International Journal of Interactive Mobile Technologies (iJIM) – eISSN: 1865-7923 – Vol 17 No 11 (2023) Paper—Proposed Hybrid Secured Method to Protect Against DDOS in n Vehicular Adhoc Network… Proposed Hybrid Secured Method to Protect Against DDOS in n Vehicular Adhoc Network (VANET) https://doi.org/10.3991/ijim.v17i11.38907 Tuka Kareem Jebur Department of Accounting, Al-Mustansiriyah University, Baghdad, Iraq tukakareem@uomustansiriyah.edu.iq Abstract—Security and safety are critical concerns in Vehicular Adhoc Net- work. vulnerable to Distributed Denial of Service (DDoS) attacks, which occur when multiple vehicles carry out various tasks. This cause disrupts the normal functioning of legitimate routes. In this work, the Hybrid PSO-BAT Optimization Algorithm (HBPSO) Algorithm based on modified chaos -cellular neural net- work (Chaos - CNN) approaches has been proposed to overcome DDoS attacks. The suggest approaches consists of three-part which are hybrid optimization search algorithm to enhance the route from source to destination, chaos theory module is used to detect the abnormal nodes, then on Modified Chaotic CNN (MCCN) employed to prevent a malicious node from sending data to the desti- nation by determining node that consumer more resource, packets lose or the vic- tim could reset the path between the attacker and itself. CICIDS dataset has been used to test and evaluate the performance of the proposed approach based on the criteria of accuracy, packet loss, and jitter. The Chaos - CNN approached results to outperform similar models of the related work and the approach protects the VANETs with high accuracy of 0.8736, specificity of 0.9959, TPR of 0.9561, and FPR of 0.78, Detection rate 0.9561. Keywords—Vehicular Adhoc Networks (VANETs), Intrusion Detection Sys- tem (IDS), Distributed Denial of Service (DDoS) attack, chaos -cellular neural network (Chaos - CNN), particle swarm optimization, Bat optimization 1 Introduction As a result of the development in smart devices and software, the emergence of many advanced software and companies competing to produce models Sophisticated software and the increasing demand for smart systems, which is due to the rapid increase of vehicles on the road every day due to traffic jams for long periods [1]. VANETs con- sidered a subset of Adhoc Systems, Moving cars in cities and highways, and converting each car into a network participant, into a wireless router that allows cars to move away from each other at a distance of approximately 300 meters .The attacks that this network suffers from where users cannot analyze the resources in the event of an attack DDOS [2]. Because of the transmission of critical messages in VANETs, the availability re- iJIM ‒ Vol. 17, No. 11, 2023 141 https://doi.org/10.3991/ijim.v17i11.38907 mailto:%20tukakareem@uomustansiriyah.edu.iq Paper—Proposed Hybrid Secured Method to Protect Against DDOS in n Vehicular Adhoc Network… quirement should be prioritized among these requirements. If the availability of a mes- sage is jeopardized due to any issue, it can result in a life-threatening situation [3]. The groups that face this type of network are denial-of-service attacks due to the loss of security in this type of network, so there are many attempts to compensate for the defi- ciency in this aspect, where the problem of loss of security is the result of the network as a result of the network topology. A single source attack in Denial of Service (DOS) attacks, while DDoS uses multiple hosts to attack a network [4], [5]. The authorized users cannot determine resources in the case3of a DDoS attack. Chaos offers a more accurate and efficient identification of network abnormal activ- ity that reduces the false positive caused by the subjective factors of man [6]. Chaos - CNN enables the internal representation of the hidden layer to be read directly. MENN training algorithms are substantially quicker than multilayer phrases (MLPs) however (Chaos -CNN) used to defiance agents’ malicious nodes in MANET. The attacks by DDoS pose significant challenges to VANETs network accessibility. In this work, the Hybrid PSO - Bat Optimization algorithm and the Algorithm based Chaos -CNN ap- proaches have been proposed to overcome DDoS attack. Chaos -CNN approaches con- sist of three-part which are, Hybrid PSO - Bat Optimization algorithm clustering area to improve the route from origin to destination, chaos theory module is employed to detect the abnormal nodes, then Chaos –CNN employed to prevent a malicious node from sending data to the destination by determining node that consumer more resource, packets lose or the victim could reset the path between the attacker and itself. The re- mainder of this work is as follows: Section 2 includes a review of related literature. Section 3 describes the methodology ad Section 4 discusses the results of the experi- ment. Section 5 brings the work to a close. 2 Related works This research paper was presented in order to analyse and study DDOS in a network quickly and accurately in the event that this type of network shows abnormal behaviour, as many programs and algorithms were used, including packets, Bloom filters and other techniques among the traditional techniques, where security is among the most im- portant goals that this type of network loses.