DDoS Attack Classification on Cloud Environment Using Machine Learning Techniques with Different Feature Selection Methods
C Bagyalakshmi, E Samundeeswari, Ahmed Shawish, Maria Salama, Anna Buczak, Erhan Guven, Antony Asir, Gnana Singh, Jebamalar Leavline, Carlos Pedreira, Ikram, Cherukuri, Jaswinder Singh, Krishan Kumar, Monika Sachdeva, Navjot Sidhu, Jian-Hui Wu1, Wei Wei, Lu Zhang, Jie Wang, Robertas Dama, Evi, Jing Ius, Hai-Dong Li, Guo-Li Wang, Xin Wang, Ju-Xiang Zhang, Marcin Yuan, Wozniak, Keisuke Kato, Vitaly Klyuev, Preeti Mishra, Vijay Varadharajan, Uday Tupakula, Emmanuel Pilli
Abstract
Cloud Computing is a prominent compelling paradigm for managing and delivering services over the Internet. It is modifying the landscape of information technology in terms of data storage. In large data storage requirements, highest priority is to be given for data security. Intrusion is one of the important security issues in today's cyber world. Due to networked nature of the cloud, resources, data and applications are vulnerable to the attack in cloud environment. Intrusion Detection Systems (IDS) are employed in the cloud to detect malicious behavior in the network and in the host. Distributed Denial of Service (DDoS) attack is one of challenging task in IDS, as it creates a huge volume of malicious data in the network. Data mining methods for cyber analytics provide support for intrusion detection. A significant number of techniques are developed, based on machine learning approaches. Feature selection methods also play an important role in reducing the dimensionality of the dataset. In this work, two approaches are proposed and the dataset is collected from NSL-KDD. The first approach uses Learning Vector Quantization (LVQ), a filter method and the second approach uses Principal Component Analysis (PCA), a dimensionality reduction method. The selected features from each approach is used for classification using Nave Bayes (NB), Support Vector Machine (SVM) and Decision Tree (DT) and compared the results in terms of their detection capability for DDoS attack. Results shows that LVQ based DT technique overtakes the others in terms of attack identification.