MetaVSID: A Robust Meta-Reinforced Learning Approach for VSI-DDoS Detection on the Edge

The explosive growth of end devices that generate massive amounts of data requires close-proximity computing resources for processing at the network’s edge. Having geographic distributions and limited resources of edge nodes or servers opens several doors for attackers to exploit them primarily to the detriment of deployed services; one of the recent attacks is Very Short Intermittent Distributed Denial of Services (VSI-DDoS). Deep learning-based models have been developed to detect and mitigate such attacks but cause the degrading quality of models due to covariate shifts when deployed in real-world environments. Therefore, we propose a new approach, called MetaVSID, to detect VSI-DDoS attacks in edge clouds using meta-reinforcement learning followed by ensemble learning to increase the robustness of the model in detecting VSI-DDoS attacks early. The proposed model can capture dynamic patterns of VSI-DDoS attacks, from which it identifies manipulated services and increase service availability when covariate shifts at deployment time. We carry out extensive experiments to validate the MetaVSID using both testbed and benchmark datasets. Via the meta-reinforced downsampling process, the proposed method improves sample efficiency, leading to cost-effective policies. Moreover, the optimized policies are generalized to adapt to dynamic changes in the training distribution. Our experimental results demonstrate that MetaVSID stably achieves better performance in multiple evaluation settings with the difference from baseline models from 1.5% to 7.5% in terms of AUC for both VSI-DDoS and DDoS detection, especially under covariate shift settings.