Recurrent autonomous autoencoder for intelligent DDoS attack mitigation within the ISP domain.

Area of Science:

• Cybersecurity
• Network Security
• Artificial Intelligence

Background:

• Distributed Denial of Service (DDoS) attacks are increasingly sophisticated, especially with the proliferation of IoT devices on 5G networks.
• Existing DDoS mitigation systems struggle with the complexity and scale of modern attacks.
• Deep Learning algorithms offer potential for improved DDoS mitigation performance.

Purpose of the Study:

• To develop an Intelligent Attack Mitigation (IAM) system for effective DDoS flood attack mitigation.
• To address the challenge of unlabelled real-world DDoS attack data using unsupervised learning.
• To enhance the performance and scalability of DDoS mitigation systems.

Main Methods:

• An ensemble approach utilizing Recurrent Autonomous Autoencoders (RAA) as basic learners with a majority voting scheme.
• Development of a novel Comparison-Max Random Walk algorithm to determine a Reference Target (RT) for data classification.
• Proposal of Estimated Evaluation Metrics (EEM) for evaluating unsupervised models.
• Testing the IAM system on various DDoS attack types (UDP, TCP, ICMP flood, multi-vector) and real attack data.

Main Results:

• The IAM system demonstrated robust performance across diverse DDoS attack scenarios.
• The system achieved an average Recall of over 98% on all tested datasets.
• Scalability was confirmed through testing on subdivided datasets for distributed computing.

Conclusions:

• The proposed IAM system, leveraging RAA and a novel RT determination, effectively mitigates DDoS flood attacks.
• The system's unsupervised approach and high recall rate offer a significant advancement in network security.
• The IAM system provides a scalable and effective solution for defending against evolving cyber threats.