Detecting Distributed Denial-of-Service (DDoS) Attacks Through the Log Consolidation Processing (LCP) Framework

Mohammad Adib Khairuddin - Universiti Pertahanan Nasional Malaysia, Kem Perdana Sungai Besi, Kuala Lumpur, 57000, Malaysia
Mohd Rizal Mohd Isa - Universiti Pertahanan Nasional Malaysia, Kem Perdana Sungai Besi, Kuala Lumpur, 57000, Malaysia
Mohd Afizi Mohd Shukran - Universiti Pertahanan Nasional Malaysia, Kem Perdana Sungai Besi, Kuala Lumpur, 57000, Malaysia
Mohd Nazri Ismail - Universiti Pertahanan Nasional Malaysia, Kem Perdana Sungai Besi, Kuala Lumpur, 57000, Malaysia
Kamaruzaman Maskat - Universiti Pertahanan Nasional Malaysia, Kem Perdana Sungai Besi, Kuala Lumpur, 57000, Malaysia


Citation Format:



DOI: http://dx.doi.org/10.62527/joiv.8.3.2184

Abstract


One major problem commonly faced by organizations is a network attack especially if the network is vulnerable due to poor security policies. Network security is vital in protecting not only the infrastructure but most importantly, the data that moves around the network and is stored within the organization. Ensuring a secure network requires a complex combination of hardware including both network and security devices, specialized applications such as web filtering and log management, and a group of well-trained network administrators and highly skilled analysts.  This paper aims to present an alternative to the current log management solution. A hindrance to the current log management solution is the difficulty in amalgamating and correlating a vast number of logs with different formats and variables. This paper uses a novel framework called Log Consolidation Processing (LCP) based on the System Information Event Management (SIEM) technology, to monitor the behavior and the fitness of a network. LCP provides a flexible and complete solution to collect, correlate, and analyze logs from multiple devices as well as applications. An experiment testing the effectiveness of LCP in detecting DDoS attacks in a campus network environment was conducted, demonstrating a highly successful rate of detection. Besides threat detection and avoidance through log monitoring and analysis, other benefits of implementing the LCP framework are also included. This paper concludes by mentioning suggested enhancements for the LCP framework.

Keywords


Log Consolidation Processing; LCP framework; SIEM; DDoS; campus network; log monitoring solution

Full Text:

PDF

References


U. Horn, “What is a 5G Campus Network?”

T. D. D. Et. al., “An Investigation and Analysis of Cyber Security Information Systems: Latest Trends and Future Suggestions,” INFORMATION TECHNOLOGY IN INDUSTRY, vol. 9, no. 2, 2021, doi: 10.17762/itii.v9i2.372.

G. González-Granadillo, S. González-Zarzosa, and R. Diaz, “Security information and event management (SIEM): Analysis, trends, and usage in critical infrastructures,” Sensors, vol. 21, no. 14, 2021, doi: 10.3390/s21144759.

M. Azmi Bin Mustafa Sulaiman, M. Adib Khairuddin, M. Rizal Mohd Isa, M. Nazri Ismail, M. Afizi Mohd Shukran, and A. Abu Bakar Sajak, “SIEM Network Behaviour Monitoring Framework using Deep Learning Approach for Campus Network Infrastructure,” International journal of electrical and computer engineering systems, vol. 12, pp. 9–21, Nov. 2021, doi: 10.32985/ijeces.12.si.2.

I. Cvitić, D. Peraković, M. Periša, and S. Husnjak, “An overview of distributed denial of service traffic detection approaches,” Promet - Traffic - Traffico, vol. 31, no. 4, 2019, doi: 10.7307/ptt.v31i4.3082.

G. A. Jaafar, S. M. Abdullah, and S. Ismail, “Review of Recent Detection Methods for HTTP DDoS Attack,” Journal of Computer Networks and Communications, vol. 2019. 2019. doi: 10.1155/2019/1283472.

Fortinet, “What is a DDoS Attack? DDoS Meaning, Definition and Types.”

A. Mishra, N. Gupta, and B. B. Gupta, “Defense mechanisms against DDoS attack based on entropy in SDN-cloud using POX controller,” Telecommun Syst, vol. 77, no. 1, pp. 47–62, May 2021, doi: 10.1007/s11235-020-00747-w.

Y. A. Bekeneva, “Algorithm for Generating Event Logs Based on Data from Heterogeneous Sources,” in 2020 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (EIConRus), IEEE, Jan. 2020, pp. 233–236. doi: 10.1109/EIConRus49466.2020.9039350.

R. Ávila, R. Khoury, R. Khoury, and F. Petrillo, “Use of Security Logs for Data Leak Detection: A Systematic Literature Review,” Security and Communication Networks, vol. 2021. Hindawi Limited, 2021. doi: 10.1155/2021/6615899.

