Economic denial of sustainability attack detection using ensemble-based machine learning

Abstract

Cloud computing is developed to meet the demands of diverse IT and computing services delivered over the internet, gaining widespread popularity for providing cost-effective solutions to companies and businesses. However, various security vulnerabilities, including a novel type known as Economic Denial of Sustainability (EDoS) attacks, pose significant risks to the economic safety of cloud users. This research presents an effective solution to counter EDoS attacks using ensemble-based machine learning. Ensemble-based machine learning is highly capable of analyzing network traffic to extract hidden patterns to distinguish benign and attack packets, hence, capable of preventing users from incurring unnecessary expenses due to EDoS attacks. The application of black box machine learning models in the EDoS scenario raises concerns about legitimate packet rejection and the passage of malicious packets. To address this issue, explainable AI techniques, namely SHAP and LIME, have been employed, shedding light on the decision-making process of the machine learning model and transforming it into an interpretable model. Two distinct datasets, namely UNSW-NB15 and CSE-CIC-IDS18, have been utilized for the development and assessment of models. Results demonstrate that the performance of the ensemble-based model surpasses that of the non-ensemble-based model in both datasets. The Extra Tree model achieved the highest accuracy score of 0.9934 on the UNSW-NB15 dataset, while the CatBoost model attained the highest accuracy score of 0.9893 on the CSE-CIC-IDS18 dataset. Both models have been globally elucidated using the SHAP explainable AI technique. In the analysis, the 'sttl' feature was identified as the most influential in the decision-making process of the Extra Tree model. Similarly, for the CatBoost model, the 'Dst Port' feature was recognized as having the most significant impact on model decisions. Furthermore, the decision of each model for every instance has been clarified utilizing both SHAP and LIME techniques. This verifies the reliability of ensemble-based machine learning in detecting EDoS attacks and its effectiveness in safeguarding cloud users from incurring unwanted bills.