Neural Networks for DDoS Attack Detection using an Enhanced Urban IoT Dataset

We investigate the application of artificial intelligence to cybersecurity, to contribute to the safe and secure growth of the internet of things (IoT). Specifically, we train and evaluate different neural networks models to detect distributed denial of service (DDoS) attacks in a large-scale IoT system. We consider futuristic attacks launched by sophisticated malicious entities that take over multiple distributed IoT nodes and are able to disguise their intrusion by closely mimicking the benign traffic of the network. Using data from prior work, we find that a truncated Cauchy distribution is a suitable fit for benign traffic volume from IoT devices, and we model the attack traffic volume as following the same distribution but with different parameters for location and scale. We emulate both benign and attack traffic by overlaying these traffic volume distributions on top of an activity status data trace from a real urban IoT deployment consisting of about 4000 nodes. Using our enhanced dataset, we compare four neural network models: multi-layer perceptron (MLP), convolutional neural network (CNN), long short-term memory (LSTM), and autoencoder (AEN), analyzing their performance as a function of a parameter that measures the deviation of the attacks from the benign data. We observe that all four models are sensitive to the distance between benign and attack traffic. We further observe that LSTM gives the best overall performance in terms of both high accuracy and high recall.