DDoS Detection in SDN using Machine Learning Techniques

Kumar, Sunil; Sastry, Hanumat G.; Marriboyina, Venkatadri; Alshazly, Hammam; Idris, Sahar Ahmed; Verma, Madhushi; Kaur, Manjit

doi:10.32604/cmc.2022.021669

Cited by 37 publications

(8 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“… Swami, Dave & Ranga (2021) explored the random forest, MLP, logistic regression, LR, and DT for DDoS attack detection in an SDN using a network dataset. Nadeem et al (2022) implemented naïve Bayes, support vector machine, KNN, and RF to detect the DDoS attack, and tested the implemented techniques using the NSL-KDD dataset and achieved 99.97% accuracy. Yuan, Li & Li (2017) sampled 20 network data features of the dataset ISCX 12 to design a bidirectional RNN performance analysis.…”

Section: Literature Overviewmentioning

confidence: 99%

DDoS attack detection in smart grid network using reconstructive machine learning models

Naqvi,

Li,

Uzair

2024

PeerJ Computer Science

View full text Add to dashboard Cite

Network attacks pose a significant challenge for smart grid networks, mainly due to the existence of several multi-directional communication devices coupling consumers to the grid. One of the network attacks that can affect the smart grid is the distributed denial of service (DDoS), where numerous compromised communication devices/nodes of the grid flood the smart grid network with false data and requests, leading to disruptions in smart meters, data servers, and the state estimator, ultimately effecting the services for end-users. Machine learning-based strategies show distinctive benefits in resolving the challenge of securing the network from DDoS attacks. Regardless, a notable hindrance in deploying machine learning-based techniques is the requirement of model retraining whenever new attack classes arise. Practically, disrupting the normal operations of smart grid is really discouraged. To handle this challenge effectively and detect DDoS attacks without major disruptions, we propose the deployment of reconstructive deep learning techniques. A primary benefit of our proposed technique is the minimum disruption during the introduction of a new attack class, even after complete deployment. We trained several deep and shallow reconstructive models to get representations for each attack type separately, and we performed attack detection by class-specific reconstruction error-based classification. Our technique experienced rigid evaluation via multiple experiments using two well-acknowledged standard databases exclusively for DDoS attacks, including their subsets. Later, we performed a comparative estimation of our outcomes against six methods prevalent within the same domain. Our outcomes reveal that our technique attained higher accuracy, and notably eliminates the requirement of a complete model retraining in the event of the introduction of new attack classes. This method will not only boost the security of smart grid networks but also ensure the stability and reliability of normal operations, protecting the critical infrastructure from ever-evolving network attacks. As smart grid is advancing rapidly, our approach proposes a robust and adaptive way to overcome the continuous challenges posed by network attacks.

show abstract

Section: Literature Overviewmentioning

confidence: 99%

DDoS attack detection in smart grid network using reconstructive machine learning models

Naqvi,

Li,

Uzair

2024

PeerJ Computer Science

View full text Add to dashboard Cite

show abstract

“…There must be a deep investigation of the controller when network size increases. Integrating IDS as a separate platform and linking it to a controller helps alleviate the stress on the controller [37]. Another solution is to implement a distributed controller or dedicate a specific controller for implementing IDS to migrate excessive traffic for checking to other controllers for processing.…”

Section: Controller Resource Consumption By Idsmentioning

confidence: 99%

A Survey on the Latest Intrusion Detection Datasets for Software Defined Networking Environments

Khalid,

Aldabagh

2024

Eng. Technol. Appl. Sci. Res.

View full text Add to dashboard Cite

Software Defined Networking (SDN) threats make network components vulnerable to cyber-attacks, creating obstacles for new model development that necessitate innovative security countermeasures, like Intrusion Detection Systems (IDSs). The centralized SDN controller, which has global view and control over the whole network and the availability of processing and storing capabilities, makes the deployment of artificial intelligence-based IDS in controllers a hot topic in the research community to resolve security issues. In order to develop effective AI-based IDSs in an SDN environment, there must be a high-quality dataset for training the model to offer effective and accurate attack prediction. There are some intrusion detection datasets used by researchers, but those datasets are either outdated or incompatible with the SDN environment. In this survey, an overview of the published work was conducted using the InSDN dataset from 2020 to 2023. Also, research challenges and future work for further research on IDS issues when deployed in an SDN environment are discussed, particularly when employing machine learning and deep learning models. Moreover, possible solutions for each issue are provided to help the researchers carry out and develop new methods of secure SDN.

show abstract

“…A comparison of four typical devices shows that the logical model tree can better identify DDoS traffic from IoT devices. In 2022, Kumar et al [ 28 ] designed the recursive feature elimination method RFE. It is also combined with the random forest algorithm to train the classifier.…”

Section: Related Workmentioning

confidence: 99%

GLD-Net: Deep Learning to Detect DDoS Attack via Topological and Traffic Feature Fusion

Guo¹,

Qiu²,

Liu³

et al. 2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

Distributed denial of service (DDoS) attacks are the most common means of cyberattacks against infrastructure, and detection is the first step in combating them. The current DDoS detection mainly uses the improvement or fusion of machine learning and deep learning methods to improve classification performance. However, most classifiers are trained with statistical flow features as input, ignoring topological connection changes. This one-sidedness affects the detection accuracy and cannot provide a basis for the distribution of attack sources for defense deployment. In this study, we propose a topological and flow feature-based deep learning method (GLD-Net), which simultaneously extracts flow and topological features from time-series flow data and exploits graph attention network (GAT) to mine correlations between non-Euclidean features to fuse flow and topological features. The long short-term memory (LSTM) network connected behind GAT obtains the node neighborhood relationship, and the fully connected layer is utilized to achieve feature dimension reduction and traffic type mapping. Experiments on the NSL-KDD2009 and CIC-IDS2017 datasets show that the detection accuracy of the GLD-Net method for two classifications (normal and DDoS flow) and three classifications (normal, fast DDoS flow, and slow DDoS flow) reaches 0.993 and 0.942, respectively. Compared with the existing DDoS attack detection methods, its average improvement is 0.11 and 0.081, respectively. In addition, the correlation coefficient between the detection accuracy of attack flow and the four source distribution indicators ranges from 0.7 to 0.83, which lays a foundation for the inference of attack source distribution. Notably, we are the first to fuse topology and flow features and achieve high-performance DDoS attack intrusion detection through graph-style neural networks. This study has important implications for related research and development of network security systems in other fields.

show abstract

DDoS Detection in SDN using Machine Learning Techniques

Cited by 37 publications

References 33 publications

DDoS attack detection in smart grid network using reconstructive machine learning models

DDoS attack detection in smart grid network using reconstructive machine learning models

A Survey on the Latest Intrusion Detection Datasets for Software Defined Networking Environments

GLD-Net: Deep Learning to Detect DDoS Attack via Topological and Traffic Feature Fusion

Contact Info

Product

Resources

About