Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit b49a98a

Browse files
Updated Readme.md
2 parents 23ae43c + 8cb3ee7 commit b49a98a

File tree

72 files changed

+4944
-2
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+4944
-2
lines changed

‎Assets/DDoS_Classification.png‎

64.9 KB
Loading[フレーム]

‎Assets/DDoS_Detection_Dashboard.png‎

475 KB
Loading[フレーム]

‎Assets/System_Outline.png‎

147 KB
Loading[フレーム]

‎Parrot_OS/DDoS_sim.py‎

Lines changed: 430 additions & 0 deletions
Large diffs are not rendered by default.

‎README.md‎

Lines changed: 97 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,98 @@
1-
# Multi-Class-DDoS-Detection-using-LSTM-Autoencoder
1+
# Multi-Class DDoS Detection Using LSTM Autoencoder and DNN
2+
3+
## Overview
4+
5+
This project presents a complete pipeline for real-time detection and classification of Distributed Denial of Service (DDoS) attacks. It leverages deep learning techniques, combining an LSTM Autoencoder for anomaly detection and a DNN for multi-class attack classification. The solution is based on realistic traffic data and supports real-time deployment scenarios.
6+
7+
![System Outline](Assets/System_Outline.png)
8+
<!-- <img src = "Assets/System_outline.png" width=00> -->
9+
---
10+
11+
## Key Features
12+
13+
- **Traffic Simulation**: Simulates various DDoS attack types in a virtualized environment.
14+
- **Traffic Capture**: Utilizes CICFlowMeter for feature extraction from raw network traffic.
15+
- **Two-Phase Detection**:
16+
- **Phase 1**: LSTM Autoencoder trained on normal traffic to detect anomalies.
17+
- **Phase 2**: Deep Neural Network (DNN) classifier to identify specific attack types.
18+
- **Real-time Dashboard**: Provides visualizations of traffic patterns, anomalies, and predicted attack classes.
19+
- **Low Latency**: Inference time ~0.28 ms/sample, suitable for high-throughput environments.
20+
21+
---
22+
23+
## Attack Types Covered
24+
25+
The system supports classification of various attack types across different layers:
26+
27+
- **TCP-based Reflection Attacks**: MSSQL
28+
- **UDP/TCP Reflection Attacks**: DNS, PORTMAP, LDAP, NetBIOS, SNMP
29+
- **UDP-based Reflection Attacks**: TFTP, NTP, CharGen
30+
- **TCP Exploitation Attacks**: SYN Flood
31+
- **UDP Exploitation Attacks**: UDP Flood, UDP-Lag
32+
33+
![DDoS Classification](Assets/DDoS_Classification.png)
34+
35+
---
36+
37+
## Dataset
38+
39+
The system is built on the [CIC-DDoS2019](https://www.kaggle.com/datasets/dhoogla/cicddos2019) dataset, which includes labeled flows for a wide range of real-world attack scenarios.
40+
41+
---
42+
43+
## Project Objectives
44+
45+
- Implement an LSTM Autoencoder to detect anomalous network behavior.
46+
- Integrate a DNN classifier for attack-type recognition.
47+
- Minimize false positives and maximize generalization across attack types.
48+
- Support real-time, low-latency detection.
49+
- Enable visualization for practical use in enterprise and academic research environments.
50+
51+
---
52+
53+
## Screenshots
54+
55+
56+
### Real Time Detection Dashboard
57+
![Dashboard](Assets/DDoS_Detection_Dashboard.png)
58+
59+
The dashboard visualizes network anomaly detection results. It showcases distribution of various DDoS attack types and the proportion of anomalous versus benign traffic. Use also can see the detailed records, enabling effective real-time monitoring and classification of network threats for cybersecurity analysis
60+
61+
---
62+
63+
## Project setup
64+
65+
1. Clone the repository:
66+
```bash
67+
git clone https://github.com/yourusername/multiclass-ddos-detector.git
68+
cd multiclass-ddos-detector
69+
70+
2. Move Files to Respective Virtual Machines (VMs)
71+
72+
3. Ensure that Parrot os and target machine/s are on the same network
73+
74+
75+
## How to run
76+
77+
1. Execute the attck script from Parrot OS
