Locally weighted classifiers for detection of neighbor discovery protocol distributed denial-of-service and replayed attacks

Abstract

The Internet of things requires more internet protocol (IP) addresses than IP version 4 (IPv4) can offer. To solve this problem, IP version 6 (IPv6) was developed to expand the availability of address spaces. Moreover, it supports hierarchical address allocation methods, which can facilitate route aggregation, thus limiting expansion of routing tables. An important feature of the IPv6 suites is the neighbor discovery protocol (NDP), which is geared towards substitution of the address resolution protocol in router discovery and function redirection in IPv4. However, NDP is vulnerable to denial-of-service (DoS) attacks. In this contribution, we present a novel detection method for distributed DoS (DDoS) attacks, launched using NDP in IPv6. The proposed system uses flow-based network representation, instead of a packet-based one. It exploits the advantages of locally weighted learning techniques, with three different machine learning models as its base learners. Simulation studies demonstrate that the intrusion detection method does not suffer from overfitting issues and offers lower computation costs and complexity, while exhibiting high accuracy rates. In summary, the proposed system uses six features, extracted from our bespoke dataset and is capable of detecting DDoS attacks with 99% accuracy and replayed attacks with an accuracy of 91.17%, offering a marked improvement in detection performance over state-of-the-art approaches.