Abstract:Distributed Denial of Service (DDoS) attack is one of the most severe threats to the current network security. As a new network architecture, Software-Defined Networking (SDN) draws notable attention from both industry and academia. The characteristics of SDN such as centralized management and flow-based traffic monitoring make it an ideal platform to defend against DDoS attacks. When designing a network intrusion detection system (NIDS) in SDN, how to obtain fine-grained flow information with minimal overhead to the SDN architecture is a problem to be solved. In this paper, we propose TPDD, a two-phase DDoS detection system to detect DDoS attacks in SDN. In the first phase, we utilize the characteristics of SDN to collect coarse-grained flow information from the core switches and locate the potential victim. Then we monitor the edge switches located close to the potential victim to obtain finer-grained traffic information in the second phase. The collection method of each phase fully considers the impact on the bandwidth between the controller and switches. Without modifying the existing flow rules, the collection module can obtain sufficient information about traffic. By using entropy-based and machine learning-based methods, the detection module can effectively detect anomalies and identify whether the potential victim marked in the first phase is the target of attacks. Experimental results show that TPDD can effectively detect DDoS attacks with little overhead.

Technical Analysis and Defendable Policy of Distributed Denial of Service Attack

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Defense study and implementation mechanism of distributed denial of service attack

Defense Technology of DDoS Attacks

The Principle and Defending of DDoS Attack

Method Research for Defending Against Distributed Denial-of-Service Attacks Based on Dynamic Game Theory

Defending Against Denial of Service Attacks

Research on Defense System Against DDoS Attacks

A Defense Mechanism for Distributed Denial of Service Attack in Software-Defined Networks

Research on Safeguard Techniques against DoS and DDoS Attacks

Research on Distributed Denial-of-service Attacks:a Survey

The Technical Analysis and Security Countermeasure of DoS-based Network Attacks

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

Analysis and Defense for Application Layer DDoS Attacks in the Novel Network Environment

Risk Assessment and Defense Resource Allocation of Cyber-Physical Distribution Systems under Denial-of-Service Attacks

Simulation and Analysis of DDoS in Active Defense Environment

A Game Theory Based Rate Limiting Scheme Against Distributed Denial-of-Service Attacks

Formalized Description of Distributed Denial of Service Attack

Analysis、detection and Protection Technology of DDOS Attack

Simulation and Analysis of Distributed Low-Rate Denial-of-service Attacks

A Novel Mechanism For Detection And Prevention Of Distributed Denial Of Service Attacks