Machine Learning-Based Identification of DDoS Flood Attack in eHealth Cloud Environment

Today’s healthcare system is largely dependent on information technology. Cloud-based patient data storage and retrieval is quickly gaining popularity in the medical world. However, it has been observed that the cloud platform is vulnerable to different types of attacks, the most common of which is distributed denial-of-service (DDoS) attack. This attack is capable of halting the network within a very short time and prevents access to important data. Among the different types of DDoS attacks TCP-SYN FLOOD attack renders the servers useless in no time by sending multiple malicious packets. It is necessary to identify such attacks at the onset. In the proposed work the authors tried to distinguish between the normal traffic and TCP-SYN FLOOD attack within first 1 min of the transmission. Different machine learning algorithms such as multilayer perceptron (MLP), random forest (RF), and support vector machine (SVM) were used to construct the model to classify the attack. Statistical metrics were used to assess the performance of the models. MLP was found to have the highest accuracy of 99.32%. A comparison was made with similar previous works, and some future research prospects were also discussed.