Defending DDoS against Software Defined Networks using Entropy

Swami, Rochak; Dave, Mayank; Ranga, Virender

doi:10.1109/iot-siu.2019.8777688

Cited by 23 publications

(14 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this study, the threshold is 1. If entropy < threshold or is in the range of 0-1, the incoming packet is normal [5] [11][25] [27]. Conversely, if the entropy value is ≥ 1, then the packet is identified as DDoS and host 4 communicates via the application layer using RYU REST Application Programming Interface (API) to create and send OFPT_FLOW_MOD messages to the switch.…”

Section: Figure 3 Sdn Controller's Block Diagrammentioning

confidence: 99%

“…This can be a problem because in the networking management mechanism on the SDN when the packet arrives, the switch will match the information in the flow table to determine the right action. If no match is found, the switch will send a packet to the controller [10] [11] and if a DDoS attack is launched with a target of an attack on the controller then the controller will go down because all controls are centralized on the controller.…”

Section: Introductionmentioning

confidence: 99%

“…Several honeypot sensors in MHN include Dionaea, Suricata, Kippo, Crown and others with MongoDB as sensor data's storage facilities. In addition to MHN, entropy is also used in this study and the combination of MHN-entropy can be a solution to DDoS attacks on SDN networks because entropy is a statistical method used to calculate the uncertainty or randomness of incoming packets [11][13] [14].…”

Section: Introductionmentioning

confidence: 99%

“…Researchers in [10] used the entropy method with the destination IP variable to detect the first 250 attacks on the controller. Whereas in research [11], researchers detected UDP Flood using entropy with the destination IP variable to calculate the randomness level of the first 125 packets. Another study [12], proposed the detection of entropy-based UDP Flooding Attack based on source IP, destination IP, source port, destination port, protocol and generated rate limiting based mitigation.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

SDN-Honeypot Integration for DDoS Detection Scheme Using Entropy

Kilwalaga

Sumadi

Syaifuddin

2020

KINETIK

View full text Add to dashboard Cite

Limitations on traditional networks contributed to the development of a new paradigm called Software Defined Network (SDN). The separation of control and data plane provides an advantage as well as a security gap on the SDN network because all controls are centralized on the controller so when the compilation of attacks are directed the controller, the controller will be overburdened and eventually dropped. One of the attacks that can be used is the DDoS attack - ICMP Flood. ICMP Flood is an attack intended to overwhelm the target with a large number of ICMP requests. To overcome this problem, this paper proposes detection and mitigation using the Modern Honey Network (MHN) integration in SDN and then makes reactive applications outside the controller using the entropy method. Entropy is a statistical method used to calculate the randomness level of an incoming packet and use header information as a reference for its calculation. In this study, the variables used are the source of IP, the destination of IP and protocol. The results show that detection and mitigation were successfully carried out with an average value of entropy around 10.830. Moreover, CPU usage either in normal packet delivery or attacks showed insignificant impact from the use of entropy. In addition, it can be concluded that the best data collected in 30 seconds in term of the promptness of mitigation flow installation.

show abstract

Section: Figure 3 Sdn Controller's Block Diagrammentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

SDN-Honeypot Integration for DDoS Detection Scheme Using Entropy

Kilwalaga

Sumadi

Syaifuddin

2020

KINETIK

View full text Add to dashboard Cite

show abstract

“…Distributed Denial of Service (DDoS) attacks are assaults against information technology infrastructure using Internet-enabled and connected devices to synchronously send requests to the victim at a rate that overwhelms the processing capacity and response rate of the victim (Dabbagh et al, 2015). Exhaustion of the victim's resources is the aim of the attack such that the resources that would have been used to serve requests from legitimate clients would be occupied by the attack requests, thus denying the legitimate clients access to the resource (Swami et al, 2019a). This results in the availability of the service, an aspect of network security among the confidentiality, integrity, and availability triad, being tampered with (Swami et al, 2019b).…”