78+
```bash
79+
sudo python3 DDoS_sim.py -i <low/medium/high> -s -p <target port> <target IP> -d <attack_duration>
80+
81+
2. Run CICFlowMeter on Ubuntu
82+
```bash
83+
sudo bash run_cicflowmeter.sh
84+
85+
3. Send the generated CSV file to the host machine
86+
```bash
87+
sudo bash send_flow_file.sh
88+
89+
- choose the file
90+
- enter IP address of host
91+
92+
4. Receive File → Run Detection Model → Launch Dashboard
93+
```bash
94+
python .\ddos_manager.py
95+
96+
97+
298

3-
initial commit

‎Ubuntu_VM/CIC-Flowmeter/.gitignore‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Ignore build artifacts
2+
build/
3+
*.o
4+
*.class
5+
6+
# Ignore logs and temporary files
7+
logs/
8+
*.log
9+
*.tmp
10+
11+
# Ignore data files (CSV, etc.)
12+
data/
13+
14+
# Ignore jnetpcap library
15+
jnetpcap/
16+
17+
# Ignore Gradle files
18+
.gradle/
19+
20+
21+
# Ignore Maven files if not needed
22+
pom.xml
23+
24+
# Ignore misc files
25+
ReadMe.txt
26+
LICENSE.txt
27+
28+
29+
.vscode/
30+

‎Ubuntu_VM/CIC-Flowmeter/README.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
## Install jnetpcap local repo
2+
3+
for linux, sudo is a prerequisite
4+
```
5+
//linux :at the pathtoproject/jnetpcap/linux/jnetpcap-1.4.r1425
6+
//windows: at the pathtoproject/jnetpcap/win/jnetpcap-1.4.r1425
7+
mvn install:install-file -Dfile=jnetpcap.jar -DgroupId=org.jnetpcap -DartifactId=jnetpcap -Dversion=1.4.1 -Dpackaging=jar
8+
```
9+
10+
## Run
11+
### IntelliJ IDEA
12+
open a Terminal in the IDE
13+
```
14+
//linux:
15+
$ sudo bash
16+
$ ./gradlew execute
17+
18+
//windows:
19+
$ gradlew execute
20+
```
21+
### Eclipse
22+
23+
Run eclipse with sudo
24+
```
25+
1. Right click App.java -> Run As -> Run Configurations -> Arguments -> VM arguments:
26+
-Djava.library.path="pathtoproject/jnetpcap/linux/jnetpcap-1.4.r1425" -> Run
27+
28+
2. Right click App.java -> Run As -> Java Application
29+
30+
```
31+
32+
## Make package
33+
34+
### IntelliJ IDEA
35+
open a Terminal in the IDE
36+
```
37+
//linux:
38+
$ ./gradlew distZip
39+
//window
40+
$ gradlew distZip
41+
```
42+
the zip file will be in the pathtoproject/CICFlowMeter/build/distributions
43+
44+
### Eclipse
45+
At the project root
46+
```
47+
mvn package
48+
```
49+
the jar file will be in the pathtoproject/CICFlowMeter/target

‎Ubuntu_VM/CIC-Flowmeter/build.gradle‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
apply plugin: 'java'
2+
apply plugin: 'maven'
3+
apply plugin: 'application'
4+
5+
group = 'cic.unb.ca'
6+
version = '4.0'
7+
description = """CICFlowMeterV4"""
8+
9+
sourceCompatibility = 1.8
10+
targetCompatibility = 1.8
11+
12+
repositories {
13+
mavenLocal()
14+
mavenCentral()
15+
maven { url "https://clojars.org/repo" }
16+
}
17+
dependencies {
18+
compile group: 'org.apache.logging.log4j', name: 'log4j-core', version: '2.11.0'
19+
compile group: 'org.slf4j', name: 'slf4j-log4j12', version:'1.7.25'
20+
compile group: 'org.jnetpcap', name: 'jnetpcap', version:'1.4.1'
21+
compile group: 'junit', name: 'junit', version:'4.12'
22+
compile group: 'org.apache.commons', name: 'commons-lang3', version:'3.6'
23+
compile group: 'org.apache.commons', name: 'commons-math3', version:'3.5'
24+
compile group: 'commons-io', name: 'commons-io', version:'2.5'
25+
compile group: 'nz.ac.waikato.cms.weka', name: 'weka-stable', version:'3.6.14'
26+
// https://mvnrepository.com/artifact/org.jfree/jfreechart
27+
compile group: 'org.jfree', name: 'jfreechart', version: '1.5.0'
28+
// https://mvnrepository.com/artifact/com.google.guava/guava
29+
compile group: 'com.google.guava', name: 'guava', version: '23.6-jre'
30+
// https://mvnrepository.com/artifact/org.apache.tika/tika-core
31+
compile group: 'org.apache.tika', name: 'tika-core', version: '1.17'
32+
33+
}
34+
sourceSets {
35+
main {
36+
java {
37+
srcDir 'src'
38+
exclude '**/CICFlowMeter.java'
