Publication:
Distributed real-time SlowDoS attacks detection over encrypted traffic using Artificial Intelligence

Simple item page
dc.contributor.authorGarcia, Norberto
dc.contributor.authorAlcaniz, Tomás
dc.contributor.authorGonzález Vidal, Aurora
dc.contributor.authorBernal Bernabé, Jorge
dc.contributor.authorRivera, Diego
dc.contributor.authorSkarmeta Gómez, Antonio
dc.contributor.departmentIngeniería de la Información y las Comunicaciones
dc.contributor.otherFacultades de la UMU::Facultad de Informática
dc.date.accessioned2026-02-16T11:08:49Z
dc.date.available2026-02-16T11:08:49Z
dc.date.copyright© 2020 Elsevier Ltd.
dc.date.issued2021
dc.description.abstractSlowDoS attacks exploit slow transmissions on application-level protocols like HTTP to carry out denial of service against web-servers. These attacks are difficult to be detected with traditional signature-based intrusion detection approaches, even more when the HTTP traffic is encrypted. To cope with this challenge, this paper describes and AI-based anomaly detection system for real-time detection of SlowDoS attacks over application-level encrypted traffic. Our system monitors in real-time the network traffic, analyzing, processing and aggregating packets into conversation flows, getting valuable features and statistics that are dynamically analyzed in streaming for AI-based anomaly detection. The distributed AI model running in Apache Spark-streaming, combines clustering analysis for anomaly detection, along with deep learning techniques to increase detection accuracy in those cases where clustering obtains ambiguous probabilities. The proposal has been implemented and validated in a real testbed, showing its feasibility, performance and accuracy for detecting in real-time different kinds of SlowDoS attacks over encrypted traffic. The achieved results are close to the optimal precision value with a success rate 98%, while the false negative rate takes a value below 0.5%.
dc.formatapplication/pdf
dc.identifier.citationGarcia, N., Alcaniz, T., González-Vidal, A., Bernabe, J. B., Rivera, D., & Skarmeta, A. (2021). Distributed real-time SlowDoS attacks detection over encrypted traffic using Artificial Intelligence. Journal of Network and Computer Applications, 173, 102871.
dc.identifier.doihttps://doi.org/10.1016/j.jnca.2020.102871
dc.identifier.eissn1095-8592
dc.identifier.issn1084-8045
dc.identifier.urihttp://hdl.handle.net/10201/205641
dc.languageeng
dc.publisherElsevier
dc.relationThis work has been sponsored by the European Commission through H2020 CyberSec4Europe project (contract 830929), H2020 INSPIRE-5Gplus project (contract 871808) and H2020 IoTCrawler project (contract 779852). It has been also partially funded by AXA Postdoctoral Scholarship awarded by the AXA Research Fund, as well as funded by MINECO and the EDRF funds of project PERSEIDES (ref. TIN2017-86885-R), ERDF funds of project UMU-CAMPUS LIVING LAB EQC2019-006176-P. It was also co-financed by the European Social Fund (ESF) and the Youth European Initiative (YEI) under the Spanish Seneca Foundation (CARM)
dc.relation.publisherversionhttps://www.sciencedirect.com/science/article/pii/S1084804520303362?
dc.rightsAttribution-NonCommercial-NoDerivatives 4.0 International*
dc.rights.accessRightsinfo:eu-repo/semantics/openAccess
dc.rights.urihttp://creativecommons.org/licenses/by-nc-nd/4.0/*
dc.subjectArtificial intelligence
dc.subjectCyberattacks
dc.subjectMachine learning
dc.subjectCybersecurity
dc.subject.odsNo relacionado con ningún objetivo de desarrollo sostenible
dc.titleDistributed real-time SlowDoS attacks detection over encrypted traffic using Artificial Intelligence
dc.typeinfo:eu-repo/semantics/article
dc.type.versioninfo:eu-repo/semantics/acceptedVersion
dspace.entity.typePublicationes
relation.isAuthorOfPublicationcf8009bf-6088-449d-9f79-a516af312945
relation.isAuthorOfPublicationc5f9eec4-b404-412b-aade-10875cdcff0d
relation.isAuthorOfPublication7dacd587-416b-43e7-bec1-30dbb093d0a4
relation.isAuthorOfPublication.latestForDiscoverycf8009bf-6088-449d-9f79-a516af312945
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Distributed_real_time_SlowDoS_attacks_detecion___SEXENIO.pdf
Size:
1.98 MB
Format:
Adobe Portable Document Format
Description:
Download
License bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
license.txt
Size:
1.37 KB
Format:
Item-specific license agreed upon to submission
Description:
Download
Collections
Artículos