Distributed Denial of Service (DDoS) Attacks Detection System for OpenStack-based Private Cloud

Virupakshar, Karan B.; Asundi, Manjunath; Channal, Kishor; Shettar, Pooja; Patil, Somashekar; Narayan, D. G.

doi:10.1016/j.procs.2020.03.282

Cited by 83 publications

(35 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The network anomaly detection algorithm based on machine learning can also be effectively applied to DDoS attack detection in SDN [43] [44]. Machine learning algorithms can automatically build classification models based on training data, and classify traffic based on the features of flows.…”

Section: A Researches On Ddos Detection and Defense Methodsmentioning

confidence: 99%

A New Framework for DDoS Attack Detection and Defense in SDN Environment

et al. 2020

View full text Add to dashboard Cite

While software defined network (SDN) brings more innovation to the development of future networks, it also faces a more severe threat from DDoS attacks. In order to deal with the single point of failure on SDN controller caused by DDoS attacks, we propose a framework for detection and defense of DDoS attacks in the SDN environment. Firstly, we deploy a trigger mechanism of DDoS attack detection on data plane to screen for abnormal flows in the network. Then, we use a combined machine learning algorithm based on K-Means and KNN to exploit the rate characteristics and asymmetry characteristics of the flows and to detect the suspicious flows determined by the detection trigger mechanism. Finally, the controller will take corresponding actions to defense against the attacks. In this paper, we propose a new framework of cooperative detection methods of control plane and data plane, which effectively improve the detection accuracy and efficiency, and prevent DDoS attacks on SDN. INDEX TERMS Software Defined Network, Distributed Denial of Service (DDoS), collaborative detection, traffic characteristics, detection trigger.

show abstract

Section: A Researches On Ddos Detection and Defense Methodsmentioning

confidence: 99%

A New Framework for DDoS Attack Detection and Defense in SDN Environment

et al. 2020

View full text Add to dashboard Cite

show abstract

“…The approach showed promising results in detecting regular DDoS attacks for NN with 80% accuracy and 100% precision. Similarly, Virupakshar et al [38] evaluated the performance of Decision Trees, K-nearest neighbor (KNN), Naive Bayes, and Deep Neural Network (DNN) in flooding attack detection on an OpenStack-based private cloud. Their findings showed that KNN, Naive Bayes and DNN achieve high accuracy, specially for DNN.…”

Section: Related Workmentioning

confidence: 99%

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

et al. 2020

View full text Add to dashboard Cite

While there have been extensive studies of denial of service (DoS) attacks and DDoS attack mitigation, such attacks remain challenging to mitigate. For example, Low-Rate DDoS (LR-DDoS) attacks are known to be difficult to detect, particularly in a software-defined network (SDN). Hence, in this paper we present a flexible modular architecture that allows the identification and mitigation of LR-DDoS attacks in SDN settings. Specifically, we train the intrusion detection system (IDS) in our architecture using six machine learning (ML) models (i.e., J48, Random Tree, REP Tree, Random Forest, Multi-Layer Perceptron (MLP), and Support Vector Machines (SVM)) and evaluate their performance using the Canadian Institute of Cybersecurity (CIC) DoS dataset. The findings from the evaluation demonstrate that our approach achieves a detection rate of 95%, despite the difficulty in detecting LR-DoS attacks. We also remark that in our deployment, we use the open network operating system (ONOS) controller running on Mininet virtual machine in order for our simulated environment to be as close to real-world production networks as possible. In our testing topology, the intrusion prevention detection system mitigates all attacks previously detected by the IDS system. This demonstrates the utility of our architecture in identifying and mitigating LR-DDoS attacks. INDEX TERMS DDoS attack mitigation, Low-rate DDoS (LR-DDoS) attacks, Machine learning, Software-defined network (SDN).

show abstract

“…For DDoS attacks in the flying ad-hoc network (FANET), Mowla et al [28] developed a modelfree Q-learning mechanism with an adaptive explorationexploitation epsilon-greedy policy, directed by an ondevice federated jamming detection mechanism. For DDoS attacks in the terrestrial network, Virupakshar et al [29] used a variety of machine learning techniques to propose a network traffic monitoring system based on OpenStack firewall and raw socket programming. Alsirhani et al [30] proposed a dynamic DDoS attack detection system based on classification algorithms, distributed systems, and fuzzy logic systems.…”

Section: Network Intrusion Detection Systemmentioning

confidence: 99%

Distributed Network Intrusion Detection System in Satellite-Terrestrial Integrated Networks Using Federated Learning

Zhou

et al. 2020

IEEE Access

View full text Add to dashboard Cite

The existing satellite-terrestrial integrated networks (STINs) suffer from security and privacy concerns due to the limited resources, poor attack resistance and high privacy requirements of satellite networks. Network Intrusion Detection System (NIDS) is intended to provide a high level of protection for modern network environments, but how to implement distributed NIDS on STINs has not been widely discussed. At the same time, satellite networks have always lacked real and effective security data sets as references. To solve these problems, we propose a distributed NIDS using Federal Learning (FL) in STIN to properly allocate resources in each domain to analyze and block malicious traffic, especially distributed denial-of-service (DDoS) attacks. Specifically, we first design a typical STIN topology, on the basis of which we collect and design security data sets adapted to satellite and terrestrial networks in STIN, respectively. To address the problem of poor attack resistance of satellite networks, we propose a satellite network topology optimization algorithm to reduce the difficulty in tracing malicious packets due to frequent link switching. In order to solve the problem of limited resources and high privacy requirements of satellite networks, we propose an algorithm for FL adaptation to STIN, and build a distributed NIDS using FL in STIN. Finally, we deploy the designed distributed NIDS in a prototype system and evaluate our proposed distributed NIDS with a large number of simulations of randomly generated malicious traffic. Related results demonstrate that the performance of our approach is better than traditional deep learning and intrusion detection methods in terms of malicious traffic recognition rate, packet loss rate, and CPU utilization. INDEX TERMS Satellite-terrestrial integrated network, distributed NIDS, security data set, federated learning.

show abstract

Distributed Denial of Service (DDoS) Attacks Detection System for OpenStack-based Private Cloud

Cited by 83 publications

References 9 publications

A New Framework for DDoS Attack Detection and Defense in SDN Environment

A New Framework for DDoS Attack Detection and Defense in SDN Environment

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

Distributed Network Intrusion Detection System in Satellite-Terrestrial Integrated Networks Using Federated Learning

Contact Info

Product

Resources

About