Abstract:Distributed Denial of Service (DDoS) attack is one of the most severe threats to the current network security. As a new network architecture, Software-Defined Networking (SDN) draws notable attention from both industry and academia. The characteristics of SDN such as centralized management and flow-based traffic monitoring make it an ideal platform to defend against DDoS attacks. When designing a network intrusion detection system (NIDS) in SDN, how to obtain fine-grained flow information with minimal overhead to the SDN architecture is a problem to be solved. In this paper, we propose TPDD, a two-phase DDoS detection system to detect DDoS attacks in SDN. In the first phase, we utilize the characteristics of SDN to collect coarse-grained flow information from the core switches and locate the potential victim. Then we monitor the edge switches located close to the potential victim to obtain finer-grained traffic information in the second phase. The collection method of each phase fully considers the impact on the bandwidth between the controller and switches. Without modifying the existing flow rules, the collection module can obtain sufficient information about traffic. By using entropy-based and machine learning-based methods, the detection module can effectively detect anomalies and identify whether the potential victim marked in the first phase is the target of attacks. Experimental results show that TPDD can effectively detect DDoS attacks with little overhead.

Traffic Distributor for High-Speed Network Intrusion Detection System

Design of Traffic Distributor Based on IXP1200 for Network Intrusion Detection System

Intrusion Detection And Simulation For High-Speed Networks

Embedded network processor based parallel intrusion detection

Hybrid Intrusion Detection System for Complicated Network

Research on Distributed Intrusion Prevention System on High-Speed Networks

New Trend of Intrusion Detection System for High-speed Networks

A Parallel Intrusion Detection System for High-Speed Networks

Multi-agent based hybrid Intrusion detection system

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

Real-time intrusion detection for high-speed networks

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Network Safeguard System Based on IDXP

Implementation of Network Processor-Based Content Filtering

High-Speed Memory-Efficient Network Intrusion Detection System

Load Balancing Algorithm for High-Speed Network Intrusion Detection Systems

Intrusion Detection for High-Speed Networks Based on Producing System

Design and Implementation of Kilomega Wirespeed Intrusion Detect System

A high throughput Intrusion Detection System (IDS) to enhance the security of data transmission among research centers

Design and Implementation of a Gigabit Rate Network Intrusion Prevention System

Research and Implementation of High-Speed Packet Processing in Gigabit Network IPS