A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

Abstract

Software-defined networking (SDN) is a revolutionary innovation in network technology with many desirable features, including flexibility and manageability. Despite those advantages, SDN is vulnerable to distributed denial of service (DDoS), which constitutes a significant threat due to its impact on the SDN network. Despite many security approaches to detect DDoS attacks, it remains an open research challenge. Therefore, this study presents a systematic literature review (SLR) to systematically investigate and critically analyze the existing DDoS attack approaches based on machine learning (ML), deep learning (DL), or hybrid approaches published between 2014 and 2022. We followed a predefined SLR protocol in two stages on eight online databases to comprehensively cover relevant studies. The two stages involve automatic and manual searching, resulting in 70 studies being identified as definitive primary studies. The trend indicates that the number of studies on SDN DDoS attacks has increased dramatically in the last few years. The analysis showed that the existing detection approaches primarily utilize ensemble, hybrid, and single ML-DL. Private synthetic datasets, followed by unrealistic datasets, are the most frequently used to evaluate those approaches. In addition, the review argues that the limited literature studies demand additional focus on resolving the remaining challenges and open issues stated in this SLR.

HLD-DDoSDN: High and low-rates dataset-based DDoS attacks against SDN

“…However, they did not meet the objectives of this research. Some of these datasets (i.e., CICIDS2018 [ 18 ] and ISCX2012 [ 19 ]) are generated for conventional networks and do not reflect the SDN network architecture, which is entirely different from traditional networks [ 3 ].…”

“…The controller processes this message and returns a response using the Packet_Out message to update the flow table switches. Attackers can exploit this forwarding process to flood the network with spoofed packets that exhaust the SDN controller resources and cause degradation of its performance [ 3 ]. Therefore, the HLD-DDoSDN dataset focuses on the most relevant DDoS flooding attacks in the SDN context.…”

“…Consequently, the network infrastructure must be equipped with an efficient IDS to detect DDoS in the SDN network. Despite the existing IDSs, the research challenge of developing an effective anomaly-based IDS for the SDN environment remains open [ 3 ]. One of these challenges is that the publicly available datasets are generated for conventional networks and do not reflect an SDN network’s characteristics, even though the publicly available realistic SDN datasets are limited to standard or conventional DDoS attacks (i.e., high-rate attacks), which are relatively easy to detect due to the large volume of malicious traffic.…”

Deep Learning-Based Approach for Detecting DDoS Attack on Software-Defined Networking Controller

“…In most cases, the SDN controller serves as a reflection and model of the SDN framework. Communication with switches is facilitated through southbound application APIs, such as OpenFlow, while SDN applications such as load balancers and firewalls rely on northbound APIs [14].…”

“…However, traditionally, signaturebased IDS struggle to keep up with the evolving nature of DDoS attacks, as attackers continuously employ new strategies. To address this challenge, DL has gained prominence in the field of IDS [14].…”