Sentry: Uma Contramedida Adaptativa contra Ataques de Negação de Serviço de Baixo Volume

• Bruno M. dos Santos UFF
• Ian V. Bastos UERJ
• Igor M. Moraes UFF

DOI: https://doi.org/10.5753/sbseg.2026.26991

Resumo

Algoritmos estáticos de aprendizado de máquina tornam os sistemas de detecção de intrusão ineficazes em ambientes dinâmicos, uma vez que esses sistemas permanecem restritos aos padrões de dados observados durante a fase de treinamento. Este artigo propõe o Sentry, uma contramedida adaptativa baseada no algoritmo Online Isolation Forest, voltada à identificação de ataques de negação de serviço de baixo volume em redes definidas por software. O Sentry realiza atualizações contínuas e incorpora critérios seletivos condicionados ao estado da rede, evitando aprendizado inadequado durante períodos de ataque e reduzindo o risco de contaminação do modelo. A avaliação experimental demonstra que o Sentry supera tanto o Online Isolation Forest com atualizações irrestritas quanto o XGBoost. O Sentry atinge métricas de revocação e pontuação F1 de até 98,89% e 98,53%, respectivamente. Em contrapartida, o XGBoost e o Online Isolation Forest exibem uma queda acentuada no desempenho, com a revocação caindo para 17,95% e 10,50%, respectivamente.

Referências

Al-Shukaili, N. A., Kiah, M. L. M., and Ahmedy, I. (2025). Optimizing feature selection and deep learning techniques for precise detection of low-rate distributed denial of service (LDDoS) attack. Discover Internet of Things, 5(80).

Alashhab, A. A., Zahid, M. S. M., Alashhab, M., and Alashhab, S. (2023). Online machine learning approach to detect and mitigate low-rate ddos attacks in sdn-based networks. In 2023 IEEE International Conference on Artificial Intelligence in Engineering and Technology (IICAIET), pages 1–6, Kota Kinabalu, Malaysia. IEEE.

Camarda, S., Musumeci, F., and Torre, G. (2025). Managing concept drift in online intrusion detection systems. Joint National Conference on Cybersecurity.

Chen, T. and Guestrin, C. (2016). Xgboost: A scalable tree boosting system. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 785–794, New York, NY, USA. ACM.

dos Santos, B. M., Bastos, I. V., and Moraes, I. M. (2026). Degradação de desempenho de contramedidas estáticas a ataques de negação de serviço de baixo volume. In Anais do XLIV Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC), Brasil. Sociedade Brasileira de Computação (SBC).

Fu, Z., Li, M., Wu, Y., and Liu, Q. (2022). Low-rate denial of service attack detection method based on time-frequency characteristics. Journal of Cloud Computing, 11.

Gama, J., Žliobait schoole, I., Bifet, A., Pechenizkiy, M., and Bouchachia, A. (2014). A survey on concept drift adaptation. ACM Computing Surveys (CSUR), 46(4):1–37.

Knight, S., Nguyen, H. X., Falkner, N., Bowden, R., and Roughan, M. (2011). Internet topology zoo. IEEE Journal on Selected Areas in Communications, 29(9):1765–1775.

Leveni, F. and Boracchi, G. (2025). Online isolation forest. In Proceedings of the 41st International Conference on Machine Learning (ICML), volume 235 of Proceedings of Machine Learning Research, pages 26858–26876. PMLR.

Liu, B., Tang, D., Chen, J., and Liang, W. (2024). ERT-EDR: Online defense framework for TCP-targeted LDoS attacks in SDN. Expert Systems with Applications, 254:124356.

Ma, X., Li, X., He, Y., Qi, Q., and Li, H. (2025). BDTM: Bidirectional detection and traceability mitigation of LDoS attacks in SDN. IEEE Transactions on Network and Service Management, 20:6826 – 6839.

Mathew, R. R. and Vidhate, A. (2024). Adaptive dos attack detection in sdn. In Proceedings of the 2024 International Conference on Emerging Smart Computing and Informatics (ESCI). IEEE.

Montgomery, D. C. and Runger, G. C. (2018). Applied Statistics and Probability for Engineers. John Wiley & Sons, 7th edition.

Pandiyakumari S, H. and Suganya R, D. (2025). Adaptive detection of low-rate denial-of-service attacks: A machine learning and reinforcement learning perspective. In Proceedings of the 2025 6th International Conference on Communication, Computing & Industry 6.0 (C2I6). IEEE.

Pérez-Díaz, J. A., Valdovinos, I. A., Choo, K.-K. R., and Zhu, D. (2020). A flexible SDN-based architecture for identifying and mitigating low-rate DDoS attacks using machine learning. IEEE Access, 8:155859–155872.

Rios, V. M., Inácio, P. R. M., and Maimó, D. (2022). Detection and mitigation of low-rate denial-of-service attacks: A survey. IEEE Access, 10:76648–76668.

Rong, X., Wang, S., Guo, C., and Tao, X. (2024). Adaptive weight xgboost: Detecting and mitigating low-rate dos attack in network slicing. In Proceedings of the 2024 IEEE Wireless Communications and Networking Conference (WCNC). IEEE.

Shyaa, W., Gharaibeh, H., and Rawashdeh, M. (2024). Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynamics-aware machine learning and deep learning in intrusion detection systems. Engineering Applications of Artificial Intelligence.

Tang, D., Yan, Y., Zhang, S., Chen, J., and Qin, Z. (2022). Performance and features: Mitigating the low-rate TCP-targeted DoS attack via SDN. IEEE Journal on Selected Areas in Communications, 40:428 – 444.

Tang, D., Yan, Y., Zhang, S., Chen, J., and Qin, Z. (2025). Trident: A low-rate DoS attack mitigation scheme based on port and traffic state in SDN. IEEE Transactions on Computers, 74:1758–1770.

Wahab, O. A. (2022). Intrusion detection in the IoT under data and concept drifts: Online deep learning approach. IEEE Internet of Things Journal, 9(20):19706 – 19716.

Yoachimik, O. and Pacheco, J. (2026). 2025 q4 DDoS threat report: A record-setting 31.4 Tbps attack caps a year of massive DDoS assaults. Technical report, Cloudflare. Disponível em [link].