This article has been accepted for inclusion in a future issue of this journal.

Content is final as presented, with the exception of pagination.

IEEE TRANSACTIONS ON ENGINEERING MANAGEMENT 1

ML-DDoS: A Blockchain-Based Multilevel DDoS

Mitigation Mechanism for IoT Environments
Rana Faisal Hayat , Sana Aurangzeb , Muhammad Aleem , Gautam Srivastava , Senior Member, IEEE,
and Jerry Chun-Wei Lin , Senior Member, IEEE

Abstract—Distributed denial of service (DDoS) attacks as well as example, in a health monitoring environment, different IoT de-
botnet-based attacks are among the most important security vul- vices such as medical sensors are connected to the human body.
nerabilities in Internet of Things (IoT) environments. Most of the These medical sensors send vital human body signs to a central
existing research approaches use centralized defense mechanisms
to prevent DDoS attacks in IoT environments. However, it is im- device and ultimately a medical server machine deployed within
portant to provide a reliable and scalable solution to prevent DDoS a hospital or in the cloud [4]. Today, millions of IoT devices and
attacks. Combining technologies such as distributed blockchain- the Internet of Medical Things (IoMT) are in operation, helping
based mechanisms and smart contracts facilitates the construc- transform the health care industry in a more intelligent way.
tion of a trusted distributed framework that can defend against However, mainstream usage of IoT has posed serious security
DDoS attacks in IoT. In this article, we have proposed a multilevel
DDoS mitigation approach (ML-DDoS) to protect IoT devices and challenges too [5].
other computing resources or machines using the blockchain-based In an IoT environment, distributed denial of service (DDoS)
framework. The core concept of the proposed system is to use attacks and botnet-based attacks are some of the main security
a device-based verification mechanism using blockchain and ex- vulnerabilities. In 2016, a famous botnet attack occurred that
clude malicious devices from IoT environments. The proposed is often referred to as Mari botnet attack disrupting Internet-
framework was developed using Hyperledger Caliper (a blockchain
benchmark tool) and its performance was evaluated using three based services and slowdowns in digital communications world-
benchmark applications. Compared to the state of the art, the wide [6]. The Internet services observed several other attacks too
results show that the proposed framework achieves up to 35% followed by the Mari botnet attack, whereas in 2016 a large-scale
improvement in throughput, up to 40% improvement in latency, DDoS attack through closed-circuit television (CCTV) cameras
and up to 25% better utilization of CPU. was faced by an Internet-hosting company, called OVH [7], in
Index Terms—Artificial intelligence, attacks, blockchain, which the cybercriminals hacked and use 145,607 cameras to
cybersecurity, distributed denial of service (DDoS), Internet of launch the DDoS attack [7], [8]. There are critical everyday
Things (IoT). applications where IoT devices are used such as home secu-
rity, hospitals, transportation, industrial automation, industrial
I. INTRODUCTION monitoring, and control. Therefore, it is essential to secure IoT
environments from DDoS and botnet attacks [9]. IoT devices
NTERNET of Things (IoT) devices [1]–[3] represent
I Internet-enabled components and machines such as sensors,
smart-cameras, medical sensors, smart security systems, to name
are manufactured offshore by third-party organizations and de-
ployed by organizations such as hospitals, industries, and other
critical businesses along with other IT infrastructure. Device
just a few that may coordinate with each other or with more
tampering to create a bot for potential DDoS attacks using IoT
capable computing resources (i.e., computing servers) for infor-
devices is a major security concern [9]. Several studies are then
mation exchange, processing, and analysis-related services. For
proposed [6], [10], [11] to mitigate the DDoS attacks initiated
by IoT-based bots, and most of those approaches [12]–[15] often
employ centralized defense mechanisms to tackle DDoS attacks.
Manuscript received December 30, 2021; revised March 15, 2022 and April
5, 2022; accepted April 22, 2022. Review of this manuscript was arranged by However, providing a reliable and efficient solution for the
Department Editor M.-Y. Chen. (Corresponding author: Jerry Chun-Wei Lin.) mitigation of DDoS attacks is important. In this regard, emerging
Rana Faisal Hayat and Muhammad Aleem are with the National Univer- technologies such as distributed blockchain-based mechanisms
sity of Computer and Emerging Sciences, Islamabad 44000, Pakistan (e-mail:
[email protected]; [email protected]). and smart contracts facilitate building a trustable distributed
Sana Aurangzeb is with the National University of Modern Languages, framework that could deal with DDoS attacks [10].
Islamabad 44000, Pakistan (e-mail: [email protected]). A blockchain is a peer-to-peer network of similar types
Gautam Srivastava is with the Department of Mathematics and Computer
Science, Brandon University, Brandon, MB R7A 6A9, Canada, and also with the of nodes that provides persistence, decentralization, auditabil-
Research Center for Interneural Computing, China Medical University, Taichung ity, and anonymity [16]. Blockchain technology provides a
404, Taiwan (e-mail: [email protected]). fully decentralized architecture in which no third parties are
Jerry Chun-Wei Lin is with the Department of Computer Science, Electri-
cal Engineering, and Mathematical Sciences, Western Norway University of involved [17] and it can be deployed to provide transpar-
Applied Sciences, 5063 Bergen, Norway (e-mail: [email protected]). ent and secure communication between different parties [15].
Color versions of one or more figures in this article are available at Blockchain uses different consensus algorithms to establish a se-
https://doi.org/10.1109/TEM.2022.3170519.
Digital Object Identifier 10.1109/TEM.2022.3170519 cure and trustworthy environment among diverse nodes such as

