# Deep-Learning-Based Approach to Detect ICMPv6 Flooding DDoS Attacks on IPv6 Networks
## 1 Introduction  
The Internet Engineering Task Force predicted as early as the 1980s that the IPv4 address pool would be exhausted within the next few decades. However, their predictions came earlier than expected after the unpredictable exponential growth of emerging technologies such as mobile devices, the Internet of Things (IoT), and cloud computing services. Therefore, the next-generation IPv6 protocol was engineered to overcome the shortcomings of IPv4 [1]. The shift from IPv4 occurred slowly, but with millions of intelligent internet-facing devices entering the market daily, the need for the new Internet protocol also increased [2]. As a result, there is a need for a faster transition to the IPv6 protocol. Additionally, IPv6 has introduced better security features than IPv4 [3], making the optional IPv4 security protocol known as IPsec mandatory. However, recent changes may also present new challenges due to unknown vulnerabilities or inherited ones [4]. Moreover, IPv6 introduced Internet Control Message Protocol version 6 (ICMPv6), one of the essential protocols in IPv6. IPv6 cannot function without the ICMPv6 protocol's functionality since ICMPv6 messages perform many vital functions that enable data routing along network paths via nodes. However, the ICMPv6 messages lack authentication by default, making them vulnerable to exploitation. Furthermore, the IPv6 node does not validate ICMPv6 messages because it considers them legitimate. Thus, each node is susceptible to fake ICMPv6 messages and is vulnerable to ICMPv6 flooding DDoS attacks [5]. In an ICMPv6 flooding DDoS attack, adversaries deliberately make the victim'sserver unavailable to users by sending myriad fake messages, which exhaust the server's resources (i.e., CPU and RAM), making it unresponsive to legitimate user requests. Recently, many organizations have suffered from intruders' attacks. Nearly 60% of enterprises have been subjected to many attacks, such as social engineering, phishing, and DDoS attacks. Based on Juniper's investigation, small businesses account for 13% of cybercrime victims. Nowadays, not all attacks are motivated by monetary gain or data theft. Instead, some adversaries find satisfaction with just denying users from utilizing their desired service for as long as possible by using DDoS flooding attacks [6]. Therefore, attacks on network services should be prevented since any incidents would cause significant losses for both users and organizations. Even though security systems are constantly improved and updated regularly, attackers also pursue a similar strategy with their attack tools. As a result, security solutions such as intrusion detection systems (IDS) must be updated and improved continuously. There are two types of IDS: signature-based (SIDS) and anomaly-based (AIDS). AIDS is typically more efficient than a signature-based IDS because it depends on predefined signatures that make them ineffective in detecting novel attacks. Thus, there is a pressing need for more research effort on AIDS because it has shown better performance in detecting anomaly attacks. Meanwhile, machine-learning-based approaches are considered adequate for IDSs because they can automate the process and create an efficient detection system. In addition, more human effort is also spared [7]. Moreover, the machine learning (ML) approaches are remarkably efficient in this domain. At the same time, advancement in ML algorithms leads to a new subset called deep learning (DL) algorithms. DL is an advanced subgroup of ML algorithms since it mimics the functions of the human brain and consists of multiple neural layers. The human brain is a source of inspiration for deep network researchers, who use various techniques to train hierarchical network layers [8]. IPv6 is vulnerable to DDoS and DoS attacks as long as the ICMPv6 messages remain unsecured, which could result in degraded quality of service in the network connectivity.