DDoS attack detection in software defined networking controller using machine learning techniques

Software Defined Networking (SDN) is a dynamic architecture that employs a variety of applications for making networks more adaptable and centrally controlled. It is easy to attack the entire network in SDN because the control plane and data plane are separated. DDoS attack is major danger to SDN service providers because it can shut down the entire network and stop services to all customers at any time. One of the key flaws of most SDN architectures is lack of susceptibility to DDoS attacks with its types like TCP flooding, UDP flooding, SYN flooding, ICMP flooding and DHCP flooding for detecting those kinds of attacks. The machine learning algorithms are widely used in recent years to identify DDoS attacks. This research utilizes Decision Tree Classifier for detection and classification of DDoS attacks on SDN. The Forward Feature Selection technique is also used in the research to select the best features from the dataset and from that dataset the data are employed to train and test the model by Decision Tree Classifier Algorithm. The decision Tree Classifier technique is a supervised method used to forecast desired values of observations using rudimentary machine learning decision rules derived from training data. Based on the accuracy of decision tree techniques, in future, a hybrid learning model will be designed for detecting the Distributed Denial of Services in an SDN environment with high accuracy and a low false negative rate.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

<p>Software defined networking (SDN) is a network framework that aims to redefine network characteristics through the programmability of network components, faster and larger network monitoring, centralized network operation, and effective detection of fraudulent traffic and special malfunctions. However, SDN networks are vulnerable to security threats that can cause complete network failure. To address this issue, in this paper, machine learning techniques are suggested for the swift detection of attacks. Various methods for detecting distributed denial of service (DDoS) attacks are evaluated, and the study identifies the most precise method for categorizing such attacks within a SDN network. The results indicate that the proposed system achieves high accuracy in detecting DDoS attacks, with ensemble learning achieving 99% accuracy. This indicates a remarkable improvement percentage in comparison to the approaches of decision tree (DT), k-nearest neighbors (KNN), and support vector machine (SVM).</p>

Software Defined Networking (SDN) is a new type of network architecture, which provides an important way to implement automated network deployment and flexible management. However, security problems in SDN are also inevitable. DDoS attack belongs to one of the most serious attack types, which is fairly common for today’s Internet. In SDN security fields, DDoS attack detection research has been received more and more attention. In this paper, a DDoS attack detection method based on one-class SVM in SDN is proposed, which provides a better detection accuracy. Furthermore, two new feature vectors, including middle value of flow table item’s duration and protocol data traffic percentage, are extracted to integrate into the item of 11 feature vectors. Additionally, basing on selection and construction method of the 11 feature vectors, a DDoS attack behavior model is established by using one-class SVM algorithm, and the self-adaptation genetic algorithm is designed to optimize the corresponding parameters of the Gaussian kernel of one-class SVM. The experimental results in SDN show that, the proposed new feature vectors are shown to more better detection accuracy, and the proposed method is more feasible by comparing with the BP neural network and RBF neural network algorithms under the same 11 features vectors.

Network Virtualization (NV) and Software Defined Networking (SDN) bring new business opportunities for network providers allowing them to offer the network as a service over their network infrastructure. One challenge for network providers is to provision virtual SDN services for multiple tenants while satisfying QoS and traffic engineering (TE) objectives of the higher priced SDN services, allocating the network resources cost effectively and managing the virtual services that span over customer premises, wide area and cloud domains. In this paper, we describe an algorithmic framework that includes QoS management and traffic-engineering methods for managing virtual services over large SDN networks. The algorithmic framework is part of an intelligent service management architecture which employs optimization algorithms, machine learning and artificial intelligence techniques into the management of virtual services over SDN networks.

Limitations on traditional networks contributed to the development of a new paradigm called Software Defined Network (SDN). The separation of control and data plane provides an advantage as well as a security gap on the SDN network because all controls are centralized on the controller so when the compilation of attacks are directed the controller, the controller will be overburdened and eventually dropped. One of the attacks that can be used is the DDoS attack - ICMP Flood. ICMP Flood is an attack intended to overwhelm the target with a large number of ICMP requests. To overcome this problem, this paper proposes detection and mitigation using the Modern Honey Network (MHN) integration in SDN and then makes reactive applications outside the controller using the entropy method. Entropy is a statistical method used to calculate the randomness level of an incoming packet and use header information as a reference for its calculation. In this study, the variables used are the source of IP, the destination of IP and protocol. The results show that detection and mitigation were successfully carried out with an average value of entropy around 10.830. Moreover, CPU usage either in normal packet delivery or attacks showed insignificant impact from the use of entropy. In addition, it can be concluded that the best data collected in 30 seconds in term of the promptness of mitigation flow installation.

