Abstract:Distributed Denial of Service (DDoS) attack is one of the most severe threats to the current network security. As a new network architecture, Software-Defined Networking (SDN) draws notable attention from both industry and academia. The characteristics of SDN such as centralized management and flow-based traffic monitoring make it an ideal platform to defend against DDoS attacks. When designing a network intrusion detection system (NIDS) in SDN, how to obtain fine-grained flow information with minimal overhead to the SDN architecture is a problem to be solved. In this paper, we propose TPDD, a two-phase DDoS detection system to detect DDoS attacks in SDN. In the first phase, we utilize the characteristics of SDN to collect coarse-grained flow information from the core switches and locate the potential victim. Then we monitor the edge switches located close to the potential victim to obtain finer-grained traffic information in the second phase. The collection method of each phase fully considers the impact on the bandwidth between the controller and switches. Without modifying the existing flow rules, the collection module can obtain sufficient information about traffic. By using entropy-based and machine learning-based methods, the detection module can effectively detect anomalies and identify whether the potential victim marked in the first phase is the target of attacks. Experimental results show that TPDD can effectively detect DDoS attacks with little overhead.

Distributed Intrusion Detection System Based on Peer to Peer

On a Distributed Intrusion Detection Model Based on the Super-Peer Framework

Study on adaptive trust alert correlation P2P overlay IDS

Research of Distributed Pre-Decision Engine in Wireless Intrusion Prevention Systems

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Multi-agent based hybrid Intrusion detection system

Intrusion Detection And Simulation For High-Speed Networks

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

A Novel Peer-to-Peer Intrusion Detection System

Design and Implementation of a Distributed Cooperative Intrusion Detection System

Intrusion Detection in Distributed Systems: An Abstraction-Based Approach

Indra: A Peer-To-Peer Approach to Network Intrusion Detection and Prevention

Design of Traffic Distributor Based on IXP1200 for Network Intrusion Detection System

Research on Distributed Intrusion Prevention System on High-Speed Networks

A Distributed Intrusion Detection System and Its Apperception Ability

Dynamic Hierarchical Distributed Intrusion Detection System Based on Multi-agent System

A Distributed Intrusion Detection System Using Cooperating Agents

Secure P2P Topology Based on a Multidimensional DHT Space Mapping

Research of a Secure Communication Protocol for Agent-based Distribution Intrusion Detection System

Agent-Based Intrusion Detection System for Integration.

A cooperative intrusion detection system based on autonomous agents