A Hybrid Machine Learning - Fuzzy Cognitive Map Approach for Fast, Reliable DDoS Attack Detection

Volumetric Distributed Denial of Service (DDoS) attacks such as the SYN flood and UDP flood attacks are designed to cause service outage by overwhelming the resources of the targeted host or network. Early detection of such attacks using computationally frugal means is highly desirable. Therefore, we propose a hybrid, fast and reliable approach to volumetric DDoS attack detection. Our hybrid model uses Machine Learning (ML) based feature selection and Fuzzy Cognitive Map (FCM) based attack prediction (classification). We test nine different Machine Learning (ML) feature selection algorithms to first identify a set of ten features from SYN and UDP flood attack packets that serve as reliable indicators of the attack. Next, we construct FCMs with these selected features and with algorithmically assigned and updated weights; these FCMs can predict with high accuracy, whether each packet is an attack packet or a benign packet. We test our model on the publicly available CICDDoS2019 dataset to demonstrate that our FCM based attack prediction is very effective when paired with a few specific feature selection algorithms. We also demonstrate that our “ML-feature-select, FCM-predict” hybrid approach is more reliable and computationally much faster than the traditional “ML train and test” approach within the context of SYN and UDP flood attack prediction. A light-weight solution such as ours is suitable for various edge devices including resource constraint IoT hosts.