In today's world, technology has become an inevitable part of human life. In fact, during the Covid-19 pandemic, everything from the corporate world to educational institutes has shifted from offline to online. It leads to exponential increase in intrusions and attacks over the Internet-based technologies. One of the lethal threat surfacing is the Distributed Denial of Service (DDoS) attack that can cripple down Internet-based services and applications in no time. The attackers are updating their skill strategies continuously and hence elude the existing detection mechanisms. Since the volume of data generated and stored has increased manifolds, the traditional detection mechanisms are not appropriate for detecting novel DDoS attacks. This paper systematically reviews the prominent literature specifically in deep learning to detect DDoS. The authors have explored four extensively used digital libraries (IEEE, ACM, ScienceDirect, Springer) and one scholarly search engine (Google scholar) for searching the recent literature. We have analyzed the relevant studies and the results of the SLR are categorized into five main research areas: (i) the different types of DDoS attack detection deep learning approaches, (ii) the methodologies, strengths, and weaknesses of existing deep learning approaches for DDoS attacks detection (iii) benchmarked datasets and classes of attacks in datasets used in the existing literature, and (iv) the preprocessing strategies, hyperparameter values, experimental setups, and performance metrics used in the existing literature (v) the research gaps, and future directions.

In this article, the authors present an effort to recognize handwritten Gurumukhi place names for use in postal automation. Five feature extraction techniques (zoning, horizontal peak extent, vertical peak extent, diagonal, and centroid) have been analyzed and optimized using Principal Component Analysis (PCA). Four classification methods ( k -Nearest Neighbor ( k -NN), decision tree, random forest, and Convolutional Neural Network (CNN)) have been utilized to classify the handwritten word images. To enhance the recognition results, the authors have employed Bootstrap Aggregation (Bagging) with a majority voting scheme. The authors used a public benchmark dataset of 40,000 handwritten place-name samples in the Punjabi language for their experimental work. The experiments were conducted using a 70:30 partitioning approach, where 70% of the data was utilized for training and the remaining 30% for testing. The system achieved a maximum recognition accuracy of 96.98% by utilizing a combination of zoning, vertical peak extent, and diagonal features, and a minimum Mean Squared Error (MSE) of 0.86% based on a combination of zoning and horizontal peak extent features with a majority voting scheme through ensemble (Bagging) methodology.

Abstract A distributed denial of service (DDoS) attack is a significant threat to web‐based applications and hindering legitimate traffic (denies access to benign users) by overwhelming the victim system or its infrastructure (service, bandwidth, networking devices, etc.) with a large volume of attack traffic. It leads to a delay in responses or sometimes a crash victim system. Even a few moments of pause in web‐based applications lead to a huge monetary loss and a bad reputation in the market. Several approaches available in the literature to protect websites from different types of DDoS attacks. However, incidents and volume sizes of DDoS attacks are growing quarter by quarter. Further, various challenges in the traditional framework based defense mechanisms: itself becoming a victim of attacks while analyzing a massive amount of traffic, require more time for detection process, no coordination among the modules, etc. This paper presents a comprehensive DDoS defense deployment taxonomy and critically reviewed existing distributed frameworks based DDoS attack detection systems. Further, characterized several existing distributed processing frameworks to select an appropriate one for deploying DDoS attack detection mechanisms. Finally, several evaluation metrics, open issues, discussion on available datasets including their limitations, and future directions are presented.

Abstract In the information age where Internet is the most important means of delivery of plethora of services, distributed denial‐of‐service (DDoS) attacks have emerged as one of the most serious threat. Strategic, security, social, and financial implications of these attacks have ceaselessly alarmed the entire cyber community. To obviate a DDoS attack and mitigate its impact, there is an irrevocable prerequisite to accurately detect them promptly. An inherent challenge in addressing this issue is to efficiently distinguish these attacks from characteristically analogous flash events (FEs) which are bona fide occurrences generated by legitimate users. Most of the studies have focused on finding out the unique characteristics of DDoS attacks in isolation, with the peril of false alarms heuristically. To preclude this, it is pertinent to fundamentally focus on identifying the unique characteristics of FE vis‐a‐vis DDoS attacks ab initio which has been the basis of this work. The aim of this paper is to formulate the taxonomy of FEs and compare the characteristics of FEs and DDoS attacks to segregate these using several empirical metrics. Real and emulation datasets have been used to validate the characteristics of both. The extensive analysis in this study establishes that there are numerous technical dissimilarities that can be exploited to separate these similar looking events. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract Feature selection methods play a significant role during classification of data having high dimensions of features. The methods select most relevant subset of features that describe data appropriately. Mutual information (MI) based upon information theory is one of the metrics used for measuring relevance of features. This paper analyses various feature selection methods for (1) reduction in number of features; (2) performance of Naïve Bayes classification model trained on reduced set of features. Research gaps identified are: (1) computation of MI from the whole sample space instead of unclassified sample subspace; (2) consideration of relevance of features only or tradeoff between relevance and redundancy, but class conditional interaction of features is ignored. In this paper, we propose a general evaluation function using MI for feature selection. The proposed evaluation function is implemented which use dynamically computed MI values from unclassified instances. Effectiveness of the proposed feature selection method is done empirically by comparing classification results using KDD 1999 benchmarked dataset of intrusion detection. The results indicate practicability and effectiveness of the proposed method for applications concerned with high accuracy and stability of predictions. Copyright © 2011 John Wiley & Sons, Ltd.

The inherent vulnerabilities in TCT/IP architecture give dearth of opportunities to DDoS attackers. The array of schemes proposed for detection of these attacks in real time is either targeted towards low rate attacks or high bandwidth attacks. Tresence of low rate attacks leads to graceful degradation of QoS in the network thus making them further undetectable. In this paper, we propose a scheme that uses three lines of defense. The first line of defense is towards detecting the presence of low rate as well as high bandwidth attacks based on entropy variations in small time windows. The second line of defense identifies and tags attack flows in real time. The last line of defense is redirecting the attack flows to honeypot server that responds in contained manner to the attack flows, thus providing deterrence and maintaining QoS at ISP level. We validate the effectiveness of the approach with simulation in ns-2 on a Linux platform.