Detection of Low Rate DDoS with Adversarial Attacks by Enhanced Generative Adversarial Networks

The Internet of Things is vulnerable to cybersecurity attacks because it is typically designed with minimal security considerations. The Low-Rate Distributed Denial-of-Service (LR-DDoS) attacks evade detection by injecting a small portion of malicious packets that persistently lurk within the IoT network. Recently, adversarial LR-DDoS attacks further complicate machine learning based security protection. In this study, an improved detection algorithm based on a generative adversarial network is proposed against LR-DDoS. To learn the temporal characteristics, LR-DDoS time-series features are taken as a part of the generator's input and Long Short-Term Memory modules are incorporated. Two discriminators with adaptive weighting are employed, one for conventional LR-DDoS attacks and the other for the adversarial attacks, to generate plausible LR-DDoS samples. The generated packets are used to train the detection algorithm of an Intrusion Detection System. Simulation results show that the proposed method achieves an accuracy of 94% in detecting adversarial LR-DDoS packets, which outperforms the state-of-the-art methods by at least 10%.