Abstract:Distributed Denial of Service Attack (DDoS) has emerged as a major threat to cyber space. A DDoS attack aims at exhausting the resources of the victim causing financial and reputational damages to it. The availability of free software make launching of DDoS attacks easy. The difficulty in differentiating a DDoS traffic from a legitimate traffic burst such as a flash crowd makes DDoS difficult to be identified. A wide range of techniques have been used in conventional networks to detect and mitigate DDoS attacks. Though the advent of Software Defined Networking (SDN) makes a network easy to be managed even SDN is vulnerable to DDoS attacks. In this case, the controller of the SDN gets overloaded with the incoming packets from the switches. In fact, a solution based on security analytics can be put in place to ward off this threat as a proactive security measure using the flow level statistics available from the SDN. Compared to the packet analysis used in traditional networks which is resource expensive the flow level statistics is relatively inexpensive. This paper focuses on the design and implementation of an attack detection system for detecting the flooding DDoS attacks TCP SYN flooding attacks, HTTP request flooding attacks, UDP flooding attacks and ICMP flooding attacks over SDN network traffic. The system uses various classification algorithms to classify a traffic into normal or attack. The feature sets for classification were arrived at using a feature selection module with ANOVA (Analysis of Variance) F-Test statistical method. Performance evaluation of each of the classifiers was carried out for the three feature sets obtained from the feature selection module using various performance measures and the results have been tabulated. The feature set which gives the best performance in detecting malicious traffic has been identified.

ADVICE: Towards adaptive scheduling for data collection and DDoS detection in SDN

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

Asidps: Auto-Scaling Intrusion Detection And Prevention System For Cloud

FADM: DDoS Flooding Attack Detection and Mitigation System in Software-Defined Networking

SDNManager: A Safeguard Architecture for SDN DoS Attacks Based on Bandwidth Prediction.

Detection and Mitigation of DoS Attacks in Software Defined Networks

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

SD-Anti-DDoS: Fast and efficient DDoS defense in software-defined networks

DDoS Attack Detection under SDN Context

SDN-Defend: A Lightweight Online Attack Detection and Mitigation System for DDoS Attacks in SDN

An Adaptive Scheme for Data Forwarding in Software Defined Network.

Flooddefender: Protecting Data and Control Plane Resources under Sdn-Aimed Dos Attacks

SDNShield: Towards More Comprehensive Defense Against DDoS Attacks on SDN Control Plane

Performance and Features: Mitigating the Low-Rate TCP-Targeted DoS Attack via SDN

Towards Detecting Flooding DDOS Attacks Over Software Defined Networks Using Machine Learning Techniques

Source-Based Defense Against DDoS Attacks in SDN Based on sFlow and SOM

Synchronizing DDoS detection and mitigation based graph learning with programmable data plane, SDN

An Efficient Scheme to Defend Data-to-Control-Plane Saturation Attacks in Software-Defined Networking

ADMS: An online attack detection and mitigation system for LDoS attacks via SDN

Adaptive Suspicious Prevention for Defending DoS Attacks in SDN-Based Convergent Networks