MENTORED: from modeling to experimentation - predicting and detecting DDoS and zero-day attacks

• Grant number: 18/23098-0
• Support Opportunities: Research Projects - Thematic Grants
• Start date: March 01, 2020
• End date: February 28, 2026
• Field of knowledge: Physical Sciences and Mathematics - Computer Science - Computer Systems
• Agreement: MCTI/MC
• Principal Investigator: Michele Nogueira Lima
• Grantee: Michele Nogueira Lima
• Host Institution: Instituto de Ciências Exatas (ICEx). Universidade Federal de Minas Gerais (UFMG). Belo Horizonte , SP, Brazil
• City of the host institution: Belo Horizonte
• Principal investigators: Aldri Luiz dos Santos ; José Augusto Suruagy Monteiro
• Associated researchers: Daniel Macêdo Batista ; Edilson Ferreira Lima ; Emerson Ribeiro de Mello ; Michelle Silva Wangham ; Paulo André da Silva Gonçalves
• Associated scholarship(s): 25/13988-1 - Engineering Early Warning Signals for Predicting DDoS Attacks, BP.TT; 25/14295-0 - Generalizable Autoencoders for Intrusion Detection, BP.TT; 25/12831-1 - Emulating and Detecting DDoS Attacks Using Virtualized Environment, BP.IC; + associated scholarships 25/09593-1 - Exploratory Analysis of Network Traffic in the Generation and Evaluation of Adversarial Samples, BP.IC; 25/02829-0 - Using DDoS Attack Emulation Tools in a Virtualized Environment, BP.IC; 25/06753-8 - Investigating Large Language Models for Attack Detection in IoT Environments, BP.IC; 25/01622-2 - Correlating Alerts for DDoS Attack Prediction, BP.IC; 25/01627-4 - Implementation of unsupervised Transformers models to predict DDoS attacks, BP.IC; 25/02406-1 - Investigating Adversarial AI Models and TinyML for Collaborative Cybersecurity Applications, BP.IC; 25/00239-0 - Traffic Monitoring and Attack Prevention in IoT, BP.TT; 25/00612-3 - Application of Transformers models for predicting DDoS attacks by correlating data sources, BP.TT; 24/22607-9 - Using Virtualization Tools to Predict and Detect DDoS Attacks, BP.IC; 24/22575-0 - Development of a Blockchain-Based Consensus Mechanism for Secure, Reliable and Resilient Communication between NIDS against DDoS Attacks, BP.IC; 24/10856-4 - Dynamic Control of IoT Traffic in Complex Environments, BP.PD; 24/09341-0 - Positioning and Optimization of Traffic Collectors in IoT Topologies, BP.PD; 24/04923-0 - Data anonymization to mitigate attribute disclosure attacks, BP.TT; 24/02680-3 - Building Virtualized Network Environments for Use in DDoS Attack Prediction and Detection, BP.IC; 24/02685-5 - Implementation of Anomaly-Based IDS in Virtualized Environments to Protect IoT Networks Against DDoS Attacks, BP.IC; 23/13902-4 - Modelling, detection and mitigation of DDoS attacks, BP.PD; 23/13773-0 - Early Warning Signals Engineering for Predicting DDoS Attacks, BP.TT; 23/13294-4 - Impact of network traffic anonymization on prediction and detection of DDoS attacks, BP.IC; 23/13307-9 - Correlating Heterogeneous Information Sources to Predict DDoS Attacks, BP.IC; 23/06265-8 - Evolution of the MENTORED Testbed Portal to provide project time management and new execution facilities of cybersecurity experiments with IoT devices, BP.TT; 22/07976-2 - Implementation and configuration of use cases for cybersecurity experiments on the FIBRE Portal, BP.IC; 22/09210-7 - Provide specialized support for the researchers and maintenance to the cybersecurity experimentation infrastructure, BP.IC; 22/06840-0 - The impact of the correlation of heterogeneous sources on botnets and DDoS prediction, BP.PD; 22/07068-9 - Implementation and tests of FIBREs portal extension for configuration of security experiment, BP.IC; 22/06802-0 - Assist on the FIBRE Islands Configurations to Experimentations on IoT Cybersecurity area, BP.IC; 21/14735-9 - Experiments on cybersecurity of the isolation solution for the FIBRE control plan, BP.IC; 21/13598-8 - Extending and configuring the RNP islands to implement the cybersecurity IoT testbed, BP.TT; 21/13217-4 - IDS modelling and development of reliable communication against denial of service attack in IoT, BP.TT; 21/04431-2 - Improvement and configuration of the islands in the cybersecurity IoT testbed, BP.TT; 20/05884-8 - MENTORED: from modeling to experimentation: predicting and detecting DDoS and zero-day attacks, BP.TT - associated scholarships

