DDoSViT: IoT DDoS attack detection for fortifying firmware Over-The-Air (OTA) updates using vision transformer

Abstract

The widespread adoption of Internet of Things (IoT) devices has introduced numerous vulnerabilities, particularly in firmware over-the-air (OTA) updates. These updates are essential for improving device functionality and addressing security vulnerabilities. However, they have increasingly become the focus of distributed denial of service (DDoS) attacks designed to disrupt the update process. Historically, the infamous Mirai botnet and its variants have exploited IoT vulnerabilities to carry out successful DDoS attacks. In recent years, deep learning models, especially Vision Transformers, have gained significant attention due to their exceptional performance in image classification tasks. To optimize detection and alert mechanisms, this novel study proposes a DDoSViT framework. This Vision Transformer (ViT)-based multi-vector DDoS and DoS attack detection framework converts attack flows into images and trains Vision Transformers on an attack image dataset. To validate the proposed framework, this study extensively reviewed diverse datasets and selected CICIoT2023 and CICIoMT2024 datasets ensuring these contain real-world attack scenarios and multi-vector real attacks. The proposed methodology and rigorous experimentation demonstrated 99.50% accuracy in multi-class classification across 23 different variants of DDoS and DoS attacks, outperforming contemporary models. The model’s performance was assessed using metrics such as accuracy, precision, recall, and F1-score. This research provides significant benefits to security practitioners and administrators, offering reduced false positives and reliable alerts during firmware over-the-air updates in IoT-edge devices.