Boosting-Based DDoS Detection in Internet of Things Systems

Distributed Denial-of-Service (DDoS) attacks remain challenging to mitigate in the existing systems, including in-home networks that comprise different Internet of Things (IoT) devices. In this article, we present a DDoS traffic detection model that uses a boosting method of logistic model trees for different IoT device classes. Specifically, a different version of the model will be generated and applied for each device class since the characteristics of the network traffic from each device class may have subtle variation(s). As a case study, we explain how devices in a typical smart home environment can be categorized into four different classes (and in our context, Class 1—very high level of traffic predictability, Class 2—high level of traffic predictability, Class 3—medium level of traffic predictability, and Class 4—low level of traffic predictability). Findings from our evaluations show that the accuracy of our proposed approach is between 99.92% and 99.99% for these four device classes. In other words, we demonstrate that we can use device classes to help us more effectively detect DDoS traffic.