Hybrid software-defined networking (SDN) networks are intermediates between traditional networks and SDN networks. However, since the hybrid control planes are structurally different from the single control plane, updating the hybrid SDN networks lacks effective techniques. In this paper, by utilizing the segment routing (SR) mechanism to update hybrid SDN networks and formalize the application of SR during updates, we propose a cooperative consistency update algorithm that can coordinate SR, two-phase commit techniques. The algorithm is capable of preserving consistency with low overhead and excellent applicability. When a network requires updating, the algorithm leverages the SR mechanism to stitch a new path using the available path segments; thus, flows can use the new path immediately. If the update cannot be completed with the SR mechanism alone, the algorithm can utilize the two-phase commit technique to update the nodes through duplication. Notably, our experiments based on real topologies indicate that, compared to prior techniques, the proposed algorithm can greatly reduce the TCAM overhead.

Distributed denial-of-service (DDoS) attacks continue to grow at a rapid rate plaguing Internet Service Providers (ISPs) and individuals in a stealthy way. Thus, intrusion detection systems (IDSs) must evolve to cope with these increasingly sophisticated and challenging security threats. Traditional IDSs are prone to zero-day attacks since they are usually signature-based detection systems. The recent advent of machine learning and deep learning (ML/DL) techniques can help strengthen these IDSs. However, the lack of up-to-date labeled training datasets makes these ML/DL based IDSs inefficient. The privacy nature of these datasets and widespread emergence of adversarial attacks make it difficult for major organizations to share their sensitive data. Federated Learning (FL) is gaining momentum from both academia and industry as a new sub-field of ML that aims to train a global statistical model across multiple distributed users, referred to as collaborators, without sharing their private data. Due to its privacy-preserving nature, FL has the potential to enable privacy-aware learning between a large number of collaborators. This paper presents a novel framework, called MiTFed, that allows multiple software defined networks (SDN) domains ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$i.e.,$</tex-math></inline-formula> collaborators) to collaboratively build a global intrusion detection model without sharing their sensitive datasets. In particular, MiTFed consists of: (1) a novel distributed architecture that allows multiple SDN based domains to securely collaborate in order to cope with sophisticated security threats while preserving the privacy of each SDN domain; (2) a novel Secure Multiparty Computation (SMPC) scheme to securely aggregate local model updates; and (3) a blockchain based scheme that uses Ethereum smart contracts to maintain the collaboration in a fully decentralized, trustworthy, flexible, and efficient manner. To the best of our knowledge, MiTFed is the first framework that leverages FL, blockchain and SDN technologies to mitigate the new emerging security threats in large scale. To evaluate MiTFed, we conduct several experiments using real-world network attacks; the experimental results using the well-known public network security dataset NSL-KDD show that MiTFed achieves efficiency and high accuracy in detecting the new emerging security threats in both binary and multi-class classification while preserving the privacy of collaborators, making it a promising framework to cope with the new emerging security threats in SDN.

In the contemporary digital landscape, Software-Defined Networking (SDN) has emerged as a transformative approach that decouples network control from hardware, enabling greater flexibility and centralized management. However, this innovation has also introduced new vulnerabilities, making SDN networks susceptible to cyber-attacks. To reduce the risk of cyber-attack blockchain can play vital role. In paper we propose a novel framework that leverages blockchain technology to enhance the security and resilience of SDN environments against potential threats. By integrating blockchain’s decentralized and immutable characteristics, our approach facilitates secure data transactions, enhances network visibility, and fosters trust among network participants. We present a comprehensive analysis of the vulnerabilities inherent in traditional SDN architectures and outline method, how blockchain can mitigate these risks through secure authentication, data integrity, and enhanced access controls.Furthermore, we conduct a series of experiments to evaluate the performance impact and security benefits of our proposed solution. The results demonstrate a significant reduction in the likelihood of cyber-attacks, showcasing the viability of blockchain as a potent tool for safeguarding SDN networks. Our findings underscore the importance of interdisciplinary approaches in addressing the evolving challenges of network security, paving the way for more resilient and secure SDN infrastructures in the future.

Software Defined Network (SDN) is a new network construction. But due to its construction, SDN is vulnerable to be attacked by Distributed Denial of Service (DDoS) attack. So it is important to detect DDoS attack in SDN network. This paper presents a DDoS detection scheme based on k-means algorithm in SDN environment. The establishment of this scheme is based on the two hypotheses that the daily network works normally most of the time, and there is a significant difference between the data characteristics of normal situation and abnormal situation. At the same time, these two hypotheses are also true to the daily network condition. After demonstrating the validity of k-means clustering algorithm, the paper proposes 5 flow table features that can be used to detect DDoS attacks. Finally, the DDoS detection scheme was tested by simulation experiment. The test results showed that the method proposed by the author could effectively detect DDoS, with an average success rate of 97.78%.

