Source-linked AI summary
IoT DoS and DDoS Attack Detection using ResNet
Faisal Hussain, Syed Ghazanfar Abbas, Muhammad Husnain, Ubaid Ullah Fayyaz, Farrukh Shahzad, Ghalib A. Shah
TL;DR
IoT DoS and DDoS attacks are increasingly frequent and difficult for static rule-based defenses to detect, especially when datasets omit modern attacks. The paper converts network traffic into three-channel images, trains ResNet on the transformed data, and reports 99.99% binary accuracy and 87.06% multiclass accuracy, with higher precision than a state-of-the-art solution.
Problem
Existing IoT defenses and datasets struggle with complex, modern DoS and DDoS attacks, while CNNs perform poorly on non-image network traffic.
Method
The study selects CICDDoS2019, converts cleaned network traffic into three-channel images, and trains and tests ResNet for attack detection.
Results
99.99% accuracy was achieved for binary detection, while multiclass testing achieved 87.06% accuracy and 9% higher precision than the state-of-the-art solution.
Takeaways & Limitations
ResNet applied to transformed network-traffic images recognized binary and eleven-class DoS and DDoS patterns within the evaluated IoT dataset.
Abstract
from arXiv · showhide
The network attacks are increasing both in frequency and intensity with the rapid growth of internet of things (IoT) devices. Recently, denial of service (DoS) and distributed denial of service (DDoS) attacks are reported as the most frequent attacks in IoT networks. The traditional security solutions like firewalls, intrusion detection systems, etc., are unable to detect the complex DoS and DDoS attacks since most of them filter the normal and attack traffic based upon the static predefined rules. However, these solutions can become reliable and effective when integrated with artificial intelligence (AI) based techniques. During the last few years, deep learning models especially convolutional neural networks achieved high significance due to their outstanding performance in the image processing field. The potential of these convolutional neural network (CNN) models can be used to efficiently detect the complex DoS and DDoS by converting the network traffic dataset into images. Therefore, in this work, we proposed a methodology to convert the network traffic data into image form and trained a state-of-the-art CNN model, i.e., ResNet over the converted data. The proposed methodology accomplished 99.99\% accuracy for detecting the DoS and DDoS in case of binary classification. Furthermore, the proposed methodology achieved 87\% average precision for recognizing eleven types of DoS and DDoS attack patterns which is 9\% higher as compared to the state-of-the-art.
I. INTRODUCTION
IoT DoS and DDoS attacks are increasing, while rule-based defenses struggle with complex and modern attack traffic. The paper proposes converting network traffic into images so ResNet can detect these patterns more effectively.
- Motivation: IoT security is increasingly important as DoS and DDoS attacks become common and intensify in frequency and volume.The paper reports an average of 28.7K attacks per day and cites a projected 15.4 million DDoS attacks by 2023.
- Motivation: Traditional firewalls, IDS, and IPS struggle with complex DDoS attacks because they rely on static predefined rules.AI-based filtering is described as more reliable and effective than static rules.
- Research gap: CNNs are effective for image patterns but perform poorly or overfit on low-dimensional, non-image network traffic datasets.The paper therefore identifies a need to transform network traffic into a representable image form before CNN training.
- Research gap: Existing IoT attack detectors may miss modern reflective attacks because their training datasets are outdated or incomplete.Examples include NetBIOS, NTP, SSDP, and UDP Lag attacks in CICDDoS2019.
- Contribution: The proposed methodology normalizes network traffic into three-channel images and applies ResNet to detect DoS and DDoS attack patterns.Unlike prior image-conversion approaches using encoding or FFT, the method uses normalization instead.
II. PROBLEM STATEMENT
The problem is to detect complex and current DoS and DDoS attacks using CNNs despite their limited performance on non-image or low-dimensional network data.
- Problem statement: DoS and DDoS attacks are common in IoT, but existing solutions cannot reliably detect complex attacks.The paper attributes this limitation partly to outdated datasets that omit modern reflective attacks.
- Problem statement: CNNs are designed for computer-vision patterns and do not perform efficiently when trained directly on non-image or low-dimensional network traffic.The proposed problem setting therefore requires transforming traffic into image form before CNN-based detection.
