The design of existing machine-learning-based DoS detection systems in software-defined networking (SDN) suffers from two major problems. First, the proper time window for conducting network traffic analysis is unknown and has proven challenging to determine. Second, it is unable to detect unknown types of DoS saturation attacks. An unknown saturation attack is an attack that is not represented in the training data. In this paper, we evaluate three supervised classifiers for detecting a family of DDoS flooding attacks (UDP, TCP-SYN, IP-Spoofing, TCP-SARFU, and ICMP) and their combinations using different time windows. This work represents an extension of the runner-up best-paper award entitled ‘Detecting Saturation Attacks in SDN via Machine Learning’ published in the 2019 4th International Conference on Computing, Communications and Security (ICCCS). The results in this paper show that the trained supervised models fail in detecting unknown saturation attacks, and their overall detection performance decreases when the time window of the network traffic increases. Moreover, we investigate the performance of four semi-supervised classifiers in detecting unknown flooding attacks. The results indicate that semi-supervised classifiers outperform the supervised classifiers in the detection of unknown flooding attacks. Furthermore, to further increase the possibility of detecting the known and unknown flooding attacks, we propose an enhanced hybrid approach that combines two supervised and semi-supervised classifiers. The results demonstrate that the hybrid approach has outperformed individually supervised or semi-supervised classifiers in detecting the known and unknown flooding DoS attacks in SDN.

Spatial data clustering has long been used to facilitate the knowledge discovery process. Several approaches have been proposed in the literature for detecting and understanding hidden patterns. These approaches are based on different perspectives and can be roughly categorized into several main categories, including centroid-based, density-based, grid-based, and hierarchy-based clustering. In spite of being a very mature research area, existing spatial clustering techniques usually depend on user parameters and continue to utilize distances between objects as their similarity measure. In turn, clustering approaches are generally suffering from performance and scalability issues. To address this problem, we propose ACUTE, an efficient and scalable approach that detects both synthetic and real-world spatial clusters. ACUTE ascertains both the intra-cluster compactness (similarities) and inter-cluster connectedness (dissimilarities) of spatial objects by assessing the topological relations of their corresponding spatial points. While conventional methods conduct clustering according to pairwise comparisons of the distances between objects, our approach focuses on leveraging topological relations that reduce the distances required to be calculated. This in turn minimizes the number of comparisons required, thus enhancing the efficiency and increasing the scalability. To evaluate the accuracy of ACUTE, it has been extensively tested against twelve (12) synthetic datasets and five (5) actual datasets including one location-based (network) dataset. Results show that ACUTE has great performance when compared with state-of-the-art clustering techniques in terms of several evaluation metrics, including precision, recall, and error rates.

Deep learning models, particularly Convolutional Neural Networks (CNNs), play a pivotal role in intelligent software. However, like any software application, CNN-based applications are susceptible to bugs. Bug-fix patterns in CNN differ from traditional techniques, primarily due to their inherent black box nature. Moreover, current methods, although tailored for generic DNN structures, are time consuming, require specialized expertise, and are not directly applicable to the unique structure and requirements of CNNs. To address these issues, we propose DeepCNN, an innovative automated tool to identify the root causes of CNN faults and autonomously fix prevalent training faults that impact the performance and efficiency of CNN programs. DeepCNN, a data-driven tool, employs a transformer encoder model to abstract token-level CNN code, enabling it to effectively detect and fix bugs in real-world CNN models. Beyond mere identification, DeepCNN offers automated solutions for repairing CNN hyperparameter misconfigurations using an optimization solver. Additionally, by analyzing data dependencies and employing a search algorithm, it determines the most optimal hyperparameter values for the problematic models, ultimately generating patch fixes. Through rigorous evaluation on 36 diverse buggy models, DeepCNN outperformed existing methods in fault localization and repair, showing a robustness in identifying potential problems with a 90% detection rate. Among these problematic models, it manages to repair 90% of them — resulting in a 30% average accuracy boost.