DDoS Attack Early Detection and Mitigation System on SDN using Random Forest Algorithm and Ryu Framework

Nurwarsito, Heru; Nadhif, Muhammad Fahmy

doi:10.1109/iccce50029.2021.9467167

Cited by 16 publications

(5 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Several approaches employ a single ML algorithm to detect and mitigate DDoS attacks, such as [84]. The proposed approach uses an RF to classify normal and abnormal traffic based on the flow of entries.…”

Section: Single ML Approachesmentioning

confidence: 99%

“…However, some studies did not use them, such as [66,91]. At the same time, most studies ran their approaches on the SDN controller, adding unnecessary overhead to the controller, such as [70,76,[82][83][84].…”

Section: Single ML Approachesmentioning

confidence: 99%

“…Typically, the SDN architecture experience overload while detecting and mitigating SDN DDoS attacks; therefore, an efficient approach must be implemented outside the SDN controller to address these challenges and reduce the controller's overhead. If implemented this way, the proposed approach for detecting and mitigating SDN DDoS attacks must cooperate with the controller and the data plane switches.•Prevention approach for DDoS attacks: This SLR demonstrated that most literature studies, such as[59,66,70,[74][75][76][77]81,84,90,92,95,106,109,[112][113][114]118,126] focus on detection and mitigation instead of prevention of SDN DDoS attacks. There is a lack of approaches concerning prevention besides the detection and mitigation approaches.…”

mentioning

confidence: 99%

See 2 more Smart Citations

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

Bahashwan

Anbar

Manickam

et al. 2023

Sensors

View full text Add to dashboard Cite

Software-defined networking (SDN) is a revolutionary innovation in network technology with many desirable features, including flexibility and manageability. Despite those advantages, SDN is vulnerable to distributed denial of service (DDoS), which constitutes a significant threat due to its impact on the SDN network. Despite many security approaches to detect DDoS attacks, it remains an open research challenge. Therefore, this study presents a systematic literature review (SLR) to systematically investigate and critically analyze the existing DDoS attack approaches based on machine learning (ML), deep learning (DL), or hybrid approaches published between 2014 and 2022. We followed a predefined SLR protocol in two stages on eight online databases to comprehensively cover relevant studies. The two stages involve automatic and manual searching, resulting in 70 studies being identified as definitive primary studies. The trend indicates that the number of studies on SDN DDoS attacks has increased dramatically in the last few years. The analysis showed that the existing detection approaches primarily utilize ensemble, hybrid, and single ML-DL. Private synthetic datasets, followed by unrealistic datasets, are the most frequently used to evaluate those approaches. In addition, the review argues that the limited literature studies demand additional focus on resolving the remaining challenges and open issues stated in this SLR.

show abstract

Section: Single ML Approachesmentioning

confidence: 99%

Section: Single ML Approachesmentioning

confidence: 99%

mentioning

confidence: 99%

See 1 more Smart Citation

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

Bahashwan

Anbar

Manickam

et al. 2023

Sensors

View full text Add to dashboard Cite

show abstract

“…An entropy with a deep learning algorithm is presented in [8], which measures the entropy value on the traffic features and, based on the value, the classification is performed. A Joint Entropybased Security Scheme (JEES) is presented in [9], which estimates the joint entropy in detecting DDoS attacks.…”

Section: Related Workmentioning

confidence: 99%

RMCARTAM For DDoS Attack Mitigation in SDN Using Machine Learning

Revathi¹,

Ramalingam²,

Amutha³

2023

Computer Systems Science and Engineering

View full text Add to dashboard Cite

The impact of a Distributed Denial of Service (DDoS) attack on Software Defined Networks (SDN) is briefly analyzed. Many approaches to detecting DDoS attacks exist, varying on the feature being considered and the method used. Still, the methods have a deficiency in the performance of detecting DDoS attacks and mitigating them. To improve the performance of SDN, an efficient Real-time Multi-Constrained Adaptive Replication and Traffic Approximation Model (RMCARTAM) is sketched in this article. The RMCARTAM considers different parameters or constraints in running different controllers responsible for handling incoming packets. The model is designed with multiple controllers to handle network traffic but can turn the controllers according to requirements. The multi-constraint adaptive replication model monitors different features of network traffic like rate of packet reception, class-based packet reception and target-specific reception. According to these features, the method estimates the Replication Turning Weight (RTW) based on which triggering controllers are performed. Similarly, the method applies Traffic Approximation (TA) in the detection of DDoS attacks. The detection of a DDoS attack is performed by approximating the incoming traffic to any service and using various features like hop count, payload, service frequency, and malformed frequency to compute various support measures on bandwidth access, data support, frequency support, malformed support, route support, and so on. Using all these support measures, the method computes the value of legitimate weight to conclude the behavior of any source in identifying the malicious node. Identified node details are used in the mitigation of DDoS attacks. The method stimulates the network performance by reducing the power factor by switching the controller according to different factors, which also reduces the cost. In the same way, the proposed model improves the accuracy of detecting DDoS attacks by estimating the features of incoming traffic in different corners.

show abstract

“…Experimental results showed that their hybrid ML model provided better accuracy, a higher detection rate, and a lower false alarm rate compared to simple ML models. On the other hand, Nurwarsito et al [37] investigated a DDoS attack detection and mitigation system constructed based on SDN architecture using an RF ML algorithm. The RF algorithm classified normal and attack packets based on their associated flow entries.…”

Section: Related Workmentioning

confidence: 99%

Using Machine Learning and Software-Defined Networking to Detect and Mitigate DDoS Attacks in Fiber-Optic Networks

2022

View full text Add to dashboard Cite

Fiber optic networks (FONs) are considered the backbone of telecom companies worldwide. However, the network elements of FONs are scattered over a wide area and managed through a centralized controller based on intelligent devices and the internet of things (IoT), with actuators used to perform specific tasks at remote locations. During the COVID-19 pandemic, many telecom companies advised their employees to manage the network using the public internet (e.g., working from home while connected to an IoT network). Theses IoT devices mostly have weak security algorithms that are easily taken-over by hackers, and therefore can generate Distributed Denial of Service (DDoS) attacks in FONs. A DDoS attack is one of the most severe cyberattack types, and can negatively affect the stability and quality of managing networks. Nowadays, software-defined networks (SDN) constitute a new approach that simplifies how the network can be managed through a centralized controller. Moreover, machine learning algorithms allow the detection of incoming malicious traffic with high accuracy. Therefore, combining SDN and ML approaches can lead to detecting and stopping DDoS attacks quickly and efficiently, especially compared to traditional methods. In this paper, we evaluated six ML models: Logistic Regression, K-Nearest Neighbor, Support Vector Machine, Naive Bayes, Decision Tree, and Random Forest. The accuracy reached 100% while detecting DDoS attacks in FON with two approaches: (1) using SVM with three features (SOS, SSIP, and RPF) and (2) using Random Forest with five features (SOS, SSIP, RPF, SDFP, and SDFB). The training time for the first approach was 14.3 s, whereas the second approach only requires 0.18 s; hence, the second approach was utilized for deployment.

show abstract

DDoS Attack Early Detection and Mitigation System on SDN using Random Forest Algorithm and Ryu Framework

Cited by 16 publications

References 9 publications

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

RMCARTAM For DDoS Attack Mitigation in SDN Using Machine Learning

Using Machine Learning and Software-Defined Networking to Detect and Mitigate DDoS Attacks in Fiber-Optic Networks

Contact Info

Product

Resources

About