Vehicular networks are vulnerable to Distributed Denial of Service (DDoS), an extension of a Denial of Service (DoS) attack. The existing solutions for DDoS detection in vehicular networks use various Machine Learning (ML) algorithms. However, these algorithms are applicable only in a single layer in a vehicular network environment and are incapable of detecting DDoS dynamics for different layers of the network infrastructure. The recently reported attacks on transport networks reveal the fact that a research gap exists between the existing solutions and the multi-layer DDoS detection strategy requirements. Additionally, the majority of the current detection methods fail in the consideration of traffic heterogeneity and are not rate-adaptive, where both the mentioned parameters are important for an effective detection system. In this paper, we introduce a comprehensive ML-based Network Intrusion Detection System (NIDS) against DDoS attacks in vehicular networks. Our proposed NIDS combines a three-tier security model, traffic adaptivity, and heterogeneity traffic provisions. We call our model Vehicular Adaptive Intrusion Detection And Novel System for Heterogeneous Hosts (VAIDANSHH). As mentioned earlier, VAIDANSHH has a three-tier security system: at RSU's hardware, communication channel, and RSU application level. VAIDANSHH combines the Adaptive Alarming Module (AAM) and the Detection Module (DM) for data generation, collection of generated data, flow monitoring, pre-processing, and classification. We use the NS3 simulation tool for our experiments to generate synthetic data and apply ML with WEKA. We run a thorough set of experiments, which show that VAIDANSHH detects UDP flooding, a form of DDoS attack, with 99.9% accuracy within a very short time. We compare VAIDANSHH with other state-of-the-art models; the comparative analysis shows that VAIDANSHH is superior in terms of accuracy and its multi-tier workflow.

Vehicular networks are expanding their applications for future sustainability. The reported increasing rate of data breaches through vehicular networks by Distributed Denial of Service (DDoS) type of intrusion creates concern for such networks. Existing security solutions focus only on intrusion detection. However, prevention solutions are more proactive and provide security by probabilistic analysis. Existing prevention models for vehicular networks have low accuracy and are unable to handle zero-day attacks and advanced persistent threats. In this paper, we solve the problems mentioned above and introduce Predictive Risk Evaluation for Vehicular Infrastructure Resilience (PREVIR), the first amalgamated model of logit method (statistical analysis) and LogitBoost method (machine learning) to prevent DDoS attacks in vehicular networks. In PREVIR, the logit model predicts the packet probabilities for identifying maliciousness. The machine learning method improves PREVIR's performance through iterative refinement of the model's periodic updates based on new traffic parameters. We run a set of experiments on PREVIR. We use our NS3-generated dataset, NSL-KDD public dataset, and CIC-DDoS public dataset. PREVIR analyses multiple attack types, including UDP flood, TCP flood, mixed flooding, U2R, Probe, and R2L attacks. The results show that PREVIR classifies packets with accuracy up to 99.99%. Our proposed PREVIR model achieves a True Positive Ratio (TPR) up to 100% and an average False Positive Ratio (FPR) of 35%. The comparative analysis shows that PREVIR's efficiency is 20% better on average in the prevention of malicious packets as compared to the state-of-the-art models.

In recent years, the frequently reported incidents of Distributed Denial of Service assaults on vehicular networks in various countries have made researchers find new protective solutions. DDoS attacks can propagate through the charging points for electric vehicles in a charging station and affect the production of critical infrastructures such as electric grids. Existing solutions are efficient in attack detection; however, current systems do not offer multi-level protection, and zero-day vulnerabilities are prone to escape from the detection systems. In this paper, we address the problems mentioned above and introduce the first Machine Learning (ML)–based DDoS protective solution to combine prevention and detection mechanisms in vehicular networks. To be more specific, our proposed model is the first to consider the adaptive traffic threshold to generate the alarm for a suspicious amount of traffic flow in an Intrusion Detection Prevention System (IDPS). We call our proposed approach Protecting vEhicular neTworks against distRibuted deniAl of service attacKs (PETRAK). PETRAK uses four functions: prevention, alarm, training, and detection. The alarming system uses the flow parameters and activates the detection module to detect malicious packets. The prevention system works in two modes: immediate and future. PETRAK uses logistic regression to identify incoming packets and signatures of malicious packets to prevent future attacks. We also show that our proposed model is implacable towards advanced post-quantum cryptography-based traffic and also able to analyse side-channel attacks. We run a comprehensive set of experiments to test PETRAK on our synthesized dataset, KDDCUP’99 dataset, CIC-MalMem-2022, and the ToN-IoT dataset. We observe that PETRAK shows an accuracy of 99%. The results claim the efficiency of PETRAK in detecting and preventing DDoS attacks in vehicular networks.