Early Detection of DDoS Attacks via Online Social Networks Analysis

Distributed Denial of Service (DDoS) attacks pose a significant and ever-present threat to the availability and stability of online services.Existing detection techniques can be broadly classified into direct and indirect approaches, based on the data sources considered.Despite extensive research and development of direct DDoS detection methods, indirect approaches, particularly those involving Online Social Networks (OSNs) analysis, remain relatively unexplored.In this paper, we address the above gap by investigating the feasibility of detecting early stage DDoS attacks from OSN data.With this aim, we first study how users report availability problems in OSNs by identifying the most prevalent terms and expressions consistently used to express the initial indicator of a DDoS attack.Then, we leverage this knowledge to efficiently process OSN messages, filtering out irrelevant content.Finally, we introduce a sophisticated detection model based on Bidirectional Encoder Representations from Transformers (BERT), fine-tuned using a dataset we collected from Twitter and preprocessed via our innovative filtering technique.Notably, our proposed approach is platform-independent and offers a generalizable solution.We trained and tested our model with over 1.2 million tweets related to 33 major DDoS attacks from 2012 to 2023.The results are compelling: our model achieved a 0.979 F1 score, significantly outperforming existing techniques that do not exceed 0.571.These results demonstrate the potential of user-generated content as a viable support to complement existing direct DDoS detection strategies.