0018-9391 © 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

2 IEEE TRANSACTIONS ON ENGINEERING MANAGEMENT

SDN controller will be a major concern. In [18], the authors

discussed a firewall-based solution to mitigate the DDoS attack.
The major concerns about this approach [18] are related to the
compromise possibility of the firewall implementing protocol.
Moreover, the approach [18] does not discuss the protection of
the server becoming a bot. In summary, most of the authors
who have proposed approaches to mitigate DDoS attacks have
primarily not focused on preventing devices to become a bot.
Some other approaches [11], [19], [28], [29] investigated about
Fig. 1. DDoS attack using IoT as a weapon.
preventing IoT devices from becoming bots; however, most of
these approaches rely on the third-party services.
Considering the above-related approaches, it can be con-
Proof-Of-Work, Proof-Of-Stack, among others [6]. The consen- cluded that a multilevel approach that could secure not only IoT
sus algorithms define how a new node can enter the network and devices but also the interacting computing servers is essential.
how it can add a new block to the blockchain. The consensus Therefore, in this work, we propose a multilevel blockchain-
algorithms have two main classes such as proof and vote based based DDoS mitigation approach called ML-DDoS. Moreover,
algorithms [18]. the proposed scheme provides a mechanism that could address
In Fig. 1, a typical attack scenario is shown where the botnet issues related to compromised devices. The main contributions
is being used as the main tool for creating the DDoS attack of the ML-DDoS approach are as follows.
whereas, in Fig. 2, a typical IoT-based scenario is presented that 1) In-depth scrutiny of the literature, we analyze the strengths
can be compromised through a malicious attack. As depicted and weaknesses of the existing approaches.
in Fig. 1, first, the attacker compromises the devices and sends 2) We propose a blockchain-based multilevel DDoS mitiga-
false requests to the target server [19]. Afterward, the attacker tion approach and an authentication mechanism to protect
compromises the resources of a server making it incapable to devices from becoming bots.
communicate and interact with the attached IoT devices. Con- 3) The transaction in the designed model sends a control
sidering the operation critically of the IoT devices, especially mechanism using the gas limit blockchain aspects and
in Industry 4.0 (i.e., hospitals), these attacks must be managed blacklisting suspicious devices to disengage them from
and mitigated appropriately to reduce the potential financial and the core IoT environment.
human life-related losses [20]. The following text presents some 4) The performance evaluation of the proposed ML-DDoS
of the prominent research efforts related to the mitigation of approach is based on a benchmark application and com-
DDoS attacks in the IoT environment. pared with the other state-of-the-art approaches.
In [6], the authors proposed a blockchain-based solution to The rest of this article is organized as follows. Section II
protect servers and mitigate DDoS attacks. In [21], the authors presents an overview of ML-DDoS and blockchain. Section IV
presented a blockchain-based solution for mitigation of DDoS describes state-of-the-art work by highlighting the existing de-
attacks in IoT that is made up of the following four layers: veloped approaches. Section V describes the proposed frame-
1) smart-home; work with the research methodology. Section VI delineates
2) distributed blockchain; the experimental evaluation. Finally Section VII concludes this
3) cloud; article.
4) service layers.
In [22], the authors employed an SDN controller and machine
learning techniques to detect and mitigate both DoS and DDoS II. OVERVIEW AND BACKGROUND
attacks. In another work [23], the authors proposed a scheme IoT technology has emerged as a compelling area enabling a
to identify the origin of DDoS attacks. The identity of the global network of devices to interact with each other. In a cyber-
attack origin (i.e., IoT device’s IP addresses) helps place better physical environment, the IoT infrastructure mostly contains a
mitigation measures to lesson future attack possibilities. In [24], series of distributed sensors. A research report [30] describes
the authors discussed defence mechanisms related to only the that approximately 90 billion in IoT devices will be around the
protocol-oriented attacks (focusing only on a single layer attack). world by the end of 2025. In Fig. 2, IoT devices are connected
In some other related works [10], [25]–[27], the DDoS attack through API, and those APIs are connected to the database. The
mitigation has been investigated; however, an important aspect IoT devices sense the data and send it to the main database
related to compromising IoT devices to become botnet has not through different APIs.
been targeted (mostly the root cause of the DDoS attacks). IoT devices can be categorized into three different groups,
In [21], the authors discussed the mitigation-related approaches the first is consumer IoT devices, the second is enterprise IoT
for DDoS attacks based on third-party services. However, these devices, and the third is industrial IoT devices. For example,
approaches could be less effective (to mitigate DDoS attacks) different IoT devices installed in a smart home environment and
if the third-party services are compromised. In another related different sensors installed for different purposes [31]. A typical
approach [28], the authors proposed an SDN-based mitigation smart home may have one sensor installed at the garage front
approach; however the single point of failure related to the and one installed in a car. If a car is in a front of a garage,

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

HAYAT et al.: ML-DDoS: A BLOCKCHAIN-BASED MULTILEVEL DDOS MITIGATION MECHANISM 3

Fig. 2. Typical IoT working scenario.

then the car sensor communicates with the garage sensor to cannot be tempered by anyone. For example, any potential
open it [18]. Consumer IoT devices are used to track an asset change in one block will be invalidated by the other blocks (con-
and different industries use consumer IoT devices to track the taining the prechange hash of the tempered block) [11]. Recently,
product’s supply chain. Today, many sensors are employed in the usage of the blockchain has increased many folds and many
a typical smart-home such as smart fridges, smart home appli- businesses have employed this technology for their important
ances, smart-tv, security systems, etc. [14], [32]. business processes. Blockchain uses a consensus algorithm to
Industrial IoT devices are used for industrial purposes that reach a common agreement among peers, e.g., about the present
can be operated without human interaction [14]. Everywhere, state of the distributed and decentralized ledger. Some of the
the industrial IoT devices are operated without human interac- concrete objectives of a consensus algorithm are collabora-
tion whereas human-controlled IoT devices are monitored by tion, cooperation, and utilizing equal rights among all the nodes
individuals. Therefore, a thermostat failure in a smart home is of a blockchain [34]. Ethereum blockchain is a decentralized and
not considered to be a major failure in comparison with industrial open-source technology based on the concepts of smart contracts
thermostat failure, where a minor temperature change can cause (i.e., transactions protocols or blockchain programs). The smart
severe damage [31], [32]. The main market of IoT devices is contract employed by the Ethereum blockchain is the agreement
building automation, industrial automation, commercial trans- between two parties [11].
portation, enterprise asset management, smart cars, test and
measurement, and energy grid [6]. Different IoT devices are
installed for different purposes, and then IoT devices commu- III. MOTIVATION
nicate with other IoT devices through different communication DDoS is a harmful attack that exhausts many resources by
protocols [33]. The communication protocols are ZigBee, RFID, attacking frequently on cloud servers and creates a devastating
PAN, LOPAN, etc. Today, wireless sensor networks (WSNs) are problem [35]. However, a growing number of IoT devices en-
used for patient monitoring. For instance, if a patient cannot go ables us to avoid ignoring the influence of large-scale DDoS
to the hospital then the doctor attaches the sensors to the patient attacks from IoT devices [36]. As a result of the rapid devel-
body for monitoring heartbeat, blood pressure, etc. The sensors opment of IoT devices, IoT security has become a hot topic
link to the hospital server through different communication in recent years and security is considered one of the significant
protocols [13]. Generally, we can categorize the IoT devices issues. The existing solutions [20], [25], [27], [31], [32] consume
into three classes, [31] i.e., sensing, embedded processing, and large time for detection and focus on IoT device protection
the communication-related devices. (i.e., prevention techniques to avoid devices to be compromised)
Blockchain consists of a public ledger where all the nodes or secure servers to mitigate DDoS in the IoT environment.
are publicly visible and the last block is the hash of the other Moreover, there are several approaches [10], [26], [37], [38]
nodes EthereumSmartContracts. For example, block-2s header that rely on third-party services to mitigate DDoS attacks. The
consists of block-1s hash, block-3s header consists of block-1s major motivation behind this work is to provide a reliable and
and block-2s hashes, and so on (i.e., the last block will contain the scalable solution for the prevention of DDoS attacks using the
hash of all the other blockchain nodes [25]). Today, blockchain blockchain-based framework to improve latency, and throughput
is being used for asset management, in the financial sector, and and utilize CPU consumption in a better way. Moreover, it
in other commercial companies. Blockchain is immutable and is essential to cope with DDoS attacks using a multilayered