39+
}
40+
}
41+
}
42+
43+
task zipSrc(type: Zip){
44+
baseName "${applicationName}-Source"
45+
destinationDir = file('build/')
46+
from('.'){
47+
include '**/'
48+
exclude '.gradle/','build/','bin/','logs/','*.iml','*.ipr','*.iws','.idea/','out/','data/'
49+
into "${applicationName}V${version}-Src"
50+
}
51+
}
52+
53+
import org.apache.tools.ant.DirectoryScanner
54+
task zipPro(type: Zip){
55+
56+
doFirst {
57+
DirectoryScanner.defaultExcludes.each { DirectoryScanner.removeDefaultExclude it }
58+
//DirectoryScanner.addDefaultExclude 'something has to be in here or everything gets excluded'
59+
}
60+
61+
doLast {
62+
DirectoryScanner.resetDefaultExcludes()
63+
}
64+
65+
baseName "${applicationName}-Full"
66+
destinationDir = file('build/')
67+
68+
from('.'){
69+
include '**/'
70+
exclude '.gradle/','build/','bin/','logs/','*.iml','*.ipr','*.iws','.idea/','out/','data/',".git/"
71+
into "${applicationName}V${version}"
72+
}
73+
}
74+
75+
76+
task fatJar(type: Jar) {
77+
println 'type Jar'
78+
79+
manifest {
80+
81+
attributes 'Premain-Class': 'swing.common.ObjectSizeFetcher'
82+
attributes 'Can-Retransform-Classes': true
83+
attributes 'Implementation-Title': 'Gradle Jar File Example',
84+
'Implementation-Version': version,
85+
'Main-Class': 'cic.cs.unb.ca.ifm.App'
86+
87+
}
88+
/*baseName = "NetWorkTraffic" + '-all'
89+
from { configurations.compile.collect { it.isDirectory() ? it : zipTree(it) } }
90+
into(new File('build/jar/'))
91+
with jar*/
92+
}
93+
94+
95+
task execute(type: JavaExec) {
96+
println 'type JavaExec'
97+
98+
99+
main = "cic.cs.unb.ca.ifm.App" //main class
100+
classpath = sourceSets.main.runtimeClasspath
101+
String osName = System.getProperty('os.name').toLowerCase()
102+
if(osName.contains('windows')){
103+
jvmArgs '-Djava.library.path=jnetpcap/win/jnetpcap-1.4.r1425'
104+
}else{
105+
jvmArgs '-Djava.library.path=jnetpcap/linux/jnetpcap-1.4.r1425'
106+
}
107+
}
108+
109+
110+
task exeCMD(type: JavaExec){
111+
main = "cic.cs.unb.ca.ifm.Cmd" //main class
112+
classpath = sourceSets.main.runtimeClasspath
113+
String osName = System.getProperty('os.name').toLowerCase()
114+
if(osName.contains('windows')){
115+
jvmArgs '-Djava.library.path=jnetpcap/win/jnetpcap-1.4.r1425'
116+
}else{
117+
jvmArgs '-Djava.library.path=jnetpcap/linux/jnetpcap-1.4.r1425'
118+
}
119+
//args = ["/home/yzhang29/0a/Capture/", "/home/yzhang29/0a/Capture/out/"]
120+
}
121+
122+
123+
task cmdScript(type: CreateStartScripts) {
124+
mainClassName = "cic.cs.unb.ca.ifm.Cmd"
125+
applicationName = "cfm"
126+
outputDir = new File(project.buildDir, 'scripts')
127+
classpath = jar.outputs.files + project.configurations.runtime
128+
defaultJvmOpts = ["-Djava.library.path=../lib/native"]
129+
}
130+
131+
applicationDistribution.into("bin") {
132+
from(cmdScript)
133+
fileMode = 0755
134+
}
135+
136+
137+
// The Application Plugin
138+
mainClassName = "cic.cs.unb.ca.ifm.App"
139+
applicationName = "CICFlowMeter"
140+
applicationDefaultJvmArgs = ["-Djava.library.path=../lib/native"]
141+
142+
applicationDistribution.from("jnetpcap/linux/jnetpcap-1.4.r1425") {
143+
include "*.so"
144+
into('lib/native')
145+
}
146+
applicationDistribution.from("jnetpcap/win/jnetpcap-1.4.r1425") {
147+
include "*.dll"
148+
into('lib/native')
149+
}
150+
applicationDistribution.from('LICENSE.txt'){
151+
into('')
152+
}
153+
applicationDistribution.from('ReadMe.txt'){
154+
into('')
155+
rename("ReadMe.txt","README.md")
156+
}
53.4 KB
Binary file not shown.
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#Fri May 25 10:05:01 ADT 2018
2+
distributionBase=GRADLE_USER_HOME
3+
distributionPath=wrapper/dists
4+
zipStoreBase=GRADLE_USER_HOME
5+
zipStorePath=wrapper/dists
6+
distributionUrl=https\://services.gradle.org/distributions/gradle-4.2-all.zip

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /