{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,14]],"date-time":"2026-07-14T07:24:44Z","timestamp":1784013884943,"version":"3.55.0"},"reference-count":40,"publisher":"Wiley","license":[{"start":{"date-parts":[[2021,4,22]],"date-time":"2021-04-22T00:00:00Z","timestamp":1619049600000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100007837","name":"Universiti Tun Hussein Onn Malaysia","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100007837","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Security and Communication Networks"],"published-print":{"date-parts":[[2021,4,22]]},"abstract":"<jats:p>Currently, online organizational resources and assets are potential targets of several types of attack, the most common being flooding attacks. We consider the Distributed Denial of Service (DDoS) as the most dangerous type of flooding attack that could target those resources. The DDoS attack consumes network available resources such as bandwidth, processing power, and memory, thereby limiting or withholding accessibility to users. The Flash Crowd (FC) is quite similar to the DDoS attack whereby many legitimate users concurrently access a particular service, the number of which results in the denial of service. Researchers have proposed many different models to eliminate the risk of DDoS attacks, but only few efforts have been made to differentiate it from FC flooding as FC flooding also causes the denial of service and usually misleads the detection of the DDoS attacks. In this paper, an adaptive agent-based model, known as an Adaptive Protection of Flooding Attacks (APFA) model, is proposed to protect the Network Application Layer (NAL) against DDoS flooding attacks and FC flooding traffics. The APFA model, with the aid of an adaptive analyst agent, distinguishes between DDoS and FC abnormal traffics. It then separates DDoS botnet from Demons and Zombies to apply suitable attack handling methodology. There are three parameters on which the agent relies, normal traffic intensity, traffic attack behavior, and IP address history log, to decide on the operation of two traffic filters. We test and evaluate the APFA model via a simulation system using CIDDS as a standard dataset. The model successfully adapts to the simulated attack scenarios\u2019 changes and determines 303,024 request conditions for the tested 135,583 IP addresses. It achieves an accuracy of 0.9964, a precision of 0.9962, and a sensitivity of 0.9996, and outperforms three tested similar models. In addition, the APFA model contributes to identifying and handling the actual trigger of DDoS attack and differentiates it from FC flooding, which is rarely implemented in one model.<\/jats:p>","DOI":"10.1155\/2021\/5542919","type":"journal-article","created":{"date-parts":[[2021,4,23]],"date-time":"2021-04-23T19:49:54Z","timestamp":1619207394000},"page":"1-17","source":"Crossref","is-referenced-by-count":44,"title":["An Adaptive Protection of Flooding Attacks Model for Complex Network Environments"],"prefix":"10.1155","volume":"2021","author":[{"given":"Bashar Ahmad","family":"Khalaf","sequence":"first","affiliation":[{"name":"Faculty of Computer Science and Information Technology, Universiti Tun Hussein Onn Malaysia, Johor 86400, Malaysia"},{"name":"Bilad Alrafidain University College, Ba\u2019aqubah 32001, Diyala, Iraq"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5348-502X","authenticated-orcid":true,"given":"Salama A.","family":"Mostafa","sequence":"additional","affiliation":[{"name":"Faculty of Computer Science and Information Technology, Universiti Tun Hussein Onn Malaysia, Johor 86400, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aida","family":"Mustapha","sequence":"additional","affiliation":[{"name":"Faculty of Computer Science and Information Technology, Universiti Tun Hussein Onn Malaysia, Johor 86400, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9030-8102","authenticated-orcid":true,"given":"Mazin Abed","family":"Mohammed","sequence":"additional","affiliation":[{"name":"College of Computer Science and Information Technology, University of Anbar, Ramadi 31001, Iraq"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Moamin A.","family":"Mahmoud","sequence":"additional","affiliation":[{"name":"College of Computer Science and Informatics, Universiti Tenaga Nasional, Kajang, Selangor 43000, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bander Ali Saleh","family":"Al-Rimy","sequence":"additional","affiliation":[{"name":"Faculty of Engineering, Universiti Teknologi Malaysia, Johor 81310, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8824-6069","authenticated-orcid":true,"given":"Shukor","family":"Abd Razak","sequence":"additional","affiliation":[{"name":"Faculty of Engineering, Universiti Teknologi Malaysia, Johor 81310, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mohamed","family":"Elhoseny","sequence":"additional","affiliation":[{"name":"Department of Computer Science, College of Computer Information Technology, American University in the Emirates, Dubai 503000, UAE"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Adam","family":"Marks","sequence":"additional","affiliation":[{"name":"Zayed University, Dubai, UAE"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"311","reference":[{"key":"1","first-page":"221","article-title":"A survey of distributed denial-of-service (DDoS) defence techniques in ISP domains","volume-title":"Innovations in Computer Science and Engineering","author":"N. S. Rao","year":"2019"},{"key":"2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3056614"},{"key":"3","doi-asserted-by":"publisher","DOI":"10.1109\/access.2019.2908998"},{"key":"4","author":"S. Khandelwal","year":"2016"},{"key":"5","first-page":"313","article-title":"A comparison of three machine learning algorithms in the classification of network intrusion","author":"A. Zulhilmi"},{"key":"6","first-page":"361","article-title":"Flow-based