[7], [8]. As a result, we are more explicit and focused on this subject, as shown below. In [9], the ideal ant technique was used for the purposes of collecting information, verifying the network environment, where this algorithm contributed to identifying the sent packets, determining what kind of data was lost during transmission, and abnormal behavior in the case of determining the type of attacks on this type of network, which are DDOS attack , which are studied here. The nearby nodes in the network and collecting information were updated with this algorithm using the Moore-based cellular automata and this type of update was used to determine which nodes in the network the attack is taking place. In [10], the researcher used the ant colony algorithm with chaos theory in order to detect DDOS, where the best nodes eligible for transmission in the network were determined by determining the abnormal behaviour of the nodes within the network and redirecting the data to the best path from the source to the recipient Thus, the attacks are determined based on the 142 http://www.i-jim.org Paper—Proposed Hybrid Secured Method to Protect Against DDOS in n Vehicular Adhoc Network… abnormal behaviour of any node within the network, so that the severity of the attack was carefully studied and a procedure to take the correct action during the traffic routing process. additionally in [11], the researcher here is using an ant algorithm to reduce the load on the network and determine the transmission of data from a source to the network interface or node, choosing the best transmission path, the rest of the data is missing by identifying denial-of-service attacks. In [12], the swarm algorithm was proposed, the ant algorithm, PSO-ACO where this proposed hybrid algorithm was used to solve the problem of network mobility and data loss by solving the problem of load balancing in networks. 3 System model This study developed an algorithm that employs the trust model and the cuckoo search algorithm. To mitigate the effects of a DDoS attack, the second phase employs chaos theory to control network traffic and detect abnormalities in malicious nodes, while the third phase employs fuzzy logic to compare with the suggested method. We discussed the research methods and materials of this work in this section, beginning with a review of the hybrid PSO-BAT (HPSO-BAT), Chaos Theory-CNN Neural Net- work (Chaos-CNN) architecture, and mechanisms related to this work. Following that, the CIDDS testing dataset and its attributes were described. Following that, we explain the threats model design and the evaluation methods used. 3.1 Testing dataset Performance tests for intrusion detection systems (IDS) and intrusion prevention systems (IPS) are performed using a variety of datasets such as the KDD, DEFCON, and others. The CICIDS 2017 dataset [13] was chosen from among these various types of datasets based on the various features that can be used to evaluate the performance of our model. In this analysis, the available CICIDS 2017 data set was used to test the performance of the proposed model. Table 1 depicts the CICIDS features. Table 1. The CICIDS features [13] Feature name Weight Fwd. IAT. Total 46.083171 Flow. IAT. Max 39.047967 Active. Max 38.372911 Active. Min 37.004728 Fwd. IAT. Max 36.595626 Active. Mean 35.621885 Idle. Min 33.588032 Idle. Max 32.288567 Flow. IAT. Std 29.902196 Fwd. IAT. Mean 28.631780 iJIM ‒ Vol. 17, No. 11, 2023 143 Paper—Proposed Hybrid Secured Method to Protect Against DDOS in n Vehicular Adhoc Network… 3.2 Particle swarm optimization (PSO) Using social psychology, it Searching for the optimal solution in the specified area, and in general, the greater the number of elements of the swarm and the smallness of the search area, the faster and easier the optimal solution can be found in the least pos- sible time and vice versa, that is, the greater the number of elements removed from the used area and the small number of elements, the more difficult it will be to find the optimal solution [14]. 3.3 The Bat algorithm It is one of the algorithms inspired by living creatures, the bat algorithm and is in- spired by the behavior of bats in echolocation at rates varying in oscillation emission and loudness, Where the algorithm can be represented as follows [15]: 1. Echolocation is used by all bats to identify prey and obstacles based on sound fre- quencies received. 2. All bats fly at random with velocity (vl) at position (yl), and the values for frequency, loudness, and wavelength are fl, A0, and respectively. 3. The loudness shifts from a high positive (A0) to a low positive value (Amin). Bat sounds have a pulsation rate (rl) that ranges between 0 and 1. The number one means that the pulsation rate has reached its maximum, and 0 means that it has reached its minimum. The following equations [3] are used to update the velocity, frequency, and position: fl = fmin + ( fmax − fmin) × β (1) vl (t) = [yl (t − 1) − Y∗] × fl (2) yl (t) = yl (t − 1) + vl (t) × t (3) where fl is the frequency, fmin is the minimum frequency, fmax is the maximum frequency, Y is the best position for the bats, t is the time step, yl (t 1) is the bats' position at time t 1, vl (t) is the velocity, and is the random vector. 3.4 Chaos theory (CS) Chaos theory is can be considered a branch of mathematics, where this science fo- cuses on studying the states of dynamic systems. Are these systems governed by several laws, including its starting point [16]. Chaos theory is a multidisciplinary theory. Where a slight change in the system in one case can lead to a big difference in later cases, i.e. the dependence of the starting point or the initial conditions are considered sensitive to generate the final conditions where a butterfly can flapping its wings in China can cause a hurricane in other cities such as Texas [17]. 