R. Ross, V. Pillitteri, and K. Dempsey, “Assessing enhanced security requirements for controlled unclassified information,” Mar. 2022. doi: 10.6028/NIST.SP.800-172A.

E. Zagan and M. Danubianu, “Data Lake Architecture for Storing and Transforming Web Server Access Log Files,” IEEE Access, vol. 11, 2023, doi: 10.1109/ACCESS.2023.3270368.

A. Zola, “What is an access log?”

B. AlSabbagh and S. Kowalski, “A Framework and Prototype for A Socio-Technical Security Information and Event Management System (ST-SIEM),” in 2016 European Intelligence and Security Informatics Conference (EISIC), IEEE, Aug. 2016, pp. 192–195. doi: 10.1109/EISIC.2016.049.

M. Schmidt, “Information security risk management terminology and key concepts,” Risk Management, vol. 25, no. 1, 2023, doi: 10.1057/s41283-022-00108-8.

MAMPU, “Cyber Security Framework For Public Sector (RAKKSSA).”

Securities Commission Malaysia, “Guidelines on Management of Cyber Risk.”

Technical Committee ISO/IEC JTC 1/SC 27, “ISO/IEC 27001 Information Security Management Systems.”

A. Alfaadhel, I. Almomani, and M. Ahmed, “Risk-Based Cybersecurity Compliance Assessment System (RC2AS),” Applied Sciences (Switzerland), vol. 13, no. 10, May 2023, doi: 10.3390/app13106145.

S. Ismail, M. N. Ismail, A. Ahmad, and M. A. Khairuddin, “Exploring the information security culture within industrial control systems organisations: Expert reviews,” 2022, p. 050005. doi: 10.1063/5.0120877.

M. F. Mustafa et al., “Student Perception Study on Smart Campus: A Case Study on HIgher Education Institution,” Malaysian Journal of Computer Science, pp. 1–20, Dec. 2021, doi: 10.22452/mjcs.sp2021no1.1.

R. Rawi, M. R. M. Isa, M. N. Ismail, A. A. B. Sajak, and A. Mustafa, “Preliminary study: The Readiness of WLAN Infrastructure at Malaysian Higher Education Institutes to Support Smart Campus Initiative,” International Journal on Informatics Visualization, vol. 7, no. 3, pp. 945–951, 2023, doi: 10.30630/joiv.7.3.1242.

A. S. A. Rahman, S. A. S. Ali, M. R. Isa, F. Ali, D. Kamaruddin, and M. H. Baharuddin, “Performance Assessment of Malaysian Fossil Fuel Power Plants: A Data Envelopment Analysis (DEA) Approach,” International Journal of Renewable Energy Development, vol. 12, no. 2, 2023, doi: 10.14710/ijred.2023.48487.

J. V. Botello, A. P. Mesa, F. A. Rodríguez, D. Díaz-López, P. Nespoli, and F. G. Mármol, “BlockSIEM: Protecting smart city services through a blockchain-based and distributed SIEM,” Sensors (Switzerland), vol. 20, no. 16, pp. 1–22, Aug. 2020, doi: 10.3390/s20164636.

B. Al-Duwairi, W. Al-Kahla, M. A. AlRefai, Y. Abdelqader, A. Rawash, and R. Fahmawi, “SIEM-based detection and mitigation of IoT-botnet DDoS attacks,” International Journal of Electrical and Computer Engineering, vol. 10, no. 2, pp. 2182–2191, 2020, doi: 10.11591/ijece.v10i2.pp2182-2191.

H. Karlzén, “An Analysis of Security Information and Event Management Systems,” Chamlers University of Technology, University of Goethenburg, no. January, 2009.

J. Yadav, “Sentiment Analysis on Social Media,” Qeios, Jan. 2023, doi: 10.32388/yf9x04.

S. W. Kelley, C. N. Mhaonaigh, L. Burke, R. Whelan, and C. M. Gillan, “Machine learning of language use on Twitter reveals weak and non-specific predictions,” NPJ Digit Med, vol. 5, no. 1, Dec. 2022, doi: 10.1038/s41746-022-00576-y.

A. Nistor and E. Zadobrischi, “The Influence of Fake News on Social Media: Analysis and Verification of Web Content during the COVID-19 Pandemic by Advanced Machine Learning Methods and Natural Language Processing,” Sustainability (Switzerland), vol. 14, no. 17, Sep. 2022, doi: 10.3390/su141710466.

R. Pandey et al., “A machine learning application for raising WASH awareness in the times of COVID-19 pandemic,” Sci Rep, vol. 12, no. 1, Dec. 2022, doi: 10.1038/s41598-021-03869-6.

H. E. Che Hamid, N. A. Mat Razali, M. N. Ismail, M. A. Khairuddin, and M. R. Mohd Isa, “A review paper: Forecasting of flood in Malaysia using machine learning,” 2022, p. 020012. doi: 10.1063/5.0119679.