benchmark data sets for intrusion detection","author":"M. Ring"},{"issue":"1","key":"7","doi-asserted-by":"crossref","first-page":"213","DOI":"10.30534\/ijeter\/2020\/3381.12020","article-title":"A smart network intrusion detection system based on network data analyzer and support vector machine","volume":"8","author":"O. S. Babatunde","year":"2020","journal-title":"International Journal of Emerging Trends in Engineering Research"},{"key":"8","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2007.01.040"},{"key":"9","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2017.07.003"},{"key":"10","first-page":"1","article-title":"An adaptive model for detection and prevention of DDoS and flash crowd flooding attacks","author":"B. A. Khalaf"},{"key":"11","doi-asserted-by":"publisher","DOI":"10.1109\/tpds.2011.262"},{"issue":"13","key":"12","doi-asserted-by":"crossref","first-page":"2222","DOI":"10.1002\/sec.1472","article-title":"Characterizing flash events and distributed denial-of-service attacks: an empirical investigation","volume":"9","author":"A. Bhandari","year":"2016","journal-title":"Security and Communication Networks"},{"key":"13","first-page":"210","article-title":"Parametric differences between a real-world distributed denial-of-service attack and a flash event","author":"S. Bhatia"},{"key":"14","doi-asserted-by":"publisher","DOI":"10.47839\/ijc.4.2.343"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2012.06.002"},{"key":"16","doi-asserted-by":"publisher","DOI":"10.7753\/ijcatr0202.1020"},{"key":"17","first-page":"280","article-title":"Detection of DoS\/DDoS attack against HTTP servers using naive Bayesian","author":"V. Katkar"},{"issue":"17","key":"18","first-page":"219","article-title":"An anomaly detection model in a LAN using K-NN and high-performance computing techniques","volume":"790","author":"M. Barrionuevo","year":"2017","journal-title":"Argentine Congress of Computer Science Journal"},{"key":"19","doi-asserted-by":"publisher","DOI":"10.1016\/j.aci.2017.10.003"},{"key":"20","doi-asserted-by":"publisher","DOI":"10.1109\/mcom.2018.1700621"},{"key":"21","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2017.12.091"},{"issue":"3","key":"22","article-title":"On evaluation of network intrusion detection systems: statistical analysis of CIDDS-001 dataset using machine learning techniques","volume":"26","author":"A. Verma","year":"2018","journal-title":"Pertanika Journal of Science & Technology"},{"key":"23","article-title":"Detection system of HTTP DDoS attacks in a cloud environment based on information theoretic entropy and random forest","volume":"2018","author":"I. Mohamed","year":"2018","journal-title":"Security and Communication Networks"},{"key":"24","first-page":"1","article-title":"Agent-based simulation of distributed defense against computer network attacks","author":"I. Kotenko"},{"issue":"2","key":"25","first-page":"193","article-title":"An agent-based framework to counter attack DDoS attacks","volume":"1","author":"D. Juneja","year":"2009","journal-title":"International Journal of Wireless Networks and Communications"},{"issue":"11","key":"26","first-page":"1","article-title":"Swarm intelligence based autonomous DDoS attack detection and defense using multi agent system","volume":"7","author":"R. Kesavamoorthy","year":"2018","journal-title":"Cluster Computing Journal"},{"key":"27","doi-asserted-by":"publisher","DOI":"10.47839\/ijc.17.1.945"},{"key":"28","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2018.11.002"},{"key":"29","first-page":"52","article-title":"Defining tasks and actions complexity-levels via their deliberation intensity measures in the layered adjustable autonomy model","author":"S. A. Mostafa"},{"key":"30","first-page":"1","article-title":"Adaptive, secure, and scalable distributed data outsourcing: a vision paper","author":"L. Xiong"},{"issue":"19","key":"31","first-page":"1146","article-title":"Developing component based adaptive applications in mobile environments","volume":"77","author":"D. Chefrour","year":"2005","journal-title":"Applied Computing Journal"},{"key":"32","first-page":"5","article-title":"Security measuring for self-adaptive security","author":"A. Evesti"},{"key":"33","doi-asserted-by":"publisher","DOI":"10.1155\/2018\/5198685"},{"key":"34","article-title":"CIDDS, coburg-intrusion-detection-data-sets","year":"2017"},{"key":"35","first-page":"247","article-title":"CALD: surviving various application-layer DDoS attacks that mimic flash crowd","author":"S. Wen"},{"key":"36","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2013.08.002"},{"key":"37","doi-asserted-by":"publisher","DOI":"10.1155\/2018\/7178164"},{"key":"38","first-page":"14","article-title":"Extended Kalman filter","author":"K. Fujii","year":"2013","journal-title":"Refernce Manual"},{"key":"39","first-page":"2304","article-title":"Weighted bloom filter","author":"J. Bruck"},{"key":"40","doi-asserted-by":"publisher","DOI":"10.1109\/access.2018.2803051"}],"container-title":["Security and Communication Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/5542919.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/5542919.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/5542919.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,2]],"date-time":"2023-11-02T17:08:57Z","timestamp":1698944937000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.hindawi.com\/journals\/scn\/2021\/5542919\/"}},"subtitle":[],"editor":[{"given":"Chalee","family":"Vorakulpipat","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"editor"}]}],"short-title":[],"issued":{"date-parts":[[2021,4,22]]},"references-count":40,"alternative-id":["5542919","5542919"],"URL":"https:\/\/doi.org\/10.1155\/2021\/5542919","relation":{},"ISSN":["1939-0122","1939-0114"],"issn-type":[{"value":"1939-0122","type":"electronic"},{"value":"1939-0114","type":"print"}],"subject":[],"published":{"date-parts":[[2021,4,22]]}}}