Abstract

The popularization of the Internet and its advances towards the Internet of Things (IoT) and the Internet of Everything (IoE) have raised expectations for new applications and services in different areas. Despite the great opportunities and benefits, these advances in the Internet also open space for great threats and dangers, some which did not exist before. In particular, there is concern in improving protections against Distributed Denial of Service (DDoS) attacks and against new attacks that may arise as a result of IoT and IoE scaling. Such concerns are relevant when considering recent attacks involving infected IoT devices that were responsible for some of the largest DDoS attacks in history. Considering this current scenario, this project aims to identify, model, and evaluate malicious behaviors associated with IoT to help in the construction of advanced and coordinated solutions to enable: prevention; prediction; detection, and mitigation of DDoS attacks. The team, made up of national and international partners from academia, industry, and government, will produce these solutions as well as build a testbed, to be offered to the entire security community, enabling experimentation of solutions for system and network security in a realistic way. (AU)

Scientific publications

(27)

(References retrieved automatically from Web of Science and SciELO through information on FAPESP grants and their corresponding numbers as mentioned in the publications by the authors)

SILVA, GABRIEL LUCAS F. M. E; DE NEIRA, ANDERSON BERGAMINI; NOGUEIRA, MICHELE; MORAES, IM; CAMPISTA, MEM; GHAMRI-DOUDANE, Y; COSTA, LHMK; RUBINSTEIN, MG. A Deep Learning-based System for DDoS Attack Anticipation. 2022 IEEE LATIN-AMERICAN CONFERENCE ON COMMUNICATIONS (LATINCOM), v. N/A, p. 6-pg., 2022-01-01. (18/23098-0)

DE ARAUJO, ALEX MEDEIROS; DE NEIRA, ANDERSON BERGAMINI; NOGUEIRA, MICHELE; IEEE. Lifelong Autonomous Botnet Detection. 2022 IEEE GLOBAL COMMUNICATIONS CONFERENCE (GLOBECOM 2022), v. N/A, p. 6-pg., 2022-01-01. (18/23098-0)

DE NEIRA, ANDERSON BERGAMINI; ARAUJO, ALEX MEDEIROS; NOGUEIRA, MICHELE; IEEE COMP SOC. Early Botnet Detection for the Internet and the Internet of Things by Autonomous Machine Learning. 2020 16TH INTERNATIONAL CONFERENCE ON MOBILITY, SENSING AND NETWORKING (MSN 2020), v. N/A, p. 8-pg., 2020-01-01. (18/23098-0)

VERGUTZ, ANDRESSA; DOS SANTOS, BRUNA V.; KANTARCI, BURAK; NOGUEIRA, MICHELE. Data Instrumentation From IoT Network Traffic as Support for Security Management. IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, v. 20, n. 2, p. 13-pg., 2023-06-01. (18/23098-0, 21/06733-6)

DE ELIAS, ERIK MIGUEL; CARRIEL, VINICIUS SANCHES; DE OLIVEIRA, GUILHERME WERNECK; DOS SANTOS, ALDRI LUIZ; NOGUEIRA, MICHELE; HIRATA JUNIOR, ROBERTO; BATISTA, DANIEL MACEDO; MORAES, IM; CAMPISTA, MEM; GHAMRI-DOUDANE, Y; et al. A Hybrid CNN-LSTM Model for IIoT Edge Privacy-Aware Intrusion Detection. 2022 IEEE LATIN-AMERICAN CONFERENCE ON COMMUNICATIONS (LATINCOM), v. N/A, p. 6-pg., 2022-01-01. (15/24485-9, 18/23098-0, 14/50937-1)

PAIVA, THALES B.; SIQUEIRA, YAISSA; BATISTA, DANIEL MACEDO; HIRATA JR, R.; TERADA, R.; VELAZQUEZ, R. BGP Anomalies Classification using Features based on AS Relationship Graphs. 2021 IEEE LATIN-AMERICAN CONFERENCE ON COMMUNICATIONS (LATINCOM 2021), v. N/A, p. 6-pg., 2021-01-01. (15/24485-9, 18/22979-2, 18/23098-0, 14/50937-1)

BARZILAY, ALAN; MARTINELLI, CAIO L.; NOGUEIRA, MICHELE; BATISTA, DANIEL M.; HIRATA, ROBERTO, JR.; MACHUCA, CM; MARTINS, L; SARGENTO, S; WAUTERS, T; JORGE, L; et al. AnubisFlow: A Feature Extractor for Distributed Denial of Service Attack Classification. PROCEEDINGS OF THE 2021 12TH INTERNATIONAL CONFERENCE ON NETWORK OF THE FUTURE (NOF 2021), v. N/A, p. 8-pg., 2021-01-01. (15/24485-9, 18/22979-2, 18/23098-0, 14/50937-1)

