DDoS Attack Detection for Network and Transport Layer using SIEM for Deeper Analysis

The Distributed Denial-of-Service (DDoS) attacks have been recognized as the most disruptive threat in cybersecurity, where the attacker produces a large amount of malicious traffic to the victim’s network to make the system unavailable. DDoS attack mitigation is quite challenging due to IP spoofing, large traffic volume, and protocol exploitation in the network and transport layers. Our aim is to design a low-cost solution using open-source tools with deeper visualization, flexibility, and scalability, which are limited in most existing studies. In this paper, we have proposed a SIEM-based (Security Information and Event Management) architecture for the early detection of DDoS attacks to reduce the impact of service disruptions. We have incorporated important components such as Suricata (IDS), SIEM, and the Kibana Dashboard in this architecture. We have also analyzed the Kibana Dashboard with SIEM, which acts as a key feature for performance evaluation indicators. Using this method, we achieved a more insightful outcome for the detection of DDoS attacks on Layer 3 and Layer 4 of the OSI model.