Internet of Things (IoT) security is becoming important with the growing popularity of IoT devices and their wide applications. Recent network security reports revealed a sharp increase in the type, frequency, sophistication, and impact of distributed denial of service (DDoS) attacks on IoT systems, making DDoS one of the most challenging threats. DDoS is used to commit actual, effective, and profitable cybercrimes. The current machine learning-based IoT DDoS attack detection systems use batch learning techniques, and hence are unable to maintain their performance over time in a dynamic environment. The dynamicity of heterogeneous IoT data causes concept drift issues that result in performance degradation and automation difficulties in detecting DDoS. In this study, we propose an adaptive online DDoS attack detection framework that detects and adapts to concept drifts in streaming data using a number of features often used in DDoS attack detection. This paper also proposes a novel accuracy update weighted probability averaging ensemble (AUWPAE) approach to detect concept drift and optimize zero-day DDoS detection. We evaluated the proposed framework using IoTID20 and CICIoT2023 dataset containing benign and DDoS traffic data. The results show that the proposed adaptive online DDoS attack detection framework is able to detect DDoS attacks with an accuracy of 99.54% and 99.33% for the respective datasets.

Machine learning-based Distributed Denial of Service (DDoS) attack detection systems have proven effective in detecting and preventing DDoD attacks in Internet of Things (IoT) systems. However, these DDoS attack-detection models are vulnerable to adversarial attacks. Adversarial attacks are small, crafted adversarial perturbations that are designed to fool machine learning model, leading misclassification of input. The existing defence technique primarily focuses on batch learning-based DDoS attack detection systems, that are not equipped to handle multiple and unknown adversarial attacks in real time. To address this challenge, a novel Multistage Adversarial Attack Defense (MSAAD) framework has been developed to protect online DDoS attack detection systems from adversarial attacks. The framework consists three defense layers: (1) the Resilient Adversarial Detector and Purification (RADP), which detects and purifies adversarial attacks targeting online DDoS attack detection systems against multiple and unknown adversarial attacks. (2) a multiple classifier, that increase complexity for an attacker to replicate the DDoS attack detection model. (3) the Multi-Armed Bandit (MAB) with Thompson Sampling (MLBTSE), which dynamically selects the optimal classifier or ensemble of classifiers for each incoming traffic request. MLBTSE improves detection accuracy and robustness in dynamic IoT environment. The experiment result shows the effectiveness of the proposed MSAAD framework using the IOTID20 and CICIoT2023 datasets. The accuracy of the MLBTSE based DDoS attack detection model improved from a range of 32.38%-60.58% to 99.39%-99.48% for the IOTID20 dataset and from range of 66.60%-86.20% to 99.01%-99.14% for the CICIoT2023 datasets, respectively, in the adversarial attack scenario.

The challenges of data heterogeneity and the complexity of cybersecurity attacks, specifically Distributed Denial of Service (DDoS) attacks on the Internet of Things (IoT), require advanced solutions beyond the conventional federated learning (FL)-based DDoS attack detection. This paper introduces a novel Dynamic Weighted Clustered Federated Learning (FedDWC) framework that addresses the limitation of traditional FL methods such as non-independent and identically distributed (non-IID) nature of data and equal share of influence inherited from conventional averaging. FedDWC integrate model personalization and knowledge sharing by clustering similar clients to learn shared models and formulating bi-level optimization of the learning process across distributed Internet of Things (IoT) environments. Moreover, the framework dynamically adjusts the weight based on the performance of the local model for each IoT device. This approach preserve data privacy, improves detection accuracy and reduces convergence time in the face of evolving DDoS attacks. Our study presents a theoretical analysis to demonstrate the convergence property of the proposed framework. The experimental results show that the proposed FedDWC framework outperforms other state-of-the-art methods: FedAvg, FedProx, and IFCA in terms of convergence and DDoS attack detection accuracy under non-IID data conditions. In terms of accuracy, FedDWC achieved improvements of 1.9%, 1.31%, and 1.01% over FedAvg, FedProx, and IFCA, respectively, when using the IoTID20 non-IID dataset of 10 clusters and 200 IoT devices.