Abstract:This research article proposes a novel system called Two‐Phase Authentication for Attack Detection (TPAAD) that aims to enhance the security of software‐defined networking by mitigating denial‐of‐service attacks. The methodology utilized in our study involves the implementation of packet filtration and ML classification techniques, which are subsequently followed by the targeted restriction of malevolent network traffic. Software‐defined networking (SDN) has received considerable attention and adoption owing to its inherent advantages, such as enhanced scalability, increased adaptability, and the ability to exercise centralized control. However, the control plane of the system is vulnerable to denial‐of‐service (DoS) attacks, which are a primary focus for attackers. These attacks have the potential to result in substantial delays and packet loss. In this study, we present a novel system called Two‐Phase Authentication for Attack Detection that aims to enhance the security of SDN by mitigating DoS attacks. The methodology utilized in our study involves the implementation of packet filtration and machine learning classification techniques, which are subsequently followed by the targeted restriction of malevolent network traffic. Instead of completely deactivating the host, the emphasis lies on preventing harmful communication. Support vector machine and K‐nearest neighbours algorithms were utilized for efficient detection on the CICDoS 2017 dataset. The deployed model was utilized within an environment designed for the identification of threats in SDN. Based on the observations of the banned queue, our system allows a host to reconnect when it is no longer contributing to malicious traffic. The experiments were run on a VMware Ubuntu, and an SDN environment was created using Mininet and the RYU controller. The results of the tests demonstrated enhanced performance in various aspects, including the reