POSEIDDON: Plataforma de Supervisão e Detecção de Intrusões DoS/DDoS Orientada a Nós de Borda

Abstract

The rapid expansion of Internet of Things (IoT) devices and the evolution of cyberthreats make the detection of denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks a critical need for the security of modern computing systems. Edge devices, characterized by their limited computing resources, present unique challenges for implementing effective security solutions, requiring optimized approaches that combine detection efficiency with computational solutions. This work presents an Edge-Oriented DoS/DDoS Intrusion Detection and Monitoring Platform, a novel anomaly detection system based on temporal analysis, specifically designed to operate on resource-constrained edge devices. The proposed approach systematically integrates four complementary temporal analysis techniques: Shannon entropy, ARIMA (AutoRegressive Integrated Moving Average), Hölder’s local exponent, and moving means, used for smoothing and trend identification. This multidimensional combination enables robust modeling of normal network traffic behavior and effective detection of statistical deviations that characterize malicious activity. Experimental validation was performed using the datasets (CIC-IDS-2017, CSE-CIC-IDS2018, CIC-IDS-2023) with a specific focus on application-layer attacks, notably DoS and DDoS attacks, such as Slowloris and SlowHTTPTest, which pose threats due to their ability to mimic their own traffic. The experimental methodology included 99% confidence intervals, ensuring statistical rigor. A significant methodological contribution was the implementation of cross-dataset cross-validation to assess temporal transferability, demonstrating the models’ ability to maintain adequate performance when applied to missing data across different periods. The experimental results demonstrate the high performance of the proposed approach, with Configuration 5 (combination of mobile media and Shannon entropy) achieving 99.9% accuracy in temporal cross-validation. Validation on a real device (Raspberry Pi 3b+) confirmed the solution’s computational prediction, demonstrating real-time detection capability without significantly compromising the device’s computational resources.