Distributed Denial of Service Attack Detection using Naïve Bayes and K-Nearest Neighbor for Network Forensics

Abstract

The detection of anomaly traffic has become one of the principal directions in the field of network security intending to identify the attacks based on the specific deviations of the captured traffic. The cybercrime rate is increasing, capabilities of the cyber terrorists and hackers are growing at a higher rate. Today there is a requirement for the innovation and exploration for the mitigation of DDoS attacks. One of the most popular attacks in different layers of the network is Distributed Denial of Service (DDoS) a malicious try to interrupt regular traffic of a directed server, service, or network by irresistible to the target of its nearby infrastructure with anomalous flood traffic to the legitimate servers. An attacker usually targets for gaining access to virtual things like servers, applications, networks and sometimes targets particular transactions in an application. The detection of anomalous network traffic is one of the main challenging problems. Measures taken to stand as a wall of protection are intrusion detection systems and firewalls, which are still insufficient because day by day, there are different types of attacks happening, so these pillars are to be updated regularly. The predictive analytics methodology used for the detection of anomalous network traffic is by using statistical differences and alternate methods to improve detection performance based on Machine learning using statistical features of the dataset. This paper presents a detection model for DDoS attacks to enhance enterprise network security via machine learning. The machine learning framework extracts the high-level features and identifies the hidden patterns from network traffic and detects the DDoS attacks. The experimental results demonstrate the better performance of K- nearest neighbor and naïve bayes algorithms compared with the conventional learning models.