IoT DoS and DDoS Attack Detection using ResNet

TL;DR

This paper presents a novel approach using ResNet, a deep learning CNN model, to detect IoT DoS and DDoS attacks by converting network traffic into images, achieving high accuracy and improved attack pattern recognition.

Contribution

The study introduces a method to transform network traffic data into images and applies ResNet for effective IoT DoS and DDoS attack detection, outperforming existing techniques.

Findings

Achieved 99.99% accuracy in binary attack detection.

Attained 87% average precision in recognizing 11 attack types.

Outperformed state-of-the-art methods by 9% in attack pattern recognition.

Abstract

The network attacks are increasing both in frequency and intensity with the rapid growth of internet of things (IoT) devices. Recently, denial of service (DoS) and distributed denial of service (DDoS) attacks are reported as the most frequent attacks in IoT networks. The traditional security solutions like firewalls, intrusion detection systems, etc., are unable to detect the complex DoS and DDoS attacks since most of them filter the normal and attack traffic based upon the static predefined rules. However, these solutions can become reliable and effective when integrated with artificial intelligence (AI) based techniques. During the last few years, deep learning models especially convolutional neural networks achieved high significance due to their outstanding performance in the image processing field. The potential of these convolutional neural network (CNN) models can be used to efficiently detect the complex DoS and DDoS by converting the network traffic dataset into images. Therefore, in this work, we proposed a methodology to convert the network traffic data into image form and trained a state-of-the-art CNN model, i.e., ResNet over the converted data. The proposed methodology accomplished 99.99\% accuracy for detecting the DoS and DDoS in case of binary classification. Furthermore, the proposed methodology achieved 87\% average precision for recognizing eleven types of DoS and DDoS attack patterns which is 9\% higher as compared to the state-of-the-art.