Tecnol\u00f3gico de Monterrey has developed a project to mitigate distributed denial-of-service (DDoS) attacks using emerging technologies and artificial intelligence.<\/p>\n\n\n\n
Faced with the notorious increase in DDoS attacks, a group of researchers decided to conduct this study, particularly in software-defined networks (SDN).<\/p>\n\n\n\n
This work made it possible to identify the characteristics of the most important attacks on next-generation network architectures and to develop strategies for the rapid deployment of high-level security policies on the network, said project coordinator Jesus Arturo P\u00e9rez.<\/p>\n\n\n\n
At the beginning of the year, the number of DDoS attacks had already tripled compared to the same period of 2021 and has continued to grow since the start of the war between Russia and Ukraine. \u201cThese attacks are very easy to launch, as there are simple tools that can be used to do so,\u201d P\u00e9rez observed.<\/p>\n\n\n\n
The goal of the project was to test whether there are substantial differences in attacks targeting IoT devices, and one of its first conclusions was that there are none. \u201cWhether an attack targets or originates in an IoT device does not make a substantial difference, as it is merely a device with an IP address,\u201d the Tecnol\u00f3gico de Monterrey expert added.<\/p>\n\n\n\n
The study was conducted in virtualized environments. Now, the researchers are working with the University of the Basque Country (Spain) to test the behavior on physical devices.<\/p>\n\n\n\n
The initiative has achieved interesting results. \u201cWe identified which models and artificial intelligence techniques are best suited for the identification and mitigation of attacks,\u201d P\u00e9rez said.<\/p>\n\n\n\n
Generally speaking, models based on deep learning performed better and were more efficient in identifying DDoS attacks than models based on machine learning.<\/p>\n\n\n\n
The research team worked with three datasets, two of which focused on DDos attacks, CIC-2017 and CIC-2019 (high-rate and low-rate attacks), while the third focused on obtaining results for the project and observing the behavior of IoT devices (the BoT-IoT dataset). The experiments varied the number of attackers and the rate of attack connections.<\/p>\n\n\n\n
\u201cWe achieved excellent results: by testing the dataset we were able to identify 99% of the attacks,\u201d P\u00e9rez added.<\/p>\n\n\n\n
Likewise, the IPS mitigated low-speed DDoS attacks with 100% success for some attackers. \u201cThe results show that the proposed architecture provides effective responses to malicious and legitimate connections,\u201d the expert noted.<\/p>\n\n\n\n
Another goal of the project is the autonomy of the global architecture, in other words, allowing decisions to be made automatically, without human intervention. \u201cWe often depend on an administrator to block the traffic of an attack,\u201d P\u00e9rez explained.<\/p>\n\n\n\n
If the architecture comprised of the IDS and the IPS can make decisions on its own, there will be autonomy regardless of human intervention.<\/p>\n\n\n\n
P\u00e9rez highlighted the project’s contribution: the creation of an automated architecture that identifies high-rate and low-rate attacks and their scalability.<\/p>\n\n\n\n
He confirmed that distributed denial-of-service attacks are difficult to mitigate with existing defense tools, which is why they have attempted to find a new modular, flexible, and scalable solution that can provide effective responses to legitimate and malicious connections.<\/p>\n\n\n\n