Low-rate DDoS attack Detection using Deep Learning for SDN-enabled IoT Networks

Abstract

Software Defined Networks (SDN) can logically route traffic and utilize underutilized network resources, which has enabled the deployment of SDN-enabled Internet of Things (IoT) architecture in many industrial systems. SDN also removes bottlenecks and helps process IoT data efficiently without overloading the network. An SDN-based IoT in an evolving environment is vulnerable to various types of distributed denial of service (DDoS) attacks. Many research papers focus on highrate DDoS attacks, while few address low-rate DDoS attacks in SDN-based IoT networks. There's a need to enhance the accuracy of LDDoS attack detection in SDN-based IoT networks and OpenFlow communication channel. In this paper, we propose LDDoS attack detection approach based on deep learning (DL) model that consists of an activation function of the Long-Short Term Memory (LSTM) to detect different types of LDDoS attacks in IoT networks by analyzing the characteristic values of different types of LDDoS attacks and natural traffic, improve the accuracy of LDDoS attack detection, and reduce the malicious traffic flow. The experiment result shows that the model achieved an accuracy of 98.88%. In addition, the model has been tested and validated using benchmark Edge IIoTset dataset which consist of cyber security attacks.

Enhancing DDoS Attack Detection and Mitigation in SDN Using an Ensemble Online Machine Learning Model

“…DDoS attacks pose a pervasive threat to network availability and performance. While traditional DDoS attacks flood a target with an overwhelming volume of traffic, lowrate DDoS attacks employ a subtler approach [21]. In a LDDoS attack, malicious traffic is injected at a lower rate, making it less conspicuous and more challenging to detect using traditional threshold-based methods [22].…”

“…Machine Learning (ML) has emerged as a potent tool for enhancing network security, equipping us with the capability to scrutinize vast troves of network data and promptly detect anomalies in real-time. A specialized variant of ML, known as Online Machine Learning (OML), accentuates adaptability and perpetual learning from streaming data streams [28].…”

“…Recent studies have showcased the effectiveness of ML models in accurately distinguishing legitimate network traffic from malicious attacks [7]. However, as the DDoS landscape evolves with the rise of lowrate and zero-day attacks, the availability of features for model training becomes increasingly restricted [8][9][10]. posing challenges to the model's adaptability and efficacy against evolving attack tactics.…”

A Self-Attention-Based Deep Convolutional Neural Networks for IIoT Networks Intrusion Detection

“…In [28], the authors employed the LSTM model for monitoring Software-Defined Networking (SDN)-enabled IoT networks and detecting cyberattacks. The authors specifically concentrated on enhancing the accuracy of Low-Rate Distributed Denial of Service (LDDoS) detection.…”

Comparison and Investigation of AI-Based Approaches for Cyberattack Detection in Cyber-Physical Systems

“…Machine learning (ML) and deep learning (DL) techniques are subsections of artificial intelligence (AI) that are currently used for the detection of cyberattacks, such as threat detection, malware clarification, and intrusion detection. Extensive research has been conducted on the use of ML learning algorithms to enhance cyberattack issues in the CPS environment [9], [10]. The ML method can also be applied to detect and identify anomalies [11].…”