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

4 IEEE TRANSACTIONS ON ENGINEERING MANAGEMENT

approach, i.e., protecting and securing both edge IoT devices transactions in the blockchain-based energy network. However,
and the related compute resources or servers. To address these the proposed system can be integrated with edge computing,
issues, this article presents a machine learning-based DDoS where nodes can access optimal energy and use computing
mechanism to mitigate the abovementioned challenges for IoT services from an edge computing service provider.
environments. Bhardwaj et al. [13] proposed architecture based on four
layers, the first layer is the smart home, and the second is the
distributed blockchain layer, the third is the cloud layer, and the
IV. RELATED WORK fourth is the service layer. A smart home consists of different
Zhou et al. [10] discussed a fog computing-based approach IoT devices that communicate with each other. Different sensors
which detected and mitigated the DDoS attacks. The scheme such as room-heaters, security cameras, device controllers, etc.,
provided the depth analysis and checked the behavior of the are connected to share and send information to the cloud layer.
incoming packets using a three-layered architecture. The pro- A delay in communication in a smart-home environment could
posed three-layered architecture was based on the field devices, be very critical. The second layer uses distributed blockchain to
local servers, and Cloud servers. The proposed scheme provides distribute a ledger for providing data integrity. To approve any
extra resources for firewalls and servers to protect the main transactions, the authors employed a separate entity to approve
compute resources from DDoS attacks. The first layer, i.e., and add to the blockchain (the disapproved transactions are
the field layer fetches information from the IoT devices and discarded and not added to the blockchain).
forward it to the fog server layer. The field devices are based on Hameed et al. [32] used the SDN controller and machine
different controllers called remote terminal units and program learning techniques to detect and mitigate DoS and DDoS at-
logic controllers (connected to the field devices). The device’s tacks. The SDN-based security framework known as Soft-Things
information is then sent to a fog-server using those controllers. detects the abnormal behavior of IoT devices. If IoT devices
Javaid et al. [9] proposed a blockchain-based solution to behave abnormally, then the SDN framework does not send these
mitigate DDoS attacks on computing servers. The environment IoT devices’ information to the server. The machine learning
assumptions are based on several IoT devices connected to approach is used in the SDN controller to check the behavior of
the system, data sink devices, and data transmissions to the IoT devices. The machine learning-based techniques analyze the
main server through the gateway devices. The IoT devices send behavior of IoT devices. For example, if an existing IoT device
data to the main server. In this assumed environment, authors is allowed to send three packets per second, however, it sends a
argued that the devices lack protection and are vulnerable to lot of data such as 20–30 packets to the server, then the employed
becoming a bot, and thus, can initiate DDoS attacks. The au- ML models will detect the suspicious behavior of those devices
thors proposed a gas-limit-based constrained communication and deny further transactions.
(implemented via Ethereum blockchain that utilizes gas-limit for Qaisar et al. [40] discussed that today many businesses es-
sending transactions). Different IoT devices create a cluster and pecially the industry employ IoT and in case of an attack huge
send information to the main server using the gateway (which business losses could occur, and possibly other critical events
is assumed to send data to the server in a secure way). In the related to human life could be observed too. The proposed
proposed scheme, the authors employ smart contracts based on approach aims to identify the origin of the attack to mitigate and
customized rules and conditions to govern communication. A save the environment from further attacks. The server maintains
device does not involve in communication if the smart contract a shared IP addresses list related to legitimate devices. A device
rules are not abided by. Servers or miner machines receive data that is not part of this list is denied any communication or request
and validate it using the smart contract agreements. forwarding. The identification mechanism mainly uses an IP
Yeh et al. [7], proposed SOChain, a decentralized DDoS data matching scheme based on IPTraceback. Using this method,
exchange platform that uses blockchain technology to mitigate the IP addresses of the malicious IoT device and other outside
trust and fairness issues with the DDoS_coin token. With the communications are denied to protect the IoT environment.
increase of DDoS information, it earns more coins. To confirm Christopher et al. [15] discussed a machine learning-based
the authenticity of the uploaded data, Yeh et al. enlisted a content approach to detect DDoS attacks. The proposed approach uses
verifier (which is incentivized by DDoS_coin) to investigate the a traffic analysis scheme and with the help of ML models to
uploaded abnormal IP addresses. To minimize the management identify the malicious traffic. The proposed scheme targets a
effort, the entire mechanism is automatically executed in a smart specific DDoS attack type called DoSand attack. The core idea
contract deployed on the blockchain system. employed by the authors is to train the ML models on message
Ferrag et al. [39] presented DeepCoin, which is based on deep packet lengths. The trained ML model uses the packet length
learning and a blockchain-based energy framework for smart feature of the active communication to classify the potential
grids. This blockchain-based system includes a reliable peer-to- malicious communication by an intruder or the compromised
peer energy system based on a Byzantine fault tolerance algo- IoT device (such as a bot). Upon detection of malicious com-
rithm. The proposed system consists of five phases—namely, munication, the concerned IoT devices are blocked to prevent
the setup phase, agreement phase, creating a block stage and future communications.
consensus-making stage, and view change stage. DeepCoin is Cusack et al. [14] discussed that SDN is the core tech-
based on an intrusion detection system (IDS), which uses recur- nology to design and manage a new network more eas-
rent neural networks to detect network attacks and fraudulent ily. The SDN layer has been used by the authors for the

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

HAYAT et al.: ML-DDoS: A BLOCKCHAIN-BASED MULTILEVEL DDOS MITIGATION MECHANISM 5

detection of DDoS attacks. In the proposed scheme, the con- routers equipped with risk-based transfer algorithm implemen-
troller communication protocol is employed for information tations. The third party employs certain parameters and analyzes
exchange with the other peer controllers to defend from potential any incoming traffic before forwarding it to the smart home. If
DDoS attacks. The set of SDN controllers maintains lists of the incoming traffic does not meet the specified parameters, the
the legitimate IoT devices (within their networks). Communi- transaction is blocked by a third party. One of the weaknesses
cation is allowed among the legitimate IoT devices (i.e., only of this approach is the possibility of an information breach
if the device’s IDs match with the existing lists). The authors by the third party (all transactions should route through that
stated that the collective approach (employing multiple SDN entity).
controllers for mitigation of DDoS attacks) results in a more Mohanta and Debasish [41] proposed an SDN-based
effective result to mitigate the DDoS attacks with the least approach to detect and mitigate DDoS attacks in an industrial
overhead. However, the approach has an assumption that the IoT environment. The proposed solution comprises edge
SDN controller itself cannot be compromised which is not true computing, fog devices, and a cloud computing layer. At the
always. edge, different SDN-based IoT gateways are used while the fog
Meneghello and Mattteo [28] proposed a state-full forwarding layer handles the computations of SDN controllers. Moreover,
mechanism to mitigate the DDoS attacks. The author established for the detailed analysis and computation, the cloud layer is
a game model to analyze the objective of the attacker and the employed. The cloud analyzes the transactions related data and
detection aims of the defender. The proposed algorithm is used determines the possibilities of whether the transaction is valid
to enhance the detection of the distributed low rate attacks and or not. The cloud-based analysis is enforced using the SDN
subsequently employ corresponding mitigation mechanisms. layer of the proposed architecture.
The scheme uses a malicious request table concept to check Bodkhe and Sudeep [37] presented two different types of
for the incoming requests against that table. If any new request DDoS attack scenarios and their potential mitigation approaches
matches with the existing entries of the malicious request table, using software-defined network architecture. The first DDoS
it is dropped and any potential future requests are blocked too. attack mitigation scenario discussed is referred to as source-
The objective is to block a potential intruder device that can send based mitigation that employs multiple sources or devices for
another malicious request to compromise some other device in detection and is followed by the mitigation approach. The second
the IoT environment. DDoS attack scenario discussed is a network-wise attack (that
Khalid et al. [12] discussed that urban industries mostly compromises a network of devices, etc.). To counter this attack
rely on IoT devices for many essential and critical operations. type, a network operating system is employed that could analyze
Considering the Internet-based accessibility of the IoT devices, the traffic behavior or data transactions. The main motivation to
it becomes very crucial to protect these devices to become bots. employ the network operating system is to eliminate the change
The proposed scheme introduced an edge-oriented mechanism of single-point-of-failure possibility and provide a distributed
along the SDN controllers to detect and mitigate DDoS attacks. analysis and detection solution in the form of networked wide
The SDN controllers maintain a list of devices. Moreover, the services.
typical lengths of the messages are also maintained in the SDN Zhou and Huang [38] presented a botnet attack prevention
controllers. Whenever a device sends a communication request, mechanism using blockchain. This research focused on the as-
the request is checked against both the device lists and potential pects related to the IoT device compromise issue (a major cause
message lengths. The device is denied further communication of botnet attacks in IoT). To address the involved challenges, a
if detected as potentially malicious (considering the device lists blockchain-based supply-chain mechanism has been proposed.
and message lengths). The IoT devices are secured (ensuring their originality and
DDoS attacks1 are one of the most serious threats in IoT avoiding and tempering issues) the complete train starting from
environments. Two IP lists such as black-list and white-list the manufacturing to the supply is secured using the employed
are considered to prevent DDoS attacks and shared using the blockchain models. The use of nontempered devices will greatly
blockchain mechanism. If a malicious packet comes from a reduce the chances of device comprise events and result in fewer
blacklisted IP address the packet is not sent to the server (i.e., DDoS attacks.
only the white-list IP addresses are allowed to send packets In the above literature, it can be seen that most of the related
to the server). As all the legitimate devices are part of the techniques [20], [25], [27], [31], [32] focus on IoT device
white list, the server can easily identify the outsiders and is protection (i.e., prevention technique to avoid device to be
capable to prevent those from communicating with the other compromised) or secure servers to mitigate DDoS in the IoT
devices. environment. Moreover, there are several approaches [10], [26],
Bhushan and Gupta [20] proposed a DDoS mitigation scheme [37], [38] that rely on third-party services to mitigate DDoS
based on risk-based transfer algorithm is proposed. The applica- attacks. However, it is essential to cope with DDoS attacks
tion scenario discussed in this work is related to a smart home. using a multilayered approach, i.e., protecting and securing both
The proposed technique utilizes third-party-based services to edge IoT devices and the related compute resources or servers.
mitigate DDoS attacks. The proposed scheme uses gateways Moreover, relying on third-party-based analysis privacy is one
of the major concerns. Furthermore, the existing approaches
1 [Online]. Available: https://www.blockchain-council.org/blockchain/public mitigate the DDoS attack on only one side. Therefore, to cope
-vs-private-blockchain-a-comprehensive-comparison/ with the above-mentioned challenges, this work presents a

