 ICACT20220078 Slide.01
[Big Slide]
|
Chrome  Click!! |
 |
blockchain |
| ICACT20220078 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
Table of Contents Introduction Background Proposed Blockchain-based Secure Land Title System Results and Discussions Conclusion Q and A |
| ICACT20220078 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
With the expansion of the internet, the identification
and recuperation of digital attacks have become a primary
concern for digital businesses. Damage brought about by network
attacks has caused far and wide concern. Distributed Denial
of Service (DDoS) attack is a dangerous digital attack. It’s
an attack that annihilates the network and can cause multiple
computers to be assaulted simultaneously, fizzling to perform
service appropriately. A blockchain-based DDoS recognition
model is proposed for the systematic evaluation of DDoS attacks
to understand the vulnerabilities of the Blockchain better. The
advantage of Blockchain is that Blacklisted IP addresses are
effectively stored. The use of such a framework gives the benefit
of additional security components over existing DDoS moderation
frameworks. This paper has assessed the Tab Transformer, the
XGBoost, and the Random Forest algorithm to discover the better
classifying algorithm. Tree-Based classifier procedure utilized for
feature selection to boost the computational time. Out of the three
algorithms, the Tab Transformer gives an accuracy of about 97%
real-time investigation of the attacks.
|
| ICACT20220078 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
As the number of resources associated with the web increases, the effect of Distributed Denial of Service (DDoS)
attacks is expanding. As a profoundly damaging assault, the
destruction and debasement of its service quality are capricious
. The top data transfer capacity of DDoS in 2013
has surpassed 300Gbps . DDoS attacks are exceptionally
destructive, making services reduced or even crashed .
Simple to execute and powerful innovation for attacking web
assets. Before, there have been some large-scale attacks against
notable websites . Some preventive measures have been
proposed to defend from these attacks. However, the expense
of protection is high because DDoS detection was
mostly centralized single-point detection, by examining nearby
traffic highlights which caused the DDoS attacks and
couldn’t be adequately shielded. Contrasted and single-point protection systems with the
benefits of the disseminated guard has been demonstrated.
For example, community-oriented interruption location frameworks,
which permit data from different nodes of the interruption
identification framework to communicate and gather
data yet this likewise directly prompted the issue of trust
between members.
|
| ICACT20220078 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
DDoS attacks are the most problematic and disruptive
assaults that intrude on the administrations running over hours
to days. There are several of DDoS assaults, out of which SYN
Flood Attack, UDP Flood Attack and HTTP Flood Attack are
the most common assaults. UDP Flood is an assault under
which there are a colossal number of User Datagram Packets
shipped off worker with an expectation of overpowering the
objective assets and make them inert. There could be a firewall
infringement and, thus, there might be a refusal of an authentic
client demand. HTTP Flood is an assault wherein there are
a gigantic number of HTTP demand shipped off workers
with an objective to overpower the objective assets and make
them inert. These assaults mostly focus on the OSI model
application layer. The TCP-SYN Flood assault creates a huge
traffic volume and makes worker assets difficult to reach. It
works by more than once sending the SYN parcels (Initial
Requests) and overpower every one of the ports on track
gadget and making not to react to the traffic
|
| ICACT20220078 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
Further Zhang et al. [27] contend that vindictive code identification is considered an example acknowledgment and
can be settled by a neural network that doesn’t need a numerical portrayal of how the yield is practically reliant
upon the information to estimate the capacity. Fuzzy logic and neural networks are complementary, so they propose a
fuzzy neural organization-based malware discovery calculation and it is demonstrated that this method can successfully
distinguish malevolent paired code. The connection between them leads to iteratively improve the quality of issue
Arrangements additional time [28]. The molecule swarm advancement calculation used as Multitude knowledge (SI) is
an arbitrary pursuit algorithm that recreates creature rummaging conduct and uses group collaboration as a fundamental
segment. It very well may be considered a multi-specialist enhancement framework. MAOS). Since the particle
swarm improvement calculation has a generally quick relative convergence rate in the beginning phase, it
is barely noticeable the optimal arrangement in the quick hunt cycle and accordingly fall into the local ideal,
so Eberhart and Shi [29] will change the inertia weight in the molecule swarm optimization calculation.
We will provide proactive defences that can protect against
attacks that have several vulnerabilities; on the other hand,
also reactive defences that defend themselves against attacks
that exploit a few vulnerabilities.
|
| ICACT20220078 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
DDoS attacks in the context of Blockchain. The machine
learning/deep learning models are trained on data from attacks
and genuine traffic. The framework will enable the trigger
for flagging white or boycotted IP addresses and identify the
attacks targeting the network.
In a normal TCP connection, the first step is the TCP
connection establishment which is a 3-way handshake. In a
3-way handshake, the client sends a SYN packet, the server
sends a SYN+ACK packet after receiving the SYN packet.