COELHO, KRISTTOPHER K.; OKUYAMA, MAURICIO M.; NOGUEIRA, MICHELE; VIEIRA, ALEX B.; SILVA, EDELBERTO E.; MIRANDA NACIF, JOSE AUGUSTO. A Dynamic Approach to Health Data Anonymization by Separatrices. 2024 IEEE SYMPOSIUM ON COMPUTERS AND COMMUNICATIONS, ISCC 2024, v. N/A, p. 6-pg., 2024-01-01. (18/23098-0)

DE OLIVEIRA, GUILHERME WERNECK; NEY, RODRIGO TOSCANO; HERRERA, JUAN LUIS; BATISTA, DANIEL MACEDO; HIRATA, R.; GALAN-JIMENEZ, JAIME; BERROCAL, JAVIER; MURILLO, JUAN MANUEL; DOS SANTOS, ALDRI LUIZ; NOGUEIRA, MICHELE; et al. Predicting Response Time in SDN-Fog Environments for IIoT Applications. 2021 IEEE LATIN-AMERICAN CONFERENCE ON COMMUNICATIONS (LATINCOM 2021), v. N/A, p. 6-pg., 2021-01-01. (14/50937-1, 15/24485-9, 18/22979-2, 18/23098-0)

BREZOLIN, UELINTON; VERGUTZ, ANDRESSA; NOGUEIRA, MICHELE. A method for vulnerability detection by IoT network traffic analytics. Ad Hoc Networks, v. 149, p. 10-pg., 2023-10-01. (18/23098-0, 21/06733-6)

INACIO, BRUNO BRANDAO; CARVALHO DE ARAUJO, JULIANA C.; DOS SANTOS, ALDRI L.; NOGUEIRA, MICHELE; HIRATA, R., JR.; BATISTA, DANIEL M.. A Lean and Modular Two-Stage Network Intrusion Detection System for IoT Traffic. 2024 IEEE LATIN-AMERICAN CONFERENCE ON COMMUNICATIONS, LATINCOM, v. N/A, p. 6-pg., 2024-01-01. (18/23098-0, 22/15304-4, 15/24485-9, 14/50937-1, 21/06995-0)

FARIAS JUNIOR, EUCLIDES PERES; DE NEIRA, ANDERSON BERGAMINI; BORGES, LIGIA FRACIELLE; NOGUEIRA, MICHELE. Survey paper Transformers model for DDoS attack detection: A survey. Computer Networks, v. 270, p. 38-pg., 2025-10-01. (18/23098-0, 22/06840-0, 25/00612-3)

MOSAIYEBZADEH, FATEMEH; ARAUJO RODRIGUEZ, LUIS GUSTAVO; BATISTA, DANIEL MACEDO; HIRATA JR, R.; VELAZQUEZ, R. A Network Intrusion Detection System using Deep Learning against MQTT Attacks in IoT. 2021 IEEE LATIN-AMERICAN CONFERENCE ON COMMUNICATIONS (LATINCOM 2021), v. N/A, p. 6-pg., 2021-01-01. (15/24485-9, 18/22979-2, 18/23098-0)

SCHWENGBER, BRUNO HENRIQUE; VERGUTZ, ANDRESSA; PRATES JR, NELSON G.; NOGUEIRA, MICHELE. Learning From Network Data Changes for Unsupervised Botnet Detection. IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, v. 19, n. 1, p. 13-pg., 2022-03-01. (20/05884-8, 18/23098-0)

VERGUTZ, ANDRESSA; PRATES, JR., NELSON G.; SCHWENGBER, BRUNO HENRIQUE; SANTOS, ALDRI; NOGUEIRA, MICHELE. An Architecture for the Performance Management of Smart Healthcare Applications. SENSORS, v. 20, n. 19, OCT 2020. (20/05884-8, 18/23098-0)

ARAUJO, ALEX MEDEIROS; DE NEIRA, ANDERSON BERGAMINI; NOGUEIRA, MICHELE. Autonomous machine learning for early bot detection in the internet of things. DIGITAL COMMUNICATIONS AND NETWORKS, v. 9, n. 6, p. 9-pg., 2023-12-01. (18/23098-0)

