Cross-Plane DDoS Attack Defense Architecture Based on Flow Table Features in SDN

Abstract

Software-Defined Networking (SDN) actualizes the separation of control and forwarding and innovates network functionalities with a logically centralized controller. Contemporary SDN infrastructure exposes the potential bottlenecks which are prone to engage in distributed denial of service attack (DDoS) thus posing an ever-increasing threat. This paper adopts the idea of “cross-plane collaboration” accomplishing DDoS attack defense and incorporates a two-phase project deploying the lightweight detection mechanism in data layer and the fine-grained filtering model in control layer. The coadjutant detection mechanism introduces a novel three-dimensional entropy consisting of five flow table features performing real-time feature detection; the defense strategy schedules an attack classification algorithm based on neural network by means of extracting four flow rule features designed to locate compromised interfaces occupied by malicious traffic. Extensive experiments are implemented to demonstrate the method we proposed brings excellent superiority. The detection rate of the classification filtering model is 99.4%, and it is real-time, with a detection time of 0.51s. In addition, the method of cross-layer defense reduces the CPU utilization of the controller.

Exploring Traffic Patterns Through Network Programmability: Introducing SDNFLow, a Comprehensive OpenFlow-Based Statistics Dataset for Attack Detection

“…This approach offers advantages such as precisely localizing anomalous traffic by leveraging the complete network visibility on the control plane. Additionally, it is worth noting that network scalability remains largely uncompromised, as the volume of information gathered exhibits a nearly linear relationship with the number of switches involved, given that solely the switch flow statistics are required [15].…”