144 http://www.i-jim.org Paper—Proposed Hybrid Secured Method to Protect Against DDOS in n Vehicular Adhoc Network… 3.5 Cellular Neural Network (CNN) There are many systems that need to process microprocessors and operations, and among these systems is the image processing system, and as a result, image processing does not depend on the processing pattern in real time and sequentially CNN its types of neural networks are used in the processing and the organization of this type of net- work is C networks It is considered one of the dynamic networks, non-linear and con- tinuous, and it is one of the networks used in parallel computing [18]. 3.6 Bloom filter This filter can be tested from the filters that are used in operations that need high efficiency Use of space How this filter is used extensively to select and determine if this element that is assigned belongs to a group or not where there are several possibil- ities for a false positive match but there is no probability When this filter is used in the presence of false negatives, the bloom filter is working for permanent blocks of the attack IP address [19]. 3.7 The hybrid PSO - bat optimization algorithm and Modified Chaotic CNN (MCCN) Many methods have been proposed to defend against DDoS attacks as discussed in the literature but the performance is still not good enough. This work proposes thepso- bat Search Algorithm-based Modified Chaotic CNN (MCCN) to protect routing func- tions in MANETs against DDoS attack traffics. The hybrid PSO –BAT - MCNN mon- itors and controls DDoS traffics. This method monitors and analyze the incoming traf- fics by using Chaos Theory, any node with suspension behavior such as huge power consumer and movement and the relationship between source IPs and destination IPs will be detected as a malicious node. Figure 1 shows the architecture of the HPSOBAT - MCCN model. The model consists of three modules, which are Algorithm (HPSO- BAT), Modified Chaotic CNN (MCCN), and Chaos Theory (CS) as described below: This section defines the work being proposed to improve IDS to detect and mitiga- tion of DDoS. 1. First step Input network parameter upload data set that called (CICIDS) to Cuckoo search optimization algorithm, this algorithm gathers input data as clustering for route discoveries and better route selection according to coverage and CH then find the route and optimal CH in cluster determine out layer CH and saving IP address of nodes in a buffer. 2. The second step used chaos theory to detect abnormal nodes by controller network traffic with some parameters such: Average time, Specificity, False Positive Rate, and True Positive Rate accuracy. if the discover node as DDoS then go back to the first step, so the network output parameter is calculated with chaos theory and then the attacker is identified by MCCN if not determine the abnormal traffic the node iJIM ‒ Vol. 17, No. 11, 2023 145 Paper—Proposed Hybrid Secured Method to Protect Against DDOS in n Vehicular Adhoc Network… will be sent to bloom filter As previously stated, predefined parameters and traffic equate to permanent blocks for Demon IP address. 3. Third step applying MCCN to mitigation of DDoS in the VANET network. Based on the attacker’s activities, the kind of attacker is being checked and the attacker The achievement of the best results is determined. Fig. 1. The Proposed Method 3.8 Modified Chaotic CNN (MCCN) for optimal path finding and prevent a malicious node This algorithm was proposed to find the best path between two nodes in the network without consuming a large amount of energy or taking a large time [20-25] In order to make the CNN network more efficient and effective, it has been proposed or used Ress- ler chaos system in the learning process of the network in order to increase the speed of learning and achieve the best acceptable results. Pseudocode Hybrid pso-bat optimization algorithm 1. Input: Input dataset for training 2. Input file dataset for testing 3. Output: picked optimal CH and construction the value 4. Step1: generate the randomness placed of the VANET. (a) For every i in Total_Vehicles 146 http://www.i-jim.org Paper—Proposed Hybrid Secured Method to Protect Against DDOS in n Vehicular Adhoc Network… (b) Vx(i)=1000*runif(1) / Vx and Vy are the x and y coordinates of a vehicle (c) Vy(i)=1000* runif(1) (d) Fix(V(i), Vy(i)) (e) End For 5. Step2: To decide the coverage set of VANET (a) 1. For each i in 1:5 The number of iteration is 5 (b) 2. For each j in 1: Total _Vehicles (c) 3. dist<-sqrt((rx[i]-vx[j])^2-(ry[i]-vx[j]^2)) (d) 4. if (dist < 200) (e) cov_set[i,j]<-1 (f) else (g) cov_set[i,j]<-0 (h) End If (i) End For (j) End For 6. Step3: Define objective function f(x),x=(x1, x2, x3,-- ------) 7. Do initialization of a population of n bats /PSO swarm in erratic locations. parameter initializations and PSO examine parameter initializations 8. for it=1:N 9. New_Swarm =Get_PSO (Swarm ,Bestswarm ,Lowerbound,Upper- bound); 10. [fnew,Best,Swarm ,Fitness]=Get_Best_Swarm (Swarm ,New_Swarm ,fitness); 11. N_iteration =N_iterations+n; 12. New_Swarm =Empty_Swarm s(Swarm ,Lowerbound,Upper- bound,pa); [fnew,best,swarm ,fitness]=get_Best_Swarm (swarm ,New_Swarm ,fitness); N_iter=N_iter+n; 13. if fnew r(it+1) 20. s(i,:)=cbest+0.0001*rand(1,D); end 21. Fnew=fobj(s(i,:)); 22. if(Fnew<=fitness(i))&(rand