A Gated Recurrent Unit Deep Learning Model to Detect and Mitigate Distributed Denial of Service and Portscan Attacks

• Published in: IEEE access 2022, Vol.10, p.73229-73242
• Main Authors: Brandao Lent, Daniel M., Novaes, Matheus P., Carvalho, Luiz F., Lloret, Jaime, Rodrigues, Joel J. P. C., Proenca, Mario Lemes
• Format: Article
• Language: English
• Subjects: Anomalies; Anomaly detection; Control equipment; Cybersecurity; Datasets; Deep learning; Denial of service attacks; Downtime; Feature extraction; Fuzzy logic; gated recurrent unit; Logic gates; Neural networks; Security; Software; Software-defined networking; software-defined networks
• ISSN: 2169-3536; 2169-3536
• DOI: 10.1109/ACCESS.2022.3190008

Nowadays, it is common for applications to require servers to run constantly and aim as close as possible to zero downtime. The slightest failure might cause significant financial losses and sometimes even lives. For this reason, security and management measures against network threats are fundamental and have been researched for years. Software-defined networks (SDN) are an advancement in network management due to their centralization of the control plane, as it facilitates equipment setup and administration over the local network. However, this centralization makes the controller a target to denial of service attacks (DoS). In this study, we aim to develop a network anomaly detection and mitigation system that uses gated recurrent unit (GRU) neural networks combined with fuzzy logic. The neural network is trained to forecast future traffic, and anomalies are detected when the forecasting fails. The system is designed to operate in software-defined networks since they provide network flow information and tools to manage forwarding tables. We also demonstrate how the neural network's hyperparameters affect the detection module. The system was tested using two datasets: one with emulated traffic generated by the data communication and networking research group called Orion, from computer science department at state university of Londrina, and CICDDoS2019, a well-known dataset by the anomaly detection community. The results show that GRU networks combined with fuzzy logic are a viable option to detect anomalies in SDN and possibly in other anomaly detection applications. The system was compared with other deep learning techniques.