High-Speed Network DDoS Attack Detection: A Survey

• Published in: Sensors (Basel, Switzerland) Switzerland), 2023-08, Vol.23 (15), p.6850
• Main Authors: Haseeb-Ur-Rehman, Rana M Abdul, Aman, Azana Hafizah Mohd, Hasan, Mohammad Kamrul, Ariffin, Khairul Akram Zainol, Namoun, Abdallah, Tufail, Ali, Kim, Ki-Hyung
• Format: Article
• Language: English
• Subjects: Big Data; Cloud computing; Communication; Communications networks; Computers; cyber–physical system; Data processing; Data transmission; denial of service; Denial of service attacks; Detectors; distributed denial of service; Ethernet; Global positioning systems; GPS; high-speed network; Internet of Things; intrusion detection system; machine learning; Network interface cards; Network security; Review; Safety and security measures; Smartphones; Software; Taxonomy
• ISSN: 1424-8220; 1424-8220
• DOI: 10.3390/s23156850

Having a large number of device connections provides attackers with multiple ways to attack a network. This situation can lead to distributed denial-of-service (DDoS) attacks, which can cause fiscal harm and corrupt data. Thus, irregularity detection in traffic data is crucial in detecting malicious behavior in a network, which is essential for network security and the integrity of modern Cyber-Physical Systems (CPS). Nevertheless, studies have shown that current techniques are ineffective at detecting DDoS attacks on networks, especially in the case of high-speed networks (HSN), as detecting attacks on the latter is very complex due to their fast packet processing. This review aims to study and compare different approaches to detecting DDoS attacks, using machine learning (ML) techniques such as k-means, K-Nearest Neighbors (KNN), and Naive Bayes (NB) used in intrusion detection systems (IDSs) and flow-based IDSs, and expresses data paths for packet filtering for HSN performance. This review highlights the high-speed network accuracy evaluation factors, provides a detailed DDoS attack taxonomy, and classifies detection techniques. Moreover, the existing literature is inspected through a qualitative analysis, with respect to the factors extracted from the presented taxonomy of irregular traffic pattern detection. Different research directions are suggested to support researchers in identifying and designing the optimal solution by highlighting the issues and challenges of DDoS attacks on high-speed networks.