Abstract:Distributed Denial of Service (DDoS) attack is one of the most severe threats to the current network security. As a new network architecture, Software-Defined Networking (SDN) draws notable attention from both industry and academia. The characteristics of SDN such as centralized management and flow-based traffic monitoring make it an ideal platform to defend against DDoS attacks. When designing a network intrusion detection system (NIDS) in SDN, how to obtain fine-grained flow information with minimal overhead to the SDN architecture is a problem to be solved. In this paper, we propose TPDD, a two-phase DDoS detection system to detect DDoS attacks in SDN. In the first phase, we utilize the characteristics of SDN to collect coarse-grained flow information from the core switches and locate the potential victim. Then we monitor the edge switches located close to the potential victim to obtain finer-grained traffic information in the second phase. The collection method of each phase fully considers the impact on the bandwidth between the controller and switches. Without modifying the existing flow rules, the collection module can obtain sufficient information about traffic. By using entropy-based and machine learning-based methods, the detection module can effectively detect anomalies and identify whether the potential victim marked in the first phase is the target of attacks. Experimental results show that TPDD can effectively detect DDoS attacks with little overhead.

The Systematic Survey for IP Traceback Methods.

Research of Improved Probabilistic Packet Marking Algorithms

Distributed-Log-based Scheme for IP Traceback

A Distributed-Log-based IP Traceback Scheme to Defeat DDoS Attacks

DDoS Traceback Scheme Based on Real-Time Consideration

Autonomous System-Based Marking Scheme for Internet Traceback

SURVEY OF RESEARCHES ON TRACEBACK TECHNIQUES AGAINST DDOS ATTACKS IN WIRELESS AD HOC NETWORKS

IP Tracing and Source-finding Technology Research on DDoS Attack

A Method of IP Traceback Against DDoS Attack

A Real-Time Traceback Scheme for DDoS Attacks

An Incrementally Deployable Flow-Based Scheme for IP Traceback.

Attack Source Traceback Based on Stable Topology in MANET

An adaptive edge marking based hierarchical IP traceback system

Research on Distributed Denial-of-service Attacks:a Survey

A Logless Fast IP Traceback Scheme Against DDoS Attacks

Classification of Network Attack Source Tracing Technologies

Research on a Stochastic Distribution Multibit Trie Tree IP Classification Algorithm

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Strategies for Tracking Individual IP Packets Towards DDoS

A Coding-Based Incremental Traceback Scheme Against DDoS Attacks in MANET

Distributed IDS Tracing Back to Attacking Sources