Computer network conditions that are dynamic and also complex make network operators often make mistakes in the configuration of a network device. However, these mistakes can be resolved by the emergence of a centralized programming approach which is now known as Software Defined Network (SDN). In addition, with the development of information technology, several services in computer networks also grabbed a lot of attention from the world, such as video streaming services. A video streaming service that is so massive is capable of having an impact on data traffic on computer networks. In SDN networks, controllers are a core component of this architecture. Currently, many different types of SDN controllers can be used, however, choosing a controller in an SDN network must be an important concern. This is related to the performance of the SDN controller which is a requirement for SDN network development. This research will analyze the performance of the video streaming service using the Real-time Transport Protocol (RTP) streaming protocol in testing two SDN controllers, namely Pox and Opendaylight. Based on the tests that have been carried out, it produces Quality of Service (QoS) values in the form of throughput, delay, and jitter. The Pox controller excels in the value of QoS delay and throughput. As for the jitter value, both Pox and Opendaylight controllers have good indexes.

It is Software defined networking (SDN) is a new network approach which allows separation of the forwarding plane from the control plane in network architecture, that aids in the efficient control of data flow and gives network administrators a software- based method for managing and configuring the networks. In contrast to SDN, which provides a centralized controller, traditional network topologies require the individual configuration of each network device. Due to a centralized control functionality, SDN is increasingly used by businesses, telecom service providers, cloud providers, and many other users, as it encourages flexibility and scalability in the network while also assisting in streamlining operations. There is significant demand of SDN for effective and adaptable networks. SDN adoption has also been rising in the campuses and corporate sectors. This paper provides a concise overview of the Software Defined Networks (SDN) topic, which is essential for comprehending the fundamental principles of SDN in order to conduct research and implement SDN in many sectors. The initial focus is on the discussion of traditional networks, including their limitations, as well as the many issues encountered by industries. The topic of Software Defined Networks is explored, encompassing their necessity, historical background, architectural structure, interfaces, and models. Next, the many applications of Software-Defined Networking (SDN) are examined. Additionally, the various SDN case studies, vendors, setup issues with SDN, and current research fields were elucidated. The discussion focuses on the role of Software-Defined Networking (SDN) in Artificial Intelligence (AI), specifically addressing the issues associated with implementing SDN in AI.

With the development of Edge Computing (EC), security issues have raised concerns. Due to the unusual vulnera-bility of EC servers and the distributed nature of attack sources, it is a great challenge to efficiently and effectively defend against DDoS attacks. Existing detection solutions, based on the feedback of servers under the attacks, can incur high bandwidth costs and degradation of service performance. To address this problem, we propose a novel collaborative prediction framework, called CoWatch. Based on the distributed software-defined network (SDN), the CoWatch framework can collaboratively predict the DDoS attacks towards the EC servers and detect the attack flows near the attack source in time. To efficiently filter the suspicious flows in distributed SDN, we design an optimal threshold model by balancing the trade-off between collaboration efficiency and prediction effectiveness. We also explore the prototypical LSTM network to design an LSTM-based Collaborative Prediction (LCP) algorithm, which can effectively predict and detect DDoS attacks. Experiment results demonstrate the effectiveness of the prediction and detection of DDoS attacks and validate the efficiency of flow information synchronization in distributed SDN.

Software Defined Networking (SDN) is a new paradigm proposed to meet the requirements of new networking concepts such as cloud computing and data center networking. SDN decouples control and data planes and uses a logically centralized controller to manage the underlying network resources. In this paper, a joint server and route selection mechanism is proposed for SDN networks, where current and past statistics of network resource utilization are taken into account to allocate a server and a corresponding routing path for each incoming flow. The proposed mechanism periodically and automatically updates the link cost metrics of link state routing protocol to achieve the load balancing in the network. The proof of concept has been implemented using Mininet to emulate OpenFlow enabled switches and OpenDaylight as an SDN controller. Using the real IP traffic, we successfully demonstrated that the proposed system evenly distributes traffic flows among network links and servers.

Popularity of Software Defined Network (SDN) technology is spreading rapidly and corporate networks are deploying to take advantages of its features. Control & Data planes are segregated in SDN and simple forwarding devices enabled with OpenFlow protocol is used to forward data planes. The responsibility of control planes are taken by controller into SDN network. The data packets are generated by source host and forwarded to destination host by seeing destination address of such packet without validating source host address. Flow of data packets is controlled by controller setting up required flow entries into flow table of forwarding devices. Initially forwarding devices do not have any security & control and they are not able to forward traffic generated by attached hosts. Data packets of attached hosts are sent to the controller by forwarding devices for generation of control packets and setup necessary flow entries into device flow table. Source IP spoofed attacks may be setup by attacker in this situation and perform different type of attacks. There are some techniques for prevention and mitigation from such attacks. In this study, we offer an analysis of available source address validation techniques for SDN environment. The study discussed various features, limitations and gaps of source address validation solutions and provided various areas in SDN Security for future research.