Machine learning algorithms to detect DDoS attacks in SDN

Santos, Reneilson; Souza, Danilo Santos; Santo, Walter do Espiríto; Ribeiro, Admilson de Ribamar Lima; Moreno, Edward David

doi:10.1002/cpe.5402

Cited by 143 publications

(70 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The DT and SVM algorithms have been selected because they have shown high performance in previous research in different applications of SDN [31]- [34]. Fig.…”

Section: Methodsmentioning

confidence: 99%

Detection and Classification of Conflict Flows in SDN Using Machine Learning Algorithms

et al. 2021

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is a new type of technology that embraces high flexibility and adaptability. The applications in SDN have the ability to manage and control networks while ensuring load balancing, access control, and routing. These are considered the most significant benefits of SDN. However, SDN can be influenced by several types of conflicting flows which may lead to deterioration in network performance in terms of efficiency and optimisation. Besides, SDN conflicts occur due to the impact and adjustment of certain features such as priority and action. Moreover, applying machine learning algorithms in the identification and classification of conflicting flows has limitations. As a result, this paper presents several machine learning algorithms that include Decision Tree (DT), Support Vector Machine (SVM), Extremely Fast Decision Tree (EFDT) and Hybrid (DT-SVM) for detecting and classifying conflicting flows in SDNs. The EFDT and hybrid DT-SVM algorithms were designed and deployed based on DT and SVM algorithms to achieve improved performance. Using a range flows from 1000 to 100000 with an increment of 10000 flows per step in two network topologies namely, Fat Tree and Simple Tree Topologies, that were created using the Mininet simulator and connected to the Ryu controller, the performance of the proposed algorithms was evaluated for efficiency and effectiveness across a variety of evaluation metrics. The experimental results of the detection of conflict flows show that the DT and SVM algorithms achieve accuracies of 99.27% and 98.53% respectively while the EFDT and hybrid DT-SVM algorithms achieve respective accuracies of 99.49% and 99.27%. In addition, the proposed EFDT algorithm achieves 95.73% accuracy on the task of classification between conflict flow types. The proposed EFDT and hybrid DT-SVM algorithms show a high capability of SDN applications to offer fast detection and classification of conflict flows.

show abstract

“…The DT and SVM algorithms have been selected because they have shown high performance in previous research in different applications of SDN [31]- [34]. Fig.…”

Section: Methodsmentioning

confidence: 99%

Detection and Classification of Conflict Flows in SDN Using Machine Learning Algorithms

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Thus, selecting the improper features can lead to a significant drawback on the performance attainable by most wellknown classifiers. For better illustration, Santos et al [30] demonstrated that the SDN controller attacks have the worst classifications results achieved by different machine learning algorithms. This return to the fact that some of the important features used to detect the new SDN attack types are similar to normal traffic patterns due to the unique SDN architecture.…”

Section: Background a Literature Reviewmentioning

confidence: 99%

“…In 2019, Santos et al created an SDN testbed to generate the attack traffic dataset for analyzing the performance of some ML techniques [30]. The SDN network was simulated using the POX controller and Mininet tool.…”

Section: B Reviewer-2: Comparison Of Existing Testbeds With Proposedmentioning

confidence: 99%

InSDN: A Novel SDN Intrusion Dataset

2020

View full text Add to dashboard Cite

Software-Defined Network (SDN) has been developed to reduce network complexity through control and manage the whole network from a centralized location. Today, SDN is widely implemented in many data center's network environments. Nevertheless, emerging technology itself can lead to many vulnerabilities and threats which are still challenging for manufacturers to address it. Therefore, deploying Intrusion Detection Systems (IDSs) to monitor malicious activities is a crucial part of the network architecture. Although the centralized view of the SDN network creates new opportunities for the implementation of IDSs, the performance of these detection techniques relies on the quality of the training datasets. Unfortunately, there are no publicly available datasets that can be used directly for anomaly detection systems applied in SDN networks. The majority of the published studies use non-compatible and outdated datasets, such as the KDD'99 dataset. This manuscript aims to generate an attack-specific SDN dataset and it is publicly available to the researchers. To the best of our knowledge, our work is one of the first solutions to produce a comprehensive SDN dataset to verify the performance of intrusion detection systems. The new dataset includes the benign and various attack categories that can occur in the different elements of the SDN platform. Further, we demonstrate the use of our proposed dataset by performing an experimental evaluation using eight popular machine-learning-based techniques for IDSs.

show abstract

“…Four machine learning algorithms, namely, the multilayer perceptron, SVM, decision tree (DT), and RF, are analyzed and compared in [23] to detect DDoS attacks in SDN. These algorithms are proposed to detect three types of DDoS attacks: flow table, bandwidth, and controller attacks.…”

Section: B Machine Learning Approachmentioning

confidence: 99%

Bandwidth Control Mechanism and Extreme Gradient Boosting Algorithm for Protecting Software-Defined Networks Against DDoS Attacks

Alamri

Thayananthan

2020

IEEE Access

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is an emerging network architecture that addresses the limitation of the traditional network by providing centralized management through a central controller that decouples the control and data planes. However, this development has made the controller a severe target for malicious users to execute attacks such as Distributed Denial of Service (DDoS) attacks. Several schemes have been proposed to mitigate DDoS attacks in SDN, but the challenges still exist. This paper proposes a DDoS mitigation scheme for SDN to ensure accurate attack detection and efficient network resource utilization. The scheme employs two stages: a bandwidth control mechanism and Extreme Gradient Boosting (XGBoost) Algorithm. The bandwidth control mechanism utilizes an adaptive bandwidth profile-based threshold and bandwidth control algorithm that trigger the XGBoost algorithm in case of threshold violations. The use of multiple bandwidth profiles in stetting the threshold ensures the threshold's adaptivity to consider the network traffic variation and reduce the packets drop ratio, which shows an outstanding result. The XGBoost algorithm classifies network traffic flow that violates a set threshold into normal or abnormal traffic. We evaluated the performance of our scheme using CICDDoS2019, NSL-KDD, and CAIDA datasets. Furthermore, we validated our proposed solution in real-time with the SDN environment. The results obtained show that our scheme protects SDN against DDoS attacks with high accuracy, low error, and efficient utilization of the network resources. The proposed system achieved 99.9% accuracy in detecting DDoS attacks with a low false-positive rate of 0.0002% in SDN.

show abstract

Machine learning algorithms to detect DDoS attacks in SDN

Cited by 143 publications

References 28 publications

Detection and Classification of Conflict Flows in SDN Using Machine Learning Algorithms

Detection and Classification of Conflict Flows in SDN Using Machine Learning Algorithms

InSDN: A Novel SDN Intrusion Dataset

Bandwidth Control Mechanism and Extreme Gradient Boosting Algorithm for Protecting Software-Defined Networks Against DDoS Attacks

Contact Info

Product

Resources

About