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

6 IEEE TRANSACTIONS ON ENGINEERING MANAGEMENT

TABLE I
SUMMARY OF THE RELATED WORK

blockchain-based multilevel approach for the mitigation of approach is based on the blockchain to avoid devices being
DDoS attacks in IoT environments. Table I gives a brief sum- compromised (easily detectable if device-related data are kept on
mary of the related work summarized in this Section. the blockchain ledger). The proposed ML-DDoS aims to provide
mitigation at both the device and server levels. The DDoS
attacker may launch the attack in two ways—compromising a
V. PROPOSED ML-DDOS APPROACH device into a bot and launching an attack without creating a
This section presents the details about the proposed ML- bot. In the first type of attack, after compromising a legitimate
DDoS approach. The core concept of the proposed ML-DDoS IoT device into a bot, the attacker bombards the server with

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

HAYAT et al.: ML-DDoS: A BLOCKCHAIN-BASED MULTILEVEL DDOS MITIGATION MECHANISM 7

Fig. 4. Flowchart of multilevel DDoS mitigation in IoT.

in the trusted devices list. After the validation the device is

allowed to communicate, otherwise, all transactions are blocked
(added to the list of untrusted devices) and communication is
Fig. 3. Proposed blockchain-based multilevel DDoS (ML-DDoS) mitigation abandoned for the future. The signature messages are used as
approach. an account id and therefore the communication of those devices
which do not have valid ids are not allowed to communicate. The
signature message-based denial of communication also prevents
a huge number of service requests to make it inaccessible or communication between an IoT device and the potential intruder
unresponsive (for legitimate IoT devices). In the second type of device to save it from being compromised.
attack, the attacker exploits different IoT devices to send joining The cloud storage service stores information received from
requests to the server, once joined the network, the server is the perception layer while the blockchain-based mechanism
burdened with a huge number of requests. prevents the outsider devices to establish a valid communica-
tion session with the compute servers. Therefore, to initiate a
A. ML-DDoS System Architecture DDoS attack in the IoT environment the intruder device or user
first has to compromise certain valid IoT device parts of the
Fig. 3 presents the system architecture of the proposed ML-
network. The different mechanisms could be employed by the
DDoS approach. The proposed solution is based on the following
attacker to compromise an IoT device and turn it into a bot.
three-layer architecture: 1) perception layer; 2) edge computing
The authentication messages could be validated (considering
layer; and 3) blockchain and storage layer. In the perception
the device id and signature) and only legitimate devices will
layer, different IoT devices are employed which are connected
be allowed to communicate with the network. However, if the
to the upper layer compute devices (i.e., IoT gateways in the
intruder becomes successful in compromising an IoT device
fog layer) to attain small-scale computing storage services. The
(part of the network) a mitigation approach is employed by
second layer related to edge computing consists of several IoT
our proposed solution. Each IoT device (part of our network)
gateways and edge computing devices. These devices are mainly
is assigned a gas limit that prevents a compromised device
responsible for providing application execution logic and related
to bombard the servers with a huge number of messages (i.e.,
computing and storage services to the interacting IoT devices.
preventing possible DDoS attacks).
The third layer, i.e., blockchain and storage represent cloud
services for blockchain services and data storage.
B. Proposed ML-DDoS Execution Flow
For the implementation of the blockchain-based services,
we use Ethereum, a decentralized and open-source blockchain, In Fig. 4, the complete execution flow of the proposed ML-
to develop smart contracts (i.e., transactions protocols or DDoS approach is depicted. First, we create four lists, named,
blockchain programs). Our developed smart contracts contain 1) trusted device list, 2) untrusted device list, 3) signature
four lists, one for the trusted devices and the remaining for other messages list, and 4) blacklisted device list. We use the Ethereum
purposes (at the start as empty lists). The usage of blockchain blockchain to share these lists in the IoT environment and server.
enables effective detection of any compromised device as the The usage of blockchain provides the highest integrity levels so
ledger containing the valid hashes cannot be compromised or that any intruder itself cannot modify a certain hash (related to
changed (other entities do not validate the change). the devices’ IDs and authentication messages). The blockchain’s
For interacting with the server, a device is required to use ledger hash should be the same if the data have no modifications;
a signature message. At the time of the communication, the therefore any violation related to the integrity of the data is
message signature is validated along with the device present readily determined.

