Multi-SDN Based Cooperation Scheme for DDoS Attack Defense

He, Boren; Zou, Futai; Wu, Yue

doi:10.1109/ssic.2018.8556830

Cited by 8 publications

(5 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The SDN controllers can be deployed as a cluster of VMs for instant provisioning and restoration of services under attack conditions. Moreover, the cloud facilitates easy and quick exchange of anti‐attack flow rules among the controllers and across the entire SDN cloud network 62,63,67–69 …”

Section: Discussion and Open Issuesmentioning

confidence: 99%

See 1 more Smart Citation

Software‐defined networking security for private data center networks and clouds: Vulnerabilities, attacks, countermeasures, and solutions

Abdelrahman

Rodrigues

Mahmoud

et al. 2020

Int J Communication

View full text Add to dashboard Cite

Software-defined networking (SDN) is an agile, modern networking approach that facilitates innovations in the networking paradigm. The abstracted and centralized network operating system facilitates the network management and reduces operational expenditure (OPEX). The open nature and simplicity of the data-forwarding plane dramatically reduces capital expenditure (CAPEX) by leveraging commodity servers and switches. SDN also lends itself very well to address major cloud computing issues and complement cloud services, especially in terms of network virtualization and networking as a service (NaaS).As a new technology, SDN does involve certain security challenges, which include distributed denial of service (DDoS) threats, build and run time injected malware, insider (tenant) attacks, and security holes resulting from controller misconfigurations. These are severe threats that can cripple an entire network. It is crucial to address the SDN vulnerabilities to ensure its successful deployment in private data center networks, on cloud platforms and beyond. Some security solutions leverage the built-in features of SDN, such as its controller software component, while other solutions provide external SDN applications running above the controller. This study reviews the security solutions for the vulnerabilities of state-of-the-art SDN controllers and the available countermeasures. Furthermore, an in-depth analysis of the SDN features that support security is presented, and some unresolved research issues on SDN controllers are identified.

show abstract

Section: Discussion and Open Issuesmentioning

confidence: 99%

“…62,63,[67][68][69] T A B L E 5 Comparison of the SDN features, the corresponding security features, and the available solutions SDN is rapidly emerging as de facto standard for both private data centers and cloud platforms. However, SDN controllers' vulnerabilities and issues attract serious threats and attacks that can cripple the entire network.…”

mentioning

confidence: 99%

Software‐defined networking security for private data center networks and clouds: Vulnerabilities, attacks, countermeasures, and solutions

Abdelrahman

Rodrigues

Mahmoud

et al. 2020

Int J Communication

View full text Add to dashboard Cite

show abstract

“…An entropy-based DDoS detection approach is presented in [4], which measures the difference between normal and abnormal traffic to compute the entropy value to perform the detection. Similarly, an integrated model is presented in [5], which uses SDN features and produces higher accuracy and lower cost.…”

Section: Related Workmentioning

confidence: 99%

RMCARTAM For DDoS Attack Mitigation in SDN Using Machine Learning

Revathi¹,

Ramalingam²,

Amutha³

2023

Computer Systems Science and Engineering

View full text Add to dashboard Cite

The impact of a Distributed Denial of Service (DDoS) attack on Software Defined Networks (SDN) is briefly analyzed. Many approaches to detecting DDoS attacks exist, varying on the feature being considered and the method used. Still, the methods have a deficiency in the performance of detecting DDoS attacks and mitigating them. To improve the performance of SDN, an efficient Real-time Multi-Constrained Adaptive Replication and Traffic Approximation Model (RMCARTAM) is sketched in this article. The RMCARTAM considers different parameters or constraints in running different controllers responsible for handling incoming packets. The model is designed with multiple controllers to handle network traffic but can turn the controllers according to requirements. The multi-constraint adaptive replication model monitors different features of network traffic like rate of packet reception, class-based packet reception and target-specific reception. According to these features, the method estimates the Replication Turning Weight (RTW) based on which triggering controllers are performed. Similarly, the method applies Traffic Approximation (TA) in the detection of DDoS attacks. The detection of a DDoS attack is performed by approximating the incoming traffic to any service and using various features like hop count, payload, service frequency, and malformed frequency to compute various support measures on bandwidth access, data support, frequency support, malformed support, route support, and so on. Using all these support measures, the method computes the value of legitimate weight to conclude the behavior of any source in identifying the malicious node. Identified node details are used in the mitigation of DDoS attacks. The method stimulates the network performance by reducing the power factor by switching the controller according to different factors, which also reduces the cost. In the same way, the proposed model improves the accuracy of detecting DDoS attacks by estimating the features of incoming traffic in different corners.

show abstract

“…Naïve Bayes had an accuracy of up to 70% while SVM and the neural network had the same accuracy of 80%. The authors in [13] used SVM for DDoS attack detection. It was observed that the SVM algorithm achieved more than 98% accuracy on both the attacker and victim side for SYN flooding, ICMP flooding, and DNS reflection attacks.…”

Section: Related Workmentioning

confidence: 99%

An Investigation into the Application of Deep Learning in the Detection and Mitigation of DDOS Attack on SDN Controllers

et al. 2021

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is a new paradigm that revolutionizes the idea of a software-driven network through the separation of control and data planes. It addresses the problems of traditional network architecture. Nevertheless, this brilliant architecture is exposed to several security threats, e.g., the distributed denial of service (DDoS) attack, which is hard to contain in such software-based networks. The concept of a centralized controller in SDN makes it a single point of attack as well as a single point of failure. In this paper, deep learning-based models, long-short term memory (LSTM) and convolutional neural network (CNN), are investigated. It illustrates their possibility and efficiency in being used in detecting and mitigating DDoS attack. The paper focuses on TCP, UDP, and ICMP flood attacks that target the controller. The performance of the models was evaluated based on the accuracy, recall, and true negative rate. We compared the performance of the deep learning models with classical machine learning models. We further provide details on the time taken to detect and mitigate the attack. Our results show that RNN LSTM is a viable deep learning algorithm that can be applied in the detection and mitigation of DDoS in the SDN controller. Our proposed model produced an accuracy of 89.63%, which outperformed linear-based models such as SVM (86.85%) and Naive Bayes (82.61%). Although KNN, which is a linear-based model, outperformed our proposed model (achieving an accuracy of 99.4%), our proposed model provides a good trade-off between precision and recall, which makes it suitable for DDoS classification. In addition, it was realized that the split ratio of the training and testing datasets can give different results in the performance of a deep learning algorithm used in a specific work. The model achieved the best performance when a split of 70/30 was used in comparison to 80/20 and 60/40 split ratios.

show abstract

Multi-SDN Based Cooperation Scheme for DDoS Attack Defense

Cited by 8 publications

References 11 publications

Software‐defined networking security for private data center networks and clouds: Vulnerabilities, attacks, countermeasures, and solutions

Software‐defined networking security for private data center networks and clouds: Vulnerabilities, attacks, countermeasures, and solutions

RMCARTAM For DDoS Attack Mitigation in SDN Using Machine Learning

An Investigation into the Application of Deep Learning in the Detection and Mitigation of DDOS Attack on SDN Controllers

Contact Info

Product

Resources

About