Abstract:Due to the large computational overhead, underutilization of features, and high bandwidth consumption in traditional SDN environments for DDoS attack detection and mitigation methods, this paper proposes a two-stage detection and mitigation method for DDoS attacks in SDN based on multi-dimensional characteristics. Firstly, an analysis of the traffic statistics from the SDN switch ports is performed, which aids in conducting a coarse-grained detection of DDoS attacks within the network. Subsequently, a Multi-Dimensional Deep Convolutional Classifier (MDDCC) is constructed using wavelet decomposition and convolutional neural networks to extract multi-dimensional characteristics from the traffic data passing through suspicious switches. Based on these extracted multi-dimensional characteristics, a simple classifier can be employed to accurately detect attack samples. Finally, by integrating graph theory with restrictive strategies, the source of attacks in SDN networks can be effectively traced and isolated. The experimental results indicate that the proposed method, which utilizes a minimal amount of statistical information, can quickly and accurately detect attacks within the SDN network. It demonstrates superior accuracy and generalization capabilities compared to traditional detection methods, especially when tested on both simulated and public datasets. Furthermore, by isolating the affected nodes, the method effectively mitigates the impact of the attacks, ensuring the normal transmission of legitimate traffic during network attacks. This approach not only enhances the detection capabilities but also provides a robust mechanism for containing the spread of cyber threats, thereby safeguarding the integrity and performance of the network.

A novel DDoS attack detection method

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

A Novel Distributed Denial-of-Service Attack Detection Scheme for Software Defined Networking Environments.

DDoS Attack Detection Based on Global Network Properties of Network Traffic Anomaly

Detecting DDoS Attacks Against Data Center with Correlation Analysis.

A Novel Threat Assessment Method for DDoS Early Warning Using Network Vulnerability Analysis

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

Detecting DDoS Attacks Based on Network Connection Statistics

Distributed Denial of Service (DDoS) detection by traffic pattern analysis

A New Multistage Approach to Detect Subtle DDoS Attacks.

Global Detection of DDoS Attack Based on Time and Frequency Analysis

Detection and mitigation of DDoS attacks based on multi-dimensional characteristics in SDN

A Novel Mechanism For Detection And Prevention Of Distributed Denial Of Service Attacks

Global Abnormal Correlation Analysis for DDoS Attack Detection

A Method of Run-Time Detecting Ddos Attacks

A Kind of Detecting Model against DDoS Attacks

Detecting TCP-Based DDoS Attacks in Baidu Cloud Computing Data Centers.

CCID: Cross-Correlation Identity Distinction Method for Detecting Shrew DDoS.