IoT DDoS Attack Detector

This project implements a machine learning-based DDoS attack detection system for IoT networks using the CICDDoS2019 dataset. It uses network traffic analysis and anomaly detection to identify potential DDoS attacks in real-time.

Features

• Real-time network traffic monitoring
• Feature extraction from network packets
• Machine learning-based anomaly detection using real-world DDoS attack data
• Configurable monitoring parameters
• Support for both training and detection modes

Requirements

• Python 3.8 or higher
• Network interface with packet capture capabilities
• Administrative/root privileges for packet capture
• At least 10GB of free disk space for the dataset

Installation

1. Clone this repository
2. Install the required dependencies:

pip install -r requirements.txt

Dataset

This project uses the CICDDoS2019 dataset from the Canadian Institute for Cybersecurity. The dataset includes:

• Real DDoS attack traffic
• Normal network traffic
• Various types of DDoS attacks
• Comprehensive network flow features

Downloading and Preparing the Dataset

1. Download the CICDDoS2019 dataset:

python download_dataset.py

This will:

• Create necessary directories
• Provide instructions for downloading the dataset
• Process the downloaded files
• Combine them into a single training dataset

2. Place the downloaded CSV files in the dataset directory

3. The script will automatically:

• Preprocess the data
• Extract relevant features
• Combine all files into training_data.csv

Usage

1. Train the Model

Train the model using the prepared dataset:

python main.py --train

This will train the model and save it as ddos_detector.joblib.

2. Run Detection

Start the DDoS detection:

python main.py --interface <your_network_interface> --duration 60

Replace <your_network_interface> with your network interface name (e.g., 'eth0' on Linux or 'Wi-Fi' on Windows).

Command Line Arguments

• --interface: Network interface to monitor (required for detection)
• --train: Flag to enable training mode
• --duration: Monitoring duration in seconds (default: 60)

Features Used for Detection

The system uses the following features from the CICDDoS2019 dataset:

• Flow duration
• Forward and backward packet counts
• Packet lengths and their statistics
• Flow bytes and packets per second
• Inter-arrival times (IAT) and their statistics
• And more...

How It Works

1. The system captures network traffic using Scapy
2. Extracts relevant features from packets
3. Uses Isolation Forest algorithm trained on real DDoS attack data
4. Provides real-time alerts for potential DDoS attacks

Security Considerations

• This tool requires network interface access
• Use with caution in production environments
• The model is trained on real attack data for better accuracy
• Consider implementing additional security measures

License

MIT License