Flow-Based IDS Features Enrichment for ICMPv6-DDoS Attacks Detection

Internet Protocol version 6 (IPv6) and its core protocol, Control Message (ICMPv6), need to be secured from attacks, such as Denial of Service (DoS) Distributed DoS (DDoS), in order reliable for deployment. Several Intrusion Detection Systems (IDSs) have been built proposed detect ICMPv6-based DDoS attacks. However, these IDSs suffer several drawbacks, the inability novel attacks a low detection accuracy due their reliance on packet-based traffic representation. Furthermore, existing that rely flow-based representation use simple heuristics features do not contribute detecting This paper proposes IDS by enriching with set new improve accuracy. The flow consists packets similar attributes (i.e., same source destination IP address) can differentiate between normal malicious behavior, address’s symmetry whole flow’s symmetry. experimental results reveal enriched significantly improved IDS’s 16.02% false positive rate decreased 19.17% compared state-of-the-art IDSs.