When the client receives the SYN+ACK packet, it sends an
ACK packet. In the framework, three computers are used as
attack computers that send TCPSYN requests from different
source IP addresess targeting a victom server which is listeing
on port 80. This floods the server with TCPSYN requests
as the Server will send SYN+ACK packet to each TCPSYN
packet.
According to the framework shown in Fig.1, the raw features
are fed to the ExtraTreeClassifier to obtain the important
features relevant to the classification task. The classification
task is a three-class classification task: Benign, UDP flood,
and TCPSYN flood attacks.
|
| ICACT20220078 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
DDOS |
| ICACT20220078 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
A. Dataset
The dataset [32] used in this research study is comprised
of two types of attacks, i.e., TCPSYN and UDP flood attacks,
and the attacks are directed towards the server attached to the
backbone network of the campus. The router is attached to
a blockchain-based network. There are three computers used
for attacking the network, and the traffic is captured using the
hping3 software. The attack packets contain spoofed source IP
addresses and are generated randomly that appear to the router
as if the traffic is coming from various sources. In this study,
we investigate the behavior of such attacks at the router and the
peer-to-peer level. The traffic is captured from the router and
peer-to-peer network by mirroring the traffic to the computer
for storage. The saved traffic is used for further analysis and
evaluation of intrusion detection systems.B. EVALUATION CRITERIA
1) Accuracy: Accuracy is a widely used criterion for the evaluation of machine learning algorithms. Our dataset is
imbalanced with more Benign traffic compared to TCPSYNC and UDPFLOOD attacks. Therefore, we will be looking into
some other popular criteria to assess the machine learning model’s performance. The formula for Accuracy is given
below. Accuracy = (TP + TN)=(TP + FN + FP + TN)
2) Precision: It is defined as the ratio of correctly classified items to actually classified items.
Precision = TP=(TP + FP)
3) F1-Score: The F1-Score is also known F-Measure that calculates the harmonic mean of Precision (P) and Recall(R) to
find the score. The maximum value for F1-score is 1 known as Dice similarity coefficient. The formula for F1-Score is given
below.
F1 = 2 (P R=P + R)
Where P and R represent Precision and Recall, respectively.
|
| ICACT20220078 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
This section will discuss the performance of different machine
learning algorithms on predicting DDoS attacks from benign
traffic in the context of Blockchain. We analyze the traffic
for DDoS attacks at the hierarchical level, firstly at the router
level and then at the peer-to-peer level. The accuracy of Tab
Transformer is around 97% shown in Table I. The accuracy
of XGBoost and Random Forest is mostly comparable, having
accuracy 94:3% and 94:8% respectively. The dataset has been
labeled with three classes of TCPSYNC, UDPFLOOD, and
mixed with normal traffic labeled as Benign traffic.
|
| ICACT20220078 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
This paper explores the performance of the current state-ofthe-
art machine learning models such as Tab Transformer to
detect and identify DDoS attacks in the context of Blockchain
networks. The performance of machine learning and deep
learning approaches largely depends on selecting features for
the required task. The insightful analysis of the dataset is fundamental
before choosing the machine learning/deep learning
model. In our case, the Tab transformer [31] model learns the
contextual information, thus showing superior performance in
identifying the DDoS attacks
|
| ICACT20220078 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
ddos |
| ICACT20220078 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
1) Extreme Gradient Boosting (XGBoost): Extreme Gradient
Boosting (XGBoost) [30] is an efficient open-source
project implementation of the gradient boosting algorithm.
Gradient boosting is a class of ensemble machine learning
used extensively for predictive analytics and work very well
for unstructured data. In general, the ensemble is constructed
from the addition of decision tree models one at a time to
reduce prediction error using a gradient descent optimization
algorithm. The XGBoost optimizes gradient boosting by effective
parallelization, hardware optimization, and regularization.
The algorithm is highly scalable with higher computational
speed on memory-constrained systems.
2) Tab Transformer: [31] The Transformer is widely
used for contextual modeling in Natural Language Processing
(NLP). The Tab Transformer is the adaptation of the
Transformer for tabular data. The Tab Transformer utilizes a
sequence of multi-head attention-based Transformer layers to
take input and convert it into contextual embeddings to bridge
the gap between baseline MLP and GBDT models. The highly
correlated features in the same column and cross column result
in an embedding vector close to euclidean distance. There is
no such relationship that exists in context-free embedding. The
Tab Transformer is highly robust to the random missing and
noisy data.
|
| ICACT20220078 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
Random Forest: Random Forest uses a set of decision
trees selected randomly from the bootstrap sample of the
training dataset. The vote is aggregated from all the decision
trees, and the final score of classification is given. The
classifier is efficient with a big dataset and can handle a
large number of input variables. Moreover, it avoids overfitting
and improves generalizations. During the forest building, it
produces the estimate of unbiased generalization of error. The
best experimental parameters of the classifier are: There were
120 estimators with minimum sample leaves as 1, and 120
estimators with minimum sample split as 3 were used for best
classification accuracy. The Gini criterion is used to measure
the quality of the split
|
| ICACT20220078 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
Q and A |
| ICACT20220078 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
Q and A |