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

8 IEEE TRANSACTIONS ON ENGINEERING MANAGEMENT

At the start, a device sends a request to the server which

verifies if the id of the requesting device is valid (i.e., part of
the trusted list) or not. A requesting device is added to the
untrusted list if the id of the device does not match with the
legitimate device ids (part of the trusted list). After registration
of a device, it has to perform the next level of authentication
using the signature message (a unique and random data message
assigned to all the legitimate devices). The server considers
the forwarded signature message from the device and validates
the legitimacy of the device. A device failing to authenticate
using the message string is denied further communication and is
added to the untrusted device list. Once a device is added to the
untrusted list, it will be requiring special admin permissions to
become part of the IoT environment. The untrusted list is then
shared using the Ethereum blockchain.
Our proposed approach employs a mechanism that coun-
Fig. 5. Flowchart for trusted device request verification.
ters the two potential bot attack patterns. As discussed above,
the proposed ML-DDoS addresses the issues related to any
malicious or bot device becoming part of the IoT network and
also it takes care of the scenario where an existing legitimate
device could potentially compromise. In the second type of bot
attack (where an existing or legitimate device is being compro-
mised), the proposed approach (depicted in Fig. 4) shows that
each legitimate device part of the IoT network has a gas-limit
quota which it utilizes to send messages in the network. In the
Ethereum blockchain platform, the gas is a paying mechanism
that is deducted to conduct or execute a transaction. Therefore,
based on the potential transaction requirements (or responsibil-
ities of the IoT devices concerning their potential communica-
tions), the gas-limit mechanism helps avoid the DDoS launched
by a compromised device. Whenever the gas limit of a certain
device expires, the admin can top up the new gas points and
an IoT device continues its normal operation. Moreover, we
have set a certain time-span value (as per the device’s specific
transaction requirements). For example, consider an IoT device
related to temperature monitoring in an industrial environment. Fig. 6. Flowchart of authentication request verification.
A time span of 5 s as an interval could be set for this device (for
sending the message with temperature reading). However, if the
devices try to overload the server or other devices (to which it is
interacting) with a lot of messages (with temperature reading) signature message from the device and validates the legitimacy
that shows an abrupt behavior and should be tackled. Therefore, of the device. In case of failure in the authentication process, the
the compromised devices showing abrupt behavior, i.e., flooding device is made part of the untrusted list.
the IoT environment with a large number of messages to cause In Fig. 6, the flow of the events related to the authentication
a DDoS attack are detected and such devices are added to request made by a potential intruder device (not part of the IoT
the black-listed devices. These lists are then propagated in the environment) is depicted. The intended device first sends the
IoT environment using the blockchain. request to the server and in response server validates whether
In Fig. 5, we have depicted the step-by-step workings of the device has forwarded a valid authentication message string
the trusted device-related request verification method. All the or not. In addition to that, a device is checked for the valid id
legitimate devices are part of the trusted-list and these lists are (i.e., is part of the trusted devices or not). In case the device
shared using the Ethereum blockchain. is currently not in the trusted list (which will be the case for
As discussed earlier, a device first sends a request to the server this flow chart activities) and the authentication message also
which verifies whether the id of the requesting device is valid mismatches, then the device is added to the blacklisted devices
(i.e., part of the trusted list) or not. A requesting device is added and any future communication is blocked to/from that specific
to the untrusted list if the id of the device does not match with the device. Once a device becomes part of the blacklisted device
legitimate device ids (part of the trusted list) and it is not able to list, it can only be unblocked if the admin explicitly allows it
authenticate using the message data (the second authentication (i.e., removing it from the blacklisted list and allowing another
step (as discussed above). The server considers the forwarded request attempt to that device).

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

HAYAT et al.: ML-DDoS: A BLOCKCHAIN-BASED MULTILEVEL DDOS MITIGATION MECHANISM 9

TABLE II
NOTATIONS USED IN ML-DDOS ALGORITHMS

C. Developed ML-DDoS Algorithm

For a multilevel approach, it is necessary to be able to secure
not only the IoT devices but also the corresponding interacting
computing servers. Therefore, in this article, we propose a
multilevel blockchain-based DDoS mitigation approach called
ML-DDoS. For the detailed working of the proposed ML-DDoS
approach, we have presented Algorithm 1. Notations used in
the remainder of the paper are summarized in Table II. Before
discussing the detailed steps of the algorithms, first, we present
the set of algorithmic notations (depicted in Table II) used in the
algorithms.
In Algorithm 1 (lines 1–2) device i is in tl , if a device is not
part of our IoT environment and it attempts to connect to the
network the server first verifies it using the device id lists or not.
If it is already a part of the trusted list (i.e., tl ), it is validated,
otherwise a nontrusted device label is returned. If the device has
a valid id (i.e., it has an id less than the total valid available
devices), the corresponding signature message is extracted for
that device as shown in Algorithm 1 (lines 3–4). Next, the device
will send an authentication request to the server. The signature
level authentication ensures that the device is not only part of
the network but also a trusted device. If the signature does not
match with the signature list, the device is added to the untrusted
list (i.e., ul ) (lines 5–6, Algorithm 1). As a case study, we have
assumed a time limit of the employed IoT devices equal to 5
s (configurable according to the needs and nature of the IoT
devices). The time-interval represents a message cycle-time from
an IoT device to the server. It helps to analyze an abrupt behav-
ior that a potential bot employs (i.e., sending many messages network and it sends a request for verification to potentially
irrespective of the set cycle time of the devices). In that case, the become part of the IoT network, the procedure depicted in
potential bot is detected first the transaction is declared invalid Algorithm 2 is employed. If the device sends a request, the
(Algorithm 1, line 8) and added to the blacklisted devices (i.e., signature of the request is checked. If the signature message is
bl ) as shown in Algorithm 1 (line 9). Next (see Algorithm 1, valid, then the valid status is returned and the device is allowed
line 10), the data packets related to the blacklisted device are to communicate within the IoT network otherwise it is denied
dropped from the network. Also, the updated blacklist is shared from the communication (Algorithm 2, lines 4–5).
in the IoT network (Algorithm 1, line 11). The proposed ML-DDoS is designed to mitigate the DDoS
As mentioned earlier, the proposed approach is based on a attacks at both device and server levels. The core concept of
blockchain-based multilevel DDoS mitigation approach and the the proposed scheme is to use a device-based verification mech-
authentication mechanism is important to protect devices that anism using blockchain and to remove the malicious devices
become bots. For this purpose, in Algorithm 2, the verification of from the IoT environment as early as possible. Therefore, in
the device, i.e., whether it is trusted or blacklisted, is performed. Algorithm 3, we discuss a valid or trusted device request verifi-
In Algorithm 2, we discuss a request verification method for the cation mechanism. As discussed earlier, the signature messages
untrusted devices. If the device is currently not part of the IoT are added for each interacting device in the proposed ML-DDoS

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

10 IEEE TRANSACTIONS ON ENGINEERING MANAGEMENT

TABLE III 1) Physically unclonable function (PUF) approach [6]:

SIMULATION SETUP
The physically unclonable function (PUF) is the technique
that assigns the unique identity to every IoT device. The
authentication framework checks the unique identity of the
IoT devices, if the unique identity of any device does not
match the device is detached from the IoT environment.
2) IoT-DDoS approach [9]: The IoT-DDoS technique sets the
gas limit of every IoT device in the Ethereum blockchain.
The device is prohibited from sending the data messages
if it exceeds the allocated gas limit.
3) IoT-botnet approach [17]: The IoT botnet technique sets
the authentication request limit and heartbeat message is
transferred every 40 s. A device is blocked if it exceeds the
request limit (set for that device) and denied any further
communication.
4) DDoS-collaborative approach [46]: The DDoS-
collaborative technique uses the Ethereum blockchain
and creates a smart contract. A list of IoT devices’ IP
addresses is prepared and shared using the blockchain. In
case an attacker sends a request and the corresponding
IP address does not match with the available list of IP
addresses then the device is blocked and denied any
further communication.
5) Deep learning-based DDoS approach [45]: This technique
employs the machine-learning-based trained models to
approach. The addition of the signature (in the encrypted form) classify any incoming request as legitimate or not.
is depicted in Algorithm 3, line 1. A trusted device sends a
request to the server for communication purposes. Next, it C. Performance Parameters
encrypts the signature message to be sent to the server. After
receiving the encrypted signature at the server, it is decrypted The experimental evaluation of the proposed ML-DDoS ap-
(Algorithm 3, line 5). The decrypted message is matched with proach and the other state-of-the-art has been performed using
the stored signatures (Algorithm 3, lines 8–11). If the signature the following performance parameters.
is valid the device is labelled trusted and valid and is allowed 1) Throughput [18]: How much data per unit time can be
full communication (as per the assigned gas-limit). transferred using the ML-DDoS approach? We have cre-
ated a use case in Hyperledger Caliper2 , sent different
transactions, and measured the attained throughput ac-
VI. EXPERIMENTAL EVALUATION AND DISCUSSION cordingly.
This section describes the experimental setup including soft- 2) Latency [18]: The latency is the delay in the communica-
ware/hardware configurations, benchmark heuristics (employed tion in the network. Latency is the total amount of time in
for experimental evaluation), and topology used to evaluate the a network when data can be captured, processed, send, or
system throughput, latency, and resource usage. received at the destination IoT device or server. We employ
different transactions to perform the related operations and
A. Experimental Setup measure the involved latencies.
3) CPU utilization [10]: CPU utilization technique is the
A new simulation framework, the Hyperledger caliper [6], amount of work handled by the CPU as per its capacity.
[47] was chosen for the blockchain environment as a simulation The more the task is compute-intensive the more it will
platform. Hyperledger fully supports the Ethereum blockchain- utilize the CPU time. This aspect has also been measured
based platform. The smart contract of the Ethereum blockchain to see the compute intensity of the involved tasks in the
is linked with the Hyperledger caliper and the transactions are proposed and the other related techniques.
carried out to produce the results (reported in the next section).
In addition, platforms such as Truffle, Hyperledger Caliper, D. ML-DDoS Approach Evaluation Using Botnet-Based
Ganache, and Matamask can be used for implementation. Scenario
Table III details the employed simulation setup.
In this experiment, we have used the scenario where a po-
tential botnet is detected and the DDoS attack is mitigated ac-
B. Benchmark Heuristics cordingly. Considering these detection and mitigation processes
Following benchmark heuristics are employed for the com-
parison and evaluation. 2 [Online]. Available: https://www.hyperledger.org/use/caliper

