A Deep Learning Approach to Detection and Mitigation of Distributed Denial of Service Attacks in High Availability Intelligent Transport Systems

In the era of Internet of Things (IoT) powered by 5G technologies, Automobile Industry is headed towards a revolution. In Intelligent Transport Systems (ITS), vehicles act as connected entities, and exchange data with each other and with the back-end servers on the mobile network. These communications are often session based and require a light weight protocol for session establishment and continuity. Session Initiation Protocol (SIP) can act as the base for this kind of communication. However, its simplicity also makes the protocol vulnerable to various web attacks such as identity theft and Distributed Denial of Service (DDoS). As 5G technologies will enable high data rates to the users, this will also exponentially increase the threat of high-speed DDoS on the servers originating from different sources. Thus, appropriate solutions need to be developed for securing SIP systems from these threats. Machine Learning (ML) has transpired as a building block in cyber security solutions, and a large number of techniques are available to make quick and robust network defense systems by automating the identification of attack flows in the network. In this paper, a Deep Learning-based model is proposed for the identification and alleviation of DDoS attacks in SIP based networks. The work presented here uses a system that is scalable and highly available with load balancing and failover addressing capabilities. The datasets used for conducting experiments are created by emulating SIP sessions, generating DDoS attacks, capturing the normal and attack flows, and extracting time window-based features from the packets. A stacked autoencoder model is trained on the curated datasets to detect various types of DDoS attacks. Once an attack is detected, the Mitigation Policy Recommender module recommends various actions for threat mitigation. Performance of the system is assessed in terms of Accuracy, Precision, Recall and F1-Score. The proposed model obtains a significant improvement in the performance than the previously existing state-of-the-art techniques in terms of accuracy and detection rate.