Abstract:Distributed Denial of Service Attack (DDoS) has emerged as a major threat to cyber space. A DDoS attack aims at exhausting the resources of the victim causing financial and reputational damages to it. The availability of free software make launching of DDoS attacks easy. The difficulty in differentiating a DDoS traffic from a legitimate traffic burst such as a flash crowd makes DDoS difficult to be identified. A wide range of techniques have been used in conventional networks to detect and mitigate DDoS attacks. Though the advent of Software Defined Networking (SDN) makes a network easy to be managed even SDN is vulnerable to DDoS attacks. In this case, the controller of the SDN gets overloaded with the incoming packets from the switches. In fact, a solution based on security analytics can be put in place to ward off this threat as a proactive security measure using the flow level statistics available from the SDN. Compared to the packet analysis used in traditional networks which is resource expensive the flow level statistics is relatively inexpensive. This paper focuses on the design and implementation of an attack detection system for detecting the flooding DDoS attacks TCP SYN flooding attacks, HTTP request flooding attacks, UDP flooding attacks and ICMP flooding attacks over SDN network traffic. The system uses various classification algorithms to classify a traffic into normal or attack. The feature sets for classification were arrived at using a feature selection module with ANOVA (Analysis of Variance) F-Test statistical method. Performance evaluation of each of the classifiers was carried out for the three feature sets obtained from the feature selection module using various performance measures and the results have been tabulated. The feature set which gives the best performance in detecting malicious traffic has been identified.

DDoS Attack Detection under SDN Context

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

Overview of DDoS Attack Detection in Software-Defined Networks

Detection and Mitigation of DoS Attacks in Software Defined Networks

Source-Based Defense Against DDoS Attacks in SDN Based on sFlow and SOM

Detection and mitigation of DDoS attacks based on multi-dimensional characteristics in SDN

SD-Anti-DDoS: Fast and efficient DDoS defense in software-defined networks

SDN-Defend: A Lightweight Online Attack Detection and Mitigation System for DDoS Attacks in SDN

A Deep Learning Based DDoS Detection System in Software-Defined Networking (SDN)

DDoS Detection Using a Cloud-Edge Collaboration Method Based on Entropy-Measuring SOM and KD-Tree in SDN

A DDoS Attack Detection Method Based on SVM in Software Defined Network

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

Identifying Hybrid DDoS Attacks in Deterministic Machine-to-Machine Networks on a Per-Deterministic-Flow Basis

Performance and Features: Mitigating the Low-Rate TCP-Targeted DoS Attack via SDN

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

Towards Detecting Flooding DDOS Attacks Over Software Defined Networks Using Machine Learning Techniques

Detecting DDoS Attack on SDN Due to Vulnerabilities in OpenFlow

Detecting and mitigating DDoS attacks with moving target defense approach based on automated flow classification in SDN networks

DDoS attack detection in software defined networking controller using machine learning techniques

A DDoS attack detection and defense scheme using time-series analysis for SDN