DDoS attack detection on portmap using a bidirectional recurrent neural network method

Abstract

Portmap is a protocol used in Unix and Linux operating systems to map port numbers to their associated program numbers. In a distributed denial of service (DDoS) attack on portmap, attackers will exploit a weakness in this protocol to send many malicious or manipulative server-running portmap requests Due to the connectionless and unauthenticated nature of UDP, the portmap server will attempt to respond to every request it receives. However, attackers often disguise this so that their IP address is hidden or spoofed. As a result, the server will attempt to reply to requests to a spoofed or invalid IP address, using server resources and causing a denial of service for valid users. A DDoS attack on portmap can be quite damaging. Services associated with portmap may become unresponsive, causing significant downtime for applications or services that rely on the protocol. This study uses the CSE-CIC-IDS 2019 dataset, especially the DDoS attack dataset on portmap. This paper also employs the correlation-based feature selection (CSF) approach to extract significant characteristics from the dataset Bidirectional RNN is used to detect DDoS assaults. Utilizing 30% testing data and 70% training data, the Bidirectional RNN approach can effectively identify DDoS attacks on portmap. Accuracy is 99.9917%, recall is 99.9917%, specificity is 99.9942%, precision is 99.994%, F1-Score is 99.88%, balanced accuracy (BACC) is 99.92%, and matthews correlation coefficient (MCC) is 99.98%. By merging the CFS feature selection technique with the Bidirectional RNN architecture, this work mainly contributes to creating a more accurate and efficient DDoS attack detection method. With this method, the detection process can be carried out faster and more precise, reducing the computational burden without sacrificing detection performance.