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

HAYAT et al.: ML-DDoS: A BLOCKCHAIN-BASED MULTILEVEL DDOS MITIGATION MECHANISM 11

Fig. 7. Maximum latency for legitimate device and when a botnet is detected.
Fig. 8. Minimum latency for legitimate device and when a botnet is detected.

the related performance parameters have been gauged. The two

specific situations experimented on are the following: 1) when a
legitimate IoT device performs the involved transaction; and 2)
when a device has been compromised and activates and performs
the related transactions.
In the throughput analysis, it was observed that the device
whether it is legitimate or has been compromised as a bot reflects
a similar activity (just before launching the DDoS attack) in
terms of transaction processing or throughput. If the attack has
been launched the throughput related to transaction count in the
bot-based scenario increases drastically. However, our proposed
scheme ML-DDoS proactively detects the botnets (or the com-
promised devices); therefore, the DDoS scenario is avoided that Fig. 9. Average latency for legitimate device and when a botnet is detected.
resulting in normal throughput along with decreased latency
and CPU utilization (because the devices are being detected
promptly and then blacklisted). The other related experiments
considering the latency aspect have been presented below.
In Fig. 7, the latency data have been presented that was
calculated before the device was compromised and after it
became a bot (i.e., the scenario where the device became a
bot and subsequently handled or managed by our ML-DDoS
approach). In the employed scenario, we here set an example
interval equal to 5 s for each device (it may be different for each
device in a specific IoT environment considering per device
functionality and responsibility). For example, if an attacker
creates a bot in our network and sends additional messages
Fig. 10. Maximum CPU utilization for the legitimate device, when a botnet
to initiate a DoS attack. We counter this using the gas-limit is detected.
aspect (discussed in the methodology) to limit its transactions
and subsequently detect it as a bot and disengage it from the IoT
network. The latency effect in the IoT environment is visible Similarly, Fig. 9 shows the average calculated delay in the
in Fig. 7. As soon as the devices which are detected bot are network. The figure shows that the average measured latencies
disengaged from communicating with the server the other IoT increase, for example, in normal IoT operations compared to the
device (i.e., blacklisted) the latency also reduces (because of low other scenarios (i.e., presence of bots), which are subsequently
message density in the network). handled by the proposed ML-DDoS approach. The delay in-
Fig. 8 shows the minimum involved latencies when there creases when there are more devices and decreases when there
is a normal IoT working and when there are compromised are only a few (blacklisted and removed from the environment).
devices (i.e., bots) that are subsequently handled by the proposed In Figs. 10 and 11, maximum and average CPU utilization
ML-DDoS approach. The delay increases with more devices and results are shown, respectively. These figures depict the at-
decreases when there are few. As shown in Fig. 8, the minimum tained average and maximum CPU utilization when there is a
delay decreases in the scenario there are bots or compromised de- normal IoT working as compared to the scenario when there
vices. These results validate the fact that the proposed ML-DDoS are compromised devices (i.e., bots) which are subsequently
approach effectively counters the bot devices by blacklisting handled by the proposed ML-DDoS approach. In case of a
them and disengaging from the core IoT environment. device compromise-related attack, the CPU utilization (i.e.,

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

12 IEEE TRANSACTIONS ON ENGINEERING MANAGEMENT

Fig. 11. Average CPU utilization for legitimate device, when a botnet is Fig. 13. Comparison of latency minimum.
detected.

Fig. 14. Comparison of latency average.

Fig. 12. Comparison of throughput.

server compute time and the other device activities related to

the compute operations will decrease). These results show the
effective bot countering mechanism by the proposed ML-DDoS
approach that proactively detects the bots (or the compromised
devices) and blacklists those devices (disengages them from the
main IoT environment) resulting in lower overall transaction
processing at the server and other device levels.

E. Comparative Analysis of ML-DDoS Approach

This section presents the comparative result analysis of
the proposed ML-DDoS approach as compared to the other Fig. 15. Comparison of latency maximum.
state-of-the-art such as PUF [6], IoT-DDoS [9], IoT-botnet
[17], collaborative-DDoS [46], and deep learning-DDoS [45].
The abovementioned schemes have been compared with our pro- ML-DDoS approach results in more safer environment and legit-
posed approach using throughput, latency, and CPU utilization imate processing continues with a higher number of transactions
performance in the event of a bot-based scenario. (See Fig. 11, processing per unit time.
Fig. 12, Fig. 13, Fig. 14, and Fig. 15). Fig. 13 shows the results related to the attained latencies
Fig. 12 shows the results in terms of throughput achieved for our proposed approach and the other related schemes af-
in our proposed approach and the other related schemes when ter the attacker creates bots and certain the DDoS mitigation
the attacker compromises a device or creates bots within the approaches come to the action. These results have been tested
IoT environment. The transaction initiation granularity (per for different transaction initiation granularity (per unit time) i.e.,
unit time) employed in this experiment is 2, 4, 8, 12, 16, 2, 4, 8, 12, 16, 20, and 24. The results depicted in Fig. 13 shows
20, and 24. The results depicted in Fig. 12 shows that our that our scheme results in more effective to disengage the bot
scheme results in higher overall throughput i.e., 15%, 24%, 21%, devices (both at server and device levels) resulting in filtration
37%, 40%, 40%, and 41% better as compared to the PUF [6], of DDoS traffic from the network. The results show that our
IoT-DDoS [9], IoT-botnet [17], collaborative-DDoS [46], and proposed approach results in 45%, 51%, 36%, 23%, 19%, 22%,
deep learning-DDoS [45] approaches. The network protected by and 22% lower minimum latency as compared to the PUF [6],

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

HAYAT et al.: ML-DDoS: A BLOCKCHAIN-BASED MULTILEVEL DDOS MITIGATION MECHANISM 13

TABLE IV and minimal usage of CPU compared to other state-of-the-art

COMPARATIVE ANALYSIS OF ML-DDOS APPROACH WITH OTHER
STATE-OF-THE-ART APPROACHES
approaches.

