A comprehensive and effective mechanism for DDoS detection in SDN

Conti, Mauro; Gangwal, Ankit; Gaur, Manoj Singh

doi:10.1109/wimob.2017.8115796

Cited by 29 publications

(15 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Most of the existing datasets used for network anomaly detection consist of IP-based traffic such as DARPA98 [40] KDD99, NSL-KDD. Since 1998, there are almost eleven IP-based datasets that are refined with time series data for IDS evaluation.…”

Section: A Dataset Descriptionmentioning

confidence: 99%

A Deep CNN Ensemble Framework for Efficient DDoS Attack Detection in Software Defined Networks

et al. 2020

View full text Add to dashboard Cite

As novel technologies continue to reshape the digital era, cyberattacks are also increasingly becoming more commonplace and sophisticated. Distributed denial of service (DDoS) attacks are, perhaps, the most prevalent and exponentially-growing attack, targeting the varied and emerging computational network infrastructures across the globe. This necessitates the design of an efficient and early detection of large-scale sophisticated DDoS attacks. Software defined networks (SDN) point to a promising solution, as a network paradigm which decouples the centralized control intelligence from the forwarding logic. In this work, a deep convolutional neural network (CNN) ensemble framework for efficient DDoS attack detection in SDNs is proposed. The proposed framework is evaluated on a current state-of-the-art Flow-based dataset under established benchmarks. Improved accuracy is demonstrated against existing related detection approaches. INDEX TERMS Software defined network (SDN), anomaly detection, distributed denial of service (DDoS), deep learning, deep convolutional neural network (CNN).

show abstract

Section: A Dataset Descriptionmentioning

confidence: 99%

A Deep CNN Ensemble Framework for Efficient DDoS Attack Detection in Software Defined Networks

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Siris, et al [2] investigated statistical anomaly detection algorithms for detecting SYN flooding attack with the dynamic threshold on the traditional network. Conti, et al [1] proposed a comprehensive and effective mechanism for DDoS detection in SDN with the CuSum with adaptive threshold algorithm. Since their SDN controller used the commonly exchanged FLOW_STATS messages to obtain real-time traffic statistics, their system has a little overhead for exchanging messages.…”

Section: Related Workmentioning

confidence: 99%

“…SYN flooding attack is a common DoS attack that exploits the TCP's three-way handshake procedure to exhaust memory by maintaining half-open connections. It works at the transport layer of the TCP/IP model [1]. The attacker sends a very large number of SYN messages to a single victim server.…”

Section: Introductionmentioning

confidence: 99%

“…A large number of flows sending by SYN flooding attack might overflow the storage space or OpenFlow table in OpenFlow switches in data forwarding layer. In addition, the attack might break not only the controller at the control layer but also the link between the control layer and data layer [1]. Even if the flooding attack is launched in a few seconds, the entire network can be breached or stopped.…”

Section: Introductionmentioning

confidence: 99%

“…As a result, it may produce a vast amount of false alarms. In contrast, the dynamic threshold can adapt to the trend of traffic and thus, reduce false alarm rate [1] [2]. The dynamic threshold can be calculated by using one of the two statistical anoma ly detection algorithms: adaptive threshold algorithm and cumulative sum (CUSUM) algorithm.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

SYN Flooding Attack Detection and Mitigation in SDN

2019

Proceedings of 2019 the 9th International Workshop on Computer Science and Engineering

View full text Add to dashboard Cite

Software-defined networking separates network architecture into logical control layer and data forwarding layer with the aim of providing high flexibility, agility, and security. Although it manages the whole network fro m the controller with the ease of programmab ility, many security issues still exist in SDN architecture. Attacker's target can be at the various layers of SDN by DDoS attack. Defin ing threshold in detection and mitigation of the attack is one of the most important issues. Existing researches emphasize the detection of DDoS attack with various mechanis ms in SDN infrastructure. This paper p rovides a simple mechanis m for both detection and mitigation of co mmon type of DDoS attack, SYN flooding attack via sFlow analyzer with dynamic threshold calculated by using adaptive threshold algorithm. It uses own generated network traffic consisting both normal and attack traffic and shows that how the calculated dynamic threshold adapts the inco ming t raffic. It also evaluates the performance of the detection and mitigation mechanis m by detection rate, false alarm rate, false negative rate, and accuracy in order to prove our proposed system can timely detect and reasonably mitigate DDoS attack.

show abstract

Software‐defined networking security for private data center networks and clouds: Vulnerabilities, attacks, countermeasures, and solutions

Abdelrahman

Rodrigues

Mahmoud

et al. 2020

Int J Communication

View full text Add to dashboard Cite

Software-defined networking (SDN) is an agile, modern networking approach that facilitates innovations in the networking paradigm. The abstracted and centralized network operating system facilitates the network management and reduces operational expenditure (OPEX). The open nature and simplicity of the data-forwarding plane dramatically reduces capital expenditure (CAPEX) by leveraging commodity servers and switches. SDN also lends itself very well to address major cloud computing issues and complement cloud services, especially in terms of network virtualization and networking as a service (NaaS).As a new technology, SDN does involve certain security challenges, which include distributed denial of service (DDoS) threats, build and run time injected malware, insider (tenant) attacks, and security holes resulting from controller misconfigurations. These are severe threats that can cripple an entire network. It is crucial to address the SDN vulnerabilities to ensure its successful deployment in private data center networks, on cloud platforms and beyond. Some security solutions leverage the built-in features of SDN, such as its controller software component, while other solutions provide external SDN applications running above the controller. This study reviews the security solutions for the vulnerabilities of state-of-the-art SDN controllers and the available countermeasures. Furthermore, an in-depth analysis of the SDN features that support security is presented, and some unresolved research issues on SDN controllers are identified.

show abstract

A comprehensive and effective mechanism for DDoS detection in SDN

Cited by 29 publications

References 26 publications

A Deep CNN Ensemble Framework for Efficient DDoS Attack Detection in Software Defined Networks

A Deep CNN Ensemble Framework for Efficient DDoS Attack Detection in Software Defined Networks

SYN Flooding Attack Detection and Mitigation in SDN

Software‐defined networking security for private data center networks and clouds: Vulnerabilities, attacks, countermeasures, and solutions

Contact Info

Product

Resources

About