Locally weighted classifiers for detection of neighbor discovery protocol distributed denial‐of‐service and replayed attacks. Issue 3 (31st July 2019)

• Record Type: Journal Article
• Authors: Alsadhan, Abeer; Hussain, Abir; Liatsis, Panos; Alani, Mohammed; Tawfik, Hissam; Kendrick, Phillip; Francis, Hulya
• Is Part Of: Transactions on emerging telecommunications technologies. Volume 33:Issue 3(2022)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2019-07-31
• Subjects: Telecommunication -- Periodicals; 384.05
• DOI: 10.1002/ett.3700
• Languages: English
• ISSNs: 2161-5748

Abstract

Abstract: The Internet of things requires more internet protocol (IP) addresses than IP version 4 (IPv4) can offer. To solve this problem, IP version 6 (IPv6) was developed to expand the availability of address spaces. Moreover, it supports hierarchical address allocation methods, which can facilitate route aggregation, thus limiting expansion of routing tables. An important feature of the IPv6 suites is the neighbor discovery protocol (NDP), which is geared towards substitution of the address resolution protocol in router discovery and function redirection in IPv4. However, NDP is vulnerable to denial‐of‐service (DoS) attacks. In this contribution, we present a novel detection method for distributed DoS (DDoS) attacks, launched using NDP in IPv6. The proposed system uses flow‐based network representation, instead of a packet‐based one. It exploits the advantages of locally weighted learning techniques, with three different machine learning models as its base learners. Simulation studies demonstrate that the intrusion detection method does not suffer from overfitting issues and offers lower computation costs and complexity, while exhibiting high accuracy rates. In summary, the proposed system uses six features, extracted from our bespoke dataset and is capable of detecting DDoS attacks with 99% accuracy and replayed attacks with an accuracy of 91.17%, offering a marked improvement in detection performance over state‐of‐the‐art approaches. Abstract : The proposed detection method makes use of Locally Weighted Learning machine learning techniques, with three different algorithms as its base learner. A model was developed that adopted feature selection and overcame overfitting issues, combined with lower computation costs and complexity, which resulted in a high accuracy rate. These flow‐based Internet Control Message Protocol Version 6 (ICMPv6) DDoS attack detection models made used of 6 features on our bespoke dataset and proved capable of detecting DDoS at 99% accuracy and Replayed at 91.17%, while detecting Normal traffic at 94% accuracy‐outclassing the previous 85.3% accuracy benchmark.