VII. CONCLUSION
Due to the increasing use of the and the ease of imple-
menting IoT networks, these networks are expanding every
day. Therefore, security was considered a necessity to ensure
safe and secure communication between devices. To overcome
such challenges, we had presented a ML-DDoS to protect IoT
IoT-DDoS [9], IoT-botnet [17], collaborative- DDoS [46], and devices and other computing resources or machines using the
deep learning-DDoS [45] approaches. blockchain-based framework. The core concept of the proposed
Fig. 15 shows the results related to the attained maximum la- scheme was to use a device-based verification mechanism using
tencies for our proposed approach and the other related schemes blockchain and separate the malicious devices (i.e., bots) from
after the attackers create bots and certain the DDoS mitigation IoT environments. The proposed framework was developed
approaches take action. The results depicted in Fig. 15 show using Hyperledger Caliper (a blockchain benchmarking tool)
that our scheme results are more effective to disengage the bot and its performance was evaluated using three benchmark appli-
devices (both at server and device levels) resulting in filtration cations. The presented ML-DDoS approach used the Ethereum
of DDoS traffic from the network. The results show that our blockchain with the smart contract to replace the centralized
proposed approach results in 44%, 47%, 35%, 26%, 16%, 17%, architecture with a decentralized architecture. If the device was
and 27% lower maximum-latency as compared to the PUF [6], registered in our network, the administrator could verify the
IoT-DDoS [9], IoT-botnet [17], collaborative- DDoS [46], and authenticity of the interacting devices (i.e., each device had a
deep learning-DDoS [45] approaches. unique ID, which was also verifiable). All the tempered and
compromised IoT devices are either excluded from the registry
or proactively detected by the ML-DDoS framework. We had
F. Results Analysis analyzed the performance of ML-DDoS framework compared
The proposed ML-DDoS was developed to mitigate DDoS to the state-of-the-art approaches that showed effective results
attacks both on-device and on server. The core concept em- in disabling the compromised device, resulting in low network
ployed by the proposed scheme is to use a device-ids-related latency, high throughput (of the legitimate devices), etc.
verification mechanism using blockchain and disengage the For future work, it is possible to further reduce power con-
malicious devices from the IoT environment at the earliest. We sumption and cyberattacks on IoT devices. In addition, we will
have assigned the unique id to devices and set the gas limit consider other types of attacks such as internal and external
of every device. We have set the gas limit of every device attacks by dynamically adjusting the nodes to overcome the
dynamically if the gas of the devices gets low then the admin security issues and improve the security and flexibility of our
can renew the gas of those devices. For a fixed time interval model.
(e.g., 5 s for our simulations) the IoT devices send transactions.
If the attacker creates a bot in the IoT network and the attacker REFERENCES
tries to send more transactions within the allocated time. In that
[1] J. C. W. Lin, G. Srivastava, Y. Zhang, Y. Djenouri, and M. Aloqaily,
case, the proposed ML-DDoS approach blocks the compromised “Privacy-preserving multiobjective sanitization model in 6G IoT environ-
devices and proactively disengages those devices from the IoT ments,” IEEE Internet Things, vol. 8, pp. 5340–5349, Apr. 2021.
network. The experimental evaluation shows that the latency [2] C. F. Cheng, Y. C. Chen, and J. C. W. Lin, “A carrier-based sensor
deployment algorithm for perception layer in the IoT architecture,” IEEE
( minimum, average, and maximum) reduces drastically once the Sensors, vol. 20, no. 17, pp. 10295–10305, Sep. 2020.
devices have been compromised and the proposed ML-DDoS [3] J. H. Syu, M. E. Wu, G. Srivastava, C. F. Chao, and J. C. W. Lin, “An
approach takes control related to the mitigation steps. The core IoT-based hedge system for solar power generation,” IEEE Internet Things,
vol. 8, no. 13, pp. 10347–10355, Jul. 2021.
mechanism that results in proactive engagement and isolation [4] Q. Yan, W. Huang, X. Luo, Q. Gong, and F. R. Yu, “A multi-level
of the compromised devices or bots is related to the gas-limit DDoS mitigation framework for the industrial Internet of Things,” IEEE
aspect that helps limit the transactions and subsequently helps Commun. Mag., vol. 56, no. 2, pp. 30–36, Feb. 2018.
[5] R. Akkaoui, “Blockchain for the management of Internet of Things devices
to disengage the bot device from the IoT network. The latency in the medical industry,” IEEE Trans. Eng. Manage., to be published.
effect in the IoT environment is visible to all of the latency- doi: 10.1109/TEM.2021.3097117.
related results. As soon as the devices which are detected bot [6] D. M. Mendez Mena and B. Yang, “Blockchain-based whitelisting for
consumer IoT devices and home networks,” in Proc. Annu. SIG Conf. Inf.
are disengaged from communicating with the server the other Technol. Educ., 2018, pp. 7–12.
IoT device (i.e., blacklisted) the latency also reduces (because [7] L.-Y. Yeh, P. J. Lu, S.-H. Huang, and J.-L. Huang, “Sochain: A
of low message density in the network). Table IV shows the privacy-preserving DDoS data exchange service over SOC consortium
blockchain,” IEEE Trans. Eng. Manage., vol. 67, no. 4, pp. 1487–1500,
overall comparison of the ML-DDoS approach with other state- Nov. 2020.
of-the-art approaches, which clearly shows that our proposed [8] R. Millman, “OVH suffers 1.1 Tbps DDoS attack,” News, SC Magazine
approach achieves maximum throughput with minimum latency UK, 2016.

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.
 This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