III. PROPOSED METHODOLOGY
The proposed methodology acquires and preprocesses IoT traffic, converts cleaned data into three-channel images, and trains and tests a CNN for attack-pattern recognition.
- Proposed methodology: The methodology has four steps: data acquisition, data cleaning, data conversion, and attack pattern recognition.The final stage trains and tests the CNN on preprocessed data.
A. Data Acquisition
The study selects CICDDoS2019 to provide extensive, real-time traffic containing current DoS and DDoS attack types and varied attack vectors.
- A. Data Acquisition: The acquisition stage obtains both normal and attack traffic, using public datasets to avoid the resources and cost of generating extensive real-time traffic.Dataset selection is based on real-time traffic, breadth, current attacks, and varied attack vectors.
- A. Data Acquisition: CICDDoS2019 was selected because it contains extensive real-time inbound and outbound traffic from current DoS and DDoS attacks.It provides more than 80 network-flow features and eleven attack types.
B. Data Preprocessing
Data preprocessing refines the acquired network traffic data through cleaning, conversion, and train–test–validation splitting.
- Preprocessing comprises data cleaning, data conversion, and train–test–validation splitting.
1) Data Cleaning:
The cleaning stage removes irrelevant, malformed, missing, duplicate, and constant information before model training.
- Irrelevant flow identifiers, addresses, ports, protocol, and timestamp features are removed because static values cannot determine traffic class.
- Samples containing missing or malformed values are dropped from the dataset.
- The converted images represent eleven attack categories and normal traffic as classes C0 through C11.
- Constant features are removed because they cannot discriminate attack from normal traffic and may reduce model performance.
2) Data Conversion:
Network traffic is normalized and transformed into RGB images so CNN models can process the non-image dataset.
- Each feature is normalized using (1) to support conversion of network traffic into image form.
- Samples are separated into normal and attack data frames before image construction.
- The ResNet18 training and testing workflow operates on the converted image dataset.
- Chunks of 180 samples become 60x60x3 RGB images by mapping three successive 60-sample groups to three channels.
3) Train and Test Split:
After image conversion, the dataset is divided into training, validation, and testing sets using category-specific test sampling.
- The dataset is split after conversion into training, validation, and testing sets.
- Testing randomly selects 2500 images from each category, while remaining images are used for training.
- Categories with fewer than 2500 images contribute all available images to the testing set.
C. Attack Detection
The methodology trains and tests a ResNet18 model on transformed network-traffic images, adapting its output layer for binary or multi-class attack prediction.
- ResNet18 uses 18 layers, including 10 convolutional and 8 pooling layers, to learn attack and normal traffic patterns.
- The preprocessed 60 x 60 x 3 images are transformed to 224 x 224 x 3 to match ResNet’s expected input size.
- The final ResNet layer is changed to one output class for binary classification and 12 output classes for multi-class classification.
- Testing loads unrevealed test images, applies the same transformation, predicts labels, and compares them with actual labels for performance measurement.
IV. RESULTS AND DISCUSSION
The study evaluates detection with precision, recall, accuracy, and F1-measure, reporting strong binary and multi-class results and improvements over a state-of-the-art solution.
- Precision measures correctly detected attacks among packets classified as attacks, while recall measures correct attack detection after a security breach.
- Accuracy measures correct attack and normal classifications across all samples, and F1-score is the harmonic mean of precision and recall.
- 99.99% accuracy was achieved for binary DoS and DDoS detection.
- 87.06% accuracy was achieved for multi-class classification of 11 attack classes.
- 9% higher precision, 21% higher recall, and 17% higher F1-score were achieved than the state-of-the-art solution on the same dataset.
V. CONCLUSION
The study converts non-image IoT network traffic into three-channel images and applies ResNet to detect DoS and DDoS attacks. It reports strong binary-detection performance and evaluates recognition of multiple attack patterns.
- V. CONCLUSION: The methodology converts non-image network traffic data into three-channel image form for CNN-based attack detection.The approach normalizes features without using an encoding scheme or transformations such as fast Fourier transformation.
- V. CONCLUSION: ResNet is trained on the transformed dataset to detect the latest DoS and DDoS attacks.
- V. CONCLUSION: The proposed methodology achieves 99.99% accuracy for binary DoS and DDoS detection.