DDoS attack detection in IoT systems using Neural Networks

This short paper summarizes our recent/ongoing works [2-4] on detecting DDoS attacks in IoT systems. In our studies, we conducted a thorough examination of using machine learning to detect Distributed Denial of Service (DDoS) attacks in large-scale Internet of Things (IoT) systems. Unlike prior works and typical DDoS attacks that focus on individual nodes transmitting high volumes of packets, we explored the more sophisticated and advanced future attacks that use a large number of IoT devices while hiding the attack by having each node transmit at a volume that mimics benign traffic. We introduced innovative correlation-aware architectures that consider the correlation between the traffic of IoT nodes and compare the effectiveness of centralized and distributed detection models. Through extensive analysis, we evaluated the proposed architectures using five different neural network models trained on a real-world IoT dataset of 4060 nodes. Our results showed that the combination of long short-term memory (LSTM) and transformer-based models with the correlation-aware architectures offer superior performance, in terms of F1 score and binary accuracy, compared to the other models and architectures, especially when the attacker conceals its actions by following benign traffic distribution on each transmitting node. Furthermore, we investigated the performance of heuristics for selecting a subset of nodes to share their data in resource-constrained scenarios for correlation-aware architectures.