Section: Introductionmentioning

confidence: 99%

Mitigating Slow Hypertext Transfer Protocol Distributed Denial of Service Attacks in Software Defined Networks

Akanji

Abisoye

Iliyasu

2021

Journal of Information and Communication Technology

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks has been one of the persistent forms of attacks on information technology infrastructure connected to public networks due to the ease of access to DDoS attack tools. Researchers have been able to develop several techniques to curb volumetric DDoS which overwhelms the target with a large number of request packets. However, compared to slow DDoS, limited number of research has been executed on mitigating slow DDoS. Attackers have resorted to slow DDoS because it mimics the behaviour of a slow legitimate client thereby causing service unavailability. This paper provides the scholarly community with an approach to boosting service availability in web servers under slow Hypertext Transfer Protocol (HTTP) DDoS attacks through attack detection using Genetic Algorithm and Support Vector Machine which facilitates attack mitigation in a Software-Defined Networking (SDN) environment simulated in GNS3. Genetic algorithm was used to select the Netflow features which indicates the presence of an attack and also determine the appropriate regularization parameter, C, and gamma parameter for the Support Vector Machine classifier. Results obtained showed that the classifier had detection accuracy, Area Under Receiver Operating Curve (AUC), true positive rate, false positive rate and a false negative rate of 99.89%, 99.89%, 99.95%, 0.18%, and 0.05% respectively. Also, the algorithm for subsequent implementation of the selective adaptive bubble burst mitigation mechanism was presented. This study contributes to the ongoing research in detecting and mitigating slow HTTP DDoS attacks with emphasis on the use of machine learning classification and meta-heuristic algorithms.

show abstract

Intelligent software defined networking: Long short term memory‐graded rated unit enabled block‐attack model to tackle distributed denial of service attacks

Jagtap

Saravanan

2022

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Software defined networking (SDN) is the next‐generation network. SDN enhances the programming flexibility, speed and automation to improve the network's performance. In recent times SDN has played a vital role in networking technology. It communicates with underlying hardware infrastructure and directs traffic on a network. The most complicated issue in SDN is the control plane's single point of failure (SPF). The main reason for raising the SPF problem in SDN by distributed denial of service (DDoS) attacks. The network collapses during failures in SDN, and the control plane is considered a management controller. Therefore, a novel intrusion detection and prevention system (IDPS) is proposed in the proposed approach to address SDN's problems mentioned above. In the proposed approach, a long short term memory (LSTM) and graded rated unit (GRU) deep learning model is proposed as the “Block‐Attack” model. The main objective of using LSTM and GRU in the proposed approach is to enhance the rate of accuracy in detecting DDoS attacks in an SDN environment. The CICDDoS2019 dataset is used for experimental result analysis in the proposed approach. Initially, the dataset is fed into the preprocessing stage. Using the K‐medoid technique, raw datasets are preprocessed to reduce the model's sensitivity to low density. In the proposed approach, the support vector machine based machine learning (SVM‐ML) technique is utilized to prevent DDoS attacks in a Mininet‐based emulation. Then, LSTM and GRU deep learning (DL) techniques are used to define the block‐attack model to enhance the detection performance. The experimental results of the proposed approach “Block‐Attack” model attain 98.5% of accuracy to detect and prevent the DDoS attacks and 95.5% of accuracy for SVM based method.

show abstract

Defending DDoS against Software Defined Networks using Entropy

Cited by 23 publications

References 13 publications

SDN-Honeypot Integration for DDoS Detection Scheme Using Entropy

SDN-Honeypot Integration for DDoS Detection Scheme Using Entropy

Mitigating Slow Hypertext Transfer Protocol Distributed Denial of Service Attacks in Software Defined Networks

Intelligent software defined networking: Long short term memory‐graded rated unit enabled block‐attack model to tackle distributed denial of service attacks

Contact Info

Product

Resources

About