Real-time DDoS flood attack monitoring and detection (RT-AMD) model for cloud computing

Area of Science:

• Cloud Computing
• Cybersecurity
• Machine Learning

Background:

• Cloud computing offers on-demand resources but faces significant threats like distributed denial of service (DDoS) attacks.
• DDoS attacks pose a serious risk to cloud service availability and integrity.
• Effective real-time monitoring and detection are crucial for cloud security.

Purpose of the Study:

• To develop and evaluate a machine learning model for real-time detection of DDoS attacks in cloud environments.
• To assess the performance of various machine learning classifiers in identifying DDoS flood attacks.
• To propose a novel predictive model, RT-AMD, for enhanced cloud security.

Main Methods:

• Utilized machine learning classifiers including Naïve Bayes, K-nearest neighbor, decision tree, and random forest.
• Developed a predictive model named Real-Time DDoS flood Attack Monitoring and Detection (RT-AMD).
• Evaluated the RT-AMD model on the DDoS-2020 dataset (70,020 records) and the NSL-KDD dataset, focusing on TCP, DNS, and ICMP protocols.

Main Results:

• The proposed RT-AMD model demonstrated high accuracy in detecting DDoS attacks.
• Random forest classifier achieved 99.38% accuracy in real-time cloud detection and 99.39% in local testing.
• RT-AMD achieved 99.30% accuracy in real-time cloud detection on the NSL-KDD dataset.

Conclusions:

• The RT-AMD model effectively enables real-time monitoring and detection of DDoS attacks in cloud environments.
• Incremental learning contributed to the model's real-time attack detection capabilities.
• The proposed approach shows significant improvements over related works, enhancing cloud security against DDoS threats.