Modelling DDoS Attacks in IoT Networks using Machine Learning
  In current Internet-of-Things (IoT) deployments, a mix of traditional IP
networking and IoT specific protocols, both relying on the TCP protocol, can be
used to transport data from a source to a destination. Therefore, TCP-specific
attacks, such as the Distributed Denial of Service (DDoS) using the TCP SYN
attack, are one of the most plausible tools that attackers can use on
Cyber-Physical Systems (CPS). This may be done by launching an attack from its
IoT subsystem, here referred to as the "CPS-IoT", with potential propagation to
the different servers located in both fog and the cloud infrastructures of the
CPS. This study compares the effectiveness of supervised, unsupervised, and
semi-supervised machine learning algorithms for detecting DDoS attacks in
CPS-IoT, particularly during data transmission to and from the physical space
to the cyber space via the Internet. The algorithms considered are broadly
grouped into two: i) Detection algorithms, which include Logistic Regression
(LGR), K-Means, and Artificial Neural Networks (ANN). We also looked into the
effectiveness of semi-supervised hybrid learning models, which use unsupervised
K-Means to label data, then feed the output to a supervised learning model for
attack detection. ii.) Prediction algorithms - LGR, Kernel Ridge Regression
(KRR) and Support Vector Regression (SVR), which were used to predict imminent
attacks. Experimental tests were carried out and obtained results showed that
the hybrid model was able to achieve 100% accuracy with zero false positives;
while all the prediction models were able to achieve over 94% attack prediction
accuracy.
