Abstract
Computer networks are aimed to be secured from any potential attacks. Intrusion Detection systems (IDS) are a popular software to detect any possible attacks. Among the mechanisms that are used to build accurate IDSs, classification algorithms are extensively used due to their efficiency and auto-learning ability. This paper aims to evaluate classification algorithms for detecting the dangerous and popular IPv6 attacks which are ICMPv6-based DDoS attacks. A comparison between five classification algorithms namely Decision Tree (DT), Support Vector Machine (SVM), Naïve Bayes (NB), K-Nearest Neighbors (KNN) and Neural Networks (NN) were conducted. The comparison was conducted using a publicly available flow-based dataset. The experimental results showed that classifiers have detected most of the included attacks with a range from 73%-85% for the true positive rate. Moreover, KNN classification algorithm has been the fastest algorithm (0.12 seconds) with the best detection accuracy (85.7%) and less false alarms (0.171). However, SVM achieved the lowest detection accuracy (73%) while NN was the slowest algorithm in training the detection model (323 seconds).
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Anstee, D., et al., Worldwide Infrastructure Security Report. 2017, ARBOR Network
Elejla, O.E., et al., Intrusion Detection Systems of ICMPv6-based DDoS attacks. Neural Computing and Applications, 2016: p. 1-12.
Caicedo, C.E. and J. Joshi, Security issues in ipv6 networks. International Telecommunications Research and Education Association (ITERA), 2008.
Ard, J.B., Internet protocol version six (ipv6) at uc davis: traffic analysis with a security perspective. 2012, University of California, Davis.
Elejla, O.E., M. Anbar, and B. Belaton, ICMPv6-based DoS and DDoS attacks and defense mechanisms. IETE Technical Review, 2017. 34(4): p. 390-407.
Scarfone, K. and P. Mell, Guide to intrusion detection and prevention systems (idps). NIST special publication, 2007. 800(2007): p. 94.
Shon, T. and J. Moon, A hybrid machine learning approach to network anomaly detection. Information Sciences, 2007. 177(18): p. 3799-3821.
Elejla, O.E., et al., Flow-Based IDS for ICMPv6-Based DDoS Attacks Detection. Arabian Journal for Science and Engineering, 2018.
Shamshirband, S., et al., An appraisal and design of a multi-agent system based cooperative wireless intrusion detection computational intelligence technique. Engineering Applications of Artificial Intelligence, 2013. 26(9): p. 2105-2127.
Anbar, M., et al. Comparative performance analysis of classification algorithms for intrusion detection system. in Privacy, Security and Trust (PST), 2016 14th Annual Conference on. 2016. IEEE.
Lippmann, R., et al., The 1999 DARPA off-line intrusion detection evaluation. Computer Networks, 2000. 34(4): p. 579-595.
Stolfo, S.J., et al. Cost-based modeling for fraud and intrusion detection: results from the JAM project. in DARPA Information Survivability Conference and Exposition, 2000. DISCEX ‘00. Proceedings. 2000.
Elejla, O.E., et al., Labeled flow-based dataset of ICMPv6-based DDoS attacks. Neural Computing and Applications, 2018.
Agrawal, S. and J. Agrawal, Survey on anomaly detection using data mining techniques. Procedia Computer Science, 2015. 60: p. 708-713.
Patcha, A. and J.-M. Park, An overview of anomaly detection techniques: Existing solutions and latest technological trends. Computer Networks, 2007. 51(12): p. 3448-3470.
Muniyandi, A.P., R. Rajeswari, and R. Rajaram, Network anomaly detection by cascading k-Means clustering and C4. 5 decision tree algorithm. Procedia Engineering, 2012. 30: p. 174-182.
Witten, I.H., et al., Data Mining: Practical machine learning tools and techniques. 2016: Morgan Kaufmann.
Hodge, V. and J. Austin, A survey of outlier detection methodologies. Artificial intelligence review, 2004. 22(2): p. 85-126.
