU - Hussain, Abir
AU - Liatsis, Panos
AU - Alani, Mohammed
AU - Tawfik, Hissam
AU - Kendrick, Phillip
AU - Francis, Hulya
N1 - Publisher Copyright:
© 2019 John Wiley & Sons, Ltd.
PY - 2022/3
Y1 - 2022/3
N2 - The Internet of things requires more internet protocol (IP) addresses than IP version 4 (IPv4) can offer. To solve this problem, IP version 6 (IPv6) was developed to expand the availability of address spaces. Moreover, it supports hierarchical address allocation methods, which can facilitate route aggregation, thus limiting expansion of routing tables. An important feature of the IPv6 suites is the neighbor discovery protocol (NDP), which is geared towards substitution of the address resolution protocol in router discovery and function redirection in IPv4. However, NDP is vulnerable to denial-of-service (DoS) attacks. In this contribution, we present a novel detection method for distributed DoS (DDoS) attacks, launched using NDP in IPv6. The proposed system uses flow-based network representation, instead of a packet-based one. It exploits the advantages of locally weighted learning techniques, with three different machine learning models as its base learners. Simulation studies demonstrate that the intrusion detection method does not suffer from overfitting issues and offers lower computation costs and complexity, while exhibiting high accuracy rates. In summary, the proposed system uses six features, extracted from our bespoke dataset and is capable of detecting DDoS attacks with 99% accuracy and replayed attacks with an accuracy of 91.17%, offering a marked improvement in detection performance over state-of-the-art approaches.
AB - The Internet of things requires more internet protocol (IP) addresses than IP version 4 (IPv4) can offer. To solve this problem, IP version 6 (IPv6) was developed to expand the availability of address spaces. Moreover, it supports hierarchical address allocation methods, which can facilitate route aggregation, thus limiting expansion of routing tables. An important feature of the IPv6 suites is the neighbor discovery protocol (NDP), which is geared towards substitution of the address resolution protocol in router discovery and function redirection in IPv4. However, NDP is vulnerable to denial-of-service (DoS) attacks. In this contribution, we present a novel detection method for distributed DoS (DDoS) attacks, launched using NDP in IPv6. The proposed system uses flow-based network representation, instead of a packet-based one. It exploits the advantages of locally weighted learning techniques, with three different machine learning models as its base learners. Simulation studies demonstrate that the intrusion detection method does not suffer from overfitting issues and offers lower computation costs and complexity, while exhibiting high accuracy rates. In summary, the proposed system uses six features, extracted from our bespoke dataset and is capable of detecting DDoS attacks with 99% accuracy and replayed attacks with an accuracy of 91.17%, offering a marked improvement in detection performance over state-of-the-art approaches.
UR - http://www.scopus.com/inward/record.url?scp=85070063121&partnerID=8YFLogxK
U2 - 10.1002/ett.3700
DO - 10.1002/ett.3700
M3 - Article
AN - SCOPUS:85070063121
SN - 2161-5748
VL - 33
JO - Transactions on Emerging Telecommunications Technologies
JF - Transactions on Emerging Telecommunications Technologies
IS - 3
M1 - e3700
ER -