A Graph Convolutional Networks-Based DDoS Detection Model

Network attacks have exponentially increased over the last years and, seriously, impacting fundamental aspects of our modern society at all levels, i.e., individual, critical infrastructure, and national security. To counterattack these cyber threats, several approaches for detecting or preventing them have been investigated. Ultimately, these approaches culminated in the design and development of Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs). From a detection standpoint, intelligent engines using Artificial Intelligence, Machine learning, and more recently deep learning have played a fundamental role in improving the detection capabilities of such systems. Distributed Denial of Service (DDoS) is an attack that causes loss of availability by overwhelming the target system with malicious packets that preclude legitimate users from accessing the system resources. Despite the development of IDS and IPS, successful DDoS attacks have continued to rise. To address this growing and threatening concern, this paper proposes the design of a Graph Convolutional Network (GCN)- empowered DDoS detection system. The proposed GCN model consists of three hidden layers, each with 128 neurons, and its effectiveness is validated by experiments using the UNB CIC- IDS 2017 DDoS dataset, showing that it achieves an accuracy, precision, recall, and F1-score of 99.95%, 99.95%, 99.95%, and 99.95%, respectively, which are promising results.

I. Introduction

Network and computer attacks have become extensive in today’s interconnected world [1]. Indeed, any device that connects to the Internet, including medical devices such as Continuous Glucose Monitoring (CGM) systems, smart inhalers or Remote Patient Monitoring (RPM) devices, laptops that instructors use in classrooms, government database servers, to name a few, are all exposed to several types of attacks and threats from hackers. As per the statistics reported in [2], Q2 of 2023 saw an 387% increase in DDoS attacks compared to Q1 of the same year. Furthermore, aproximately half of those attacks were targetted towards critical infrastructure providers.