14 IEEE TRANSACTIONS ON ENGINEERING MANAGEMENT

[9] U. Javaid, A. K. Siang, M. N. Aman, and B. Sikdar, “Mitigating IoT device [28] M. Daniel and O. Benedict, “Blockchain mechanisms for IoT security,”
based DDoS attacks using blockchain,” in Proc. Workshop Cryptocurren- Internet Things, vol. 1/2, pp. 1–13, 2018.
cies Blockchains Distrib. Syst., 2018, pp. 71–76. [29] J. C. Davis and D. Brittany, “Vulnerability studies and security postures
[10] L. Zhou, H. Guo, and G. Deng, “A fog computing based approach to DDoS of IoT devices: A smart home case study,” IEEE Internet Things, vol. 7,
mitigation in IIoT systems,” Comput. Secur., vol. 85, pp. 51–62, 2019. no. 10, pp. 10102–10110, Oct. 2020.
[11] R. Vishwakarma and A. K. Jain, “A survey of DDoS attacking techniques [30] “Iot trend watch—IHS markit,” (2018). Accessed Nov. 1, 2021. [Online].
and defence mechanisms in the IoT network,” Telecommun. Syst., vol. 73, Available: https://cdn.ihs.com/www/pdf/iot-trend-watch-ebook.pdf
no. 1, pp. 3–25, 2020. [31] P. Cui and U. Guin, “Countering botnet of things using blockchain-
[12] U. Khalid, M. Asim, T. Baker, P. C. K. Hung, M. A. Tariq, and L. based authenticity framework,” in Proc. IEEE Comput. Soc. Annu. Symp.
Rafferty, “A decentralized lightweight blockchain-based authentication VLSI, 2019, pp. 598–603.
mechanism for IoT systems,” Cluster Comput., vol. 23, pp. 2067–2087, [32] S. Hameed and H. A. Khan, “SDN based collaborative scheme for miti-
2020. gation of DDoS attacks,” Future Internet, vol. 10, no. 3, 2018, Art. no. 23.
[13] K. Bhardwaj, J. C. Miranda, and A. Gavrilovska, “Towards IoT-DDOS [33] G. Liu, W. Quan, N. Cheng, H. Zhang, and S. Yu, “Efficient DDoS attacks
prevention using edge computing,” in Proc. USENIX Workshop Hot Topics mitigation for stateful forwarding in Internet of Things,” J. Netw. Comput.
Edge Comput., pp. 1–7, 2018. Appl., vol. 130, pp. 1–13, 2019.
[14] B. Cusack, Z. Tian, and A. K. Kyaw, “Identifying DoS and DDoS attack [34] M. E. Ahmed and H. Kim, “DDoS attack mitigation in Internet of Things
origin: IP traceback methods comparison and evaluation for IoT,” in Proc. using software defined networking,” in Proc. IEEE Int. Conf. Big Data
Interoperability, Saf. Secur. Internet Things, 2016, pp. 127–138. Comput. Service Appl., 2017, pp. 271–276.
[15] C. D. McDermott, F. Majdani, and A. V. Petrovski, “Botnet detection in [35] V. VM, “ProSD-edgeIoT: Protected cluster assisted SDWSN for tetrad
the Internet of Things using deep learning approaches,” Proc. Int. Joint edge-IoT by collaborative DDoS detection and mitigation,” Cyber-
Conf. Neural Netw., vol. 1, pp. 1–8, 2019. Physical Syst., vol. 1, pp. 1–30, 2021.
[16] S. S. Bhunia and M. Gurusamy, “Dynamic attack detection and mitigation [36] Y.-W. Chen, J.-P. Sheu, Y.-C. Kuo, and N. VanCuong, “Design and im-
in IoT using SDN,” in Proc. Int. Telecommun. Netw. Appl. Conf., 2017, plementation of IoT DDoS attacks detection system based on machine
pp. 1–6. learning,” in Proc. Eur. Conf. Netw. Commun., 2020, pp. 122–127.
[17] Z. Ahmed, S. M. Danish, H. K. Qureshi, and M. Lestas, “Protecting IoTs [37] U. Bodkhe et al., “Blockchain for industry 4.0: A comprehensive review,”
from Mirai botnet attacks using blockchains,” in Proc. IEEE Int. Workshop IEEE Access, vol. 8, pp. 79764–79800, 2020.
Comput. Aided Model. Des. Commun. Links Netw., 2019, pp. 1–6. [38] Q. Zhou, H. Huang, Z. Zheng, and J. Bian, “Solutions to scalability of
[18] R. Doshi, N. Apthorpe, and N. Feamster, “Machine learning DDoS de- blockchain: A survey,” IEEE Access, vol. 8, pp. 16440–16455, 2020.
tection for consumer Internet of Things devices,” in Proc. IEEE Secur. [39] M. A. Ferrag and L. Maglaras, “Deepcoin: A novel deep learning and
Privacy Workshops, 2018, pp. 29–35. blockchain-based energy exchange framework for smart grids,” IEEE
[19] S. Singh, I.-H. Ra, W. Meng, M. Kaur, and G. H. Cho, “SH-blockCC: A Trans. Eng. Manage., vol. 67, no. 4, pp. 1285–1297, Nov. 2019.
secure and efficient Internet of Things smart home architecture based on [40] A. B. Qaisar Shafi, “DDos botnet prevention using blockchain in software
cloud computing and blockchain technology,” Int. J. Distrib. Sensor Netw., defined Internet of Things,” in Proc. Int. Bhurban Conf. Appl. Sci. Technol.,
vol. 15, no. 4, pp. 1–18, 2019. 2019, pp. 624–628.
[20] K. Bhushan and B. B. Gupta, “Distributed denial of service (DDoS) attack [41] B. K. Mohanta, D. Jena, S. Ramasubbareddy, M. Daneshmand, and
mitigation in software defined network (SDN)-based cloud computing A. H. Gandomi, “Addressing security and privacy issues of IoT us-
environment,” J. Ambient Intell. Humanized Comput., vol. 10, no. 5, ing blockchain technology,” IEEE Internet Things J., vol. 8, no. 2,
pp. 1985–1997, 2019. pp. 881–888, Jan. 2021.
[21] T. T. A. Dinh, R. Liu, M. Zhang, G. Chen, B. C. Ooi, and J. Wang, [42] A. Gaurav, B. B. Gupta, and P. K. Panigrahi, “A novel approach for DDoS
“Untangling blockchain: A data processing view of blockchain sys- attacks detection in COVID-19 scenario for small entrepreneurs,” Technol.
tems,” IEEE Trans. Knowl. Data Eng., vol. 30, no. 7, pp. 1366–1385, Forecasting Social Change, vol. 177, 2022, Art. no. 121554.
Jul. 2018. [43] S. Kautish, A. Reyana, and A. Vidyarthi, “SDMTA: Attack de-
[22] F. Loi, A. Sivanathan, H. Habibi Gharakheili, A. Radford, and V. tection and mitigation mechanism for DDoS vulnerabilities in hy-
Sivaraman, “Systematically evaluating security and privacy for consumer brid cloud environment,” IEEE Trans. Ind. Inform., to be published.
IoT devices,” in Proc. Workshop Internet Things Secur. Privacy, 2018, doi: 10.1109/TII.2022.3146290.
pp. 1–6. [44] R. Doriguzzi-Corin, S. Millar, S. Scott-Hayward, J. Martinez-del Rincon,
[23] A. K. Simpson, F. Roesner, and T. Kohno, “Securing vulnerable home and D. Siracusa, “Lucid: A practical, lightweight deep learning solution
IoT devices with an in-hub security manager,” in Proc. IEEE Int. Conf. for DDoS attack detection,” IEEE Trans. Netw. Service Manage., vol. 17,
Pervasive Comput. Commun. Workshops, 2017, pp. 551–556. no. 2, pp. 876–889, Jun. 2020.
[24] S. Nandan Mohanty et al., “An efficient lightweight integrated blockchain [45] M. Essaid, D. Kim, S. H. Maeng, S. Park, and H. T. Ju, “A collaborative
(ELIB) model for IoT security and privacy,” Future Gener. Comput. Syst., DDoS mitigation solution based on ethereum smart contract and RNN-
vol. 102, pp. 1027–1037, 2020. LSTM,” in Proc. Asia-Pacific Netw. Operations Manage. Symp., 2019,
[25] K. Ali and S. Askar, “Security issues and vulnerability of IoT devices,” pp. 1–6.
Int. J. Sci. Bus., vol. 5, no. 3, pp. 101–115, 2021. [46] B. Rodrigues, T. Bocek, A. Lareida, D. Hausheer, S. Rafati, and B. Stiller,
[26] F. Meneghello, M. Calore, D. Zucchetto, M. Polese, and A. Zanella, “A blockchain-based architecture for collaborative DDoS mitigation with
“Iot: Internet of threats? A survey of practical security vulnerabilities in smart contracts,” in Proc. IFIP Int. Conf. Auton. Infrastruct., Manage.
real IoT devices,” IEEE Internet Things, vol. 6, no. 5, pp. 8182–8201, Secur., 2017, pp. 16–29.
Oct. 2019. [47] S. Tanwar, K. Parekh, and R. Evans, “Blockchain-based electronic health-
[27] J. Wurm and Y. Jin, “Security analysis on consumer and industrial IoT care record system for healthcare 4.0 applications,” J. Inf. Secur. Appl.,
devices,” in Proc. Asia and South Pacific Des. Autom. Conf., 2016, vol. 50, 2020, Art. no. 102407.
pp. 519–524.

Authorized licensed use limited to: Sri Sai Ram Engineering College. Downloaded on March 24,2023 at 10:31:19 UTC from IEEE Xplore. Restrictions apply.