Burges, C.J., A tutorial on support vector machines for pattern recognition. Data mining and knowledge discovery, 1998. 2(2): p. 121-167.
Joachims, T., Text categorization with support vector machines: Learning with many relevant features. 1998: Springer.
Chapelle, O., P. Haffner, and V.N. Vapnik, Support vector machines for histogram-based image classification. Neural Networks, IEEE Transactions on, 1999. 10(5): p. 1055-1064.
Zulkiflee, M., et al., A Framework of IPv6 Network Attack Dataset Construction by Using Testbed Environment. International Review on Computers and Software (IRECOS), 2014. 9(8).
Anbar, M., et al., A Machine Learning Approach to Detect Router Advertisement Flooding Attacks in Next-Generation IPv6 Networks. Cognitive Computation, 2017: p. 1-14.
Elejla, O.E., et al. A New Set of Features for Detecting Router Advertisement Flooding Attacks. in Information and Communication Technology (PICICT), 2017 Palestinian International Conference on. 2017. IEEE.
Salih, A., X. Ma, and E. Peytchev, Detection and Classification of Covert Channels in IPv6 Using Enhanced Machine Learning. 2015.
Tsai, C.-F., et al., Intrusion detection by machine learning: A review. Expert Systems with Applications, 2009. 36(10): p. 11994-12000.
Saad, R.M., et al., An intelligent icmpv6 ddos flooding-attack detection framework (v6iids) using back-propagation neural network. IETE Technical Review, 2016. 33(3): p. 244-255.
Elejla, O.E., et al., A Reference Dataset for ICMPv6 Flooding Attacks. Journal of Engineering and Applied Sciences, 2016. 100(3): p. 476-481.
Fontugne, R., et al., MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking, in Proceedings of the 6th International COnference. 2010, ACM: Philadelphia, Pennsylvania. p. 1-12.
CAIDA. The cooperative association for internet data analysis. 2014 2014 [cited 2017 28/02/2017]; Available from: https://www.caida.org/data/active/ipv6_allpref_topology_dataset.xml.
SAAD, R., et al., DESIGN & DEPLOYMENT OF TESTBED BASED ON ICMPv6 FLOODING ATTACK. Journal of Theoretical & Applied Information Technology, 2014. 64(3).
Najjar, F. and M.M. Kadhum. Reliable Behavioral Dataset for IPv6 Neighbor Discovery Protocol Investigation. in IT Convergence and Security (ICITCS), 2015 5th International Conference on. 2015. IEEE.
Elejla, O.E., M. Anbar, and B. Belaton. Flow-based Datasets 2016 [cited 2016; Available from: https://sites.google.com/site/flowbaseddatasets/.
Heuse, M. THC IPv6 attack tool kit. 2013 [cited 2015; Available from: http://www.aldeid.com/wiki/THC-IPv6-Attack-Toolkit.
Gont, F. Si6 networks’ ipv6 toolkit. 2012 [cited 2015; Available from: http://www.si6networks.com.
Acknowledgment
The authors would like to thank the School of Computer Science, Universiti Sains Malaysia (USM) for providing the facilities and support. This research was supported by the USM RUI Grant 1001/PKOMP/8014018.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Elejla, O.E., Belaton, B., Anbar, M., Alabsi, B., Al-Ani, A.K. (2019). Comparison of Classification Algorithms on ICMPv6-Based DDoS Attacks Detection. In: Alfred, R., Lim, Y., Ibrahim, A., Anthony, P. (eds) Computational Science and Technology. Lecture Notes in Electrical Engineering, vol 481. Springer, Singapore. https://doi.org/10.1007/978-981-13-2622-6_34
Download citation
DOI: https://doi.org/10.1007/978-981-13-2622-6_34
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-13-2621-9
Online ISBN: 978-981-13-2622-6
eBook Packages: EngineeringEngineering (R0)