ANDRADE DE ARAUJO JOSEPHIK, JOAO GABRIEL; SIQUEIRA, YAISSA; MACHADO, KETLY GONCALVES; TERADA, ROUTO; DOS SANTOS, ALDRI LUIZ; NOGUEIRA, MICHELE; BATISTA, DANIEL MACEDO. Applying Hoeffding Tree Algorithms for Effective Stream Learning in IoT DDoS Detection. 2023 IEEE LATIN-AMERICAN CONFERENCE ON COMMUNICATIONS, LATINCOM, v. N/A, p. 6-pg., 2023-01-01. (18/23098-0, 15/24485-9, 21/06995-0, 14/50937-1)

DE NEIRA, ANDERSON BERGAMINI; KANTARCI, BURAK; NOGUEIRA, MICHELE. Distributed denial of service attack prediction: Challenges, open issues and opportunities. Computer Networks, v. 222, p. 27-pg., 2023-01-14. (18/23098-0)

ARBEX, GUSTAVO VITRAL; MACHADO, KETLY GONCALVES; NOGUEIRA, MICHELE; BATISTA, DANIEL M.; HIRATA, ROBERTO, JR.; MACHUCA, CM; MARTINS, L; SARGENTO, S; WAUTERS, T; JORGE, L; et al. IoT DDoS Detection Based on Stream Learning. PROCEEDINGS OF THE 2021 12TH INTERNATIONAL CONFERENCE ON NETWORK OF THE FUTURE (NOF 2021), v. N/A, p. 8-pg., 2021-01-01. (14/50937-1, 15/24485-9, 18/22979-2, 18/23098-0)

ARAUJO RODRIGUEZ, LUIS GUSTAVO; BATISTA, DANIEL MACEDO; IEEE. Towards Improving Fuzzer Efficiency for the MQTT Protocol. 26TH IEEE SYMPOSIUM ON COMPUTERS AND COMMUNICATIONS (IEEE ISCC 2021), v. N/A, p. 7-pg., 2021-01-01. (14/50937-1, 18/22979-2, 18/23098-0, 15/24485-9)

LIU, JINXIN; NOGUEIRA, MICHELE; FERNANDES, JOHAN; KANTARCI, BURAK. Adversarial Machine Learning: A Multilayer Review of the State-of-the-Art and Challenges for Wireless and Mobile Systems. IEEE COMMUNICATIONS SURVEYS AND TUTORIALS, v. 24, n. 1, p. 37-pg., 2022-01-01. (18/23098-0)

SCHWENGBER, BRUNO HENRIQUE; VERGUTZ, ANDRESSA; PRATES, NELSON G., JR.; NOGUEIRA, MICHELE; IEEE. A Method Aware of Concept Drift for Online Botnet Detection. 2020 IEEE GLOBAL COMMUNICATIONS CONFERENCE (GLOBECOM), v. N/A, p. 6-pg., 2020-01-01. (18/23098-0)

DE SANTANA, KHALIL G. QUEIROZ; SCHWARZ, MARCOS; WANGHAM, MICHELLE SILVA. Cybersecurity Testbeds for IoT: A Systematic Literature Review and Taxonomy. JOURNAL OF INTERNET SERVICES AND APPLICATIONS, v. 15, n. 1, p. 24-pg., 2024-01-01. (18/23098-0)

DE NEIRA, ANDERSON B.; BORGES, LIGIA F.; ARAUJO, ALEX M.; NOGUEIRA, MICHELE. Unsupervised Feature Engineering Approach to Predict DDoS Attacks. IEEE CONFERENCE ON GLOBAL COMMUNICATIONS, GLOBECOM, v. N/A, p. 6-pg., 2023-01-01. (22/06840-0, 18/23098-0)

DE NEIRA, ANDERSON BERGAMINI; DE ARAUJO, ALEX MEDEIROS; NOGUEIRA, MICHELE. An Intelligent System for DDoS Attack Prediction Based on Early Warning Signals. IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, v. 20, n. 2, p. 13-pg., 2023-06-01. (18/23098-0)

DE OLIVEIRA, GUILHERME WERNECK; NOGUEIRA, MICHELE; DOS SANTOS, ALDRI LUIZ; BATISTA, DANIEL MACEDO. Intelligent VNF Placement to Mitigate DDoS Attacks on Industrial IoT. IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, v. 20, n. 2, p. 13-pg., 2023-06-01. (14/50937-1, 18/23098-0, 15/24485-9)

RODRIGUEZ, LUIS GUSTAVO ARAUJO; BATISTA, DANIEL MACEDO. Resource-Intensive Fuzzing for MQTT Brokers: State of the Art, Performance Evaluation, and Open Issues. IEEE NETWORKING LETTERS, v. 5, n. 2, p. 5-pg., 2023-06-01. (14/50937-1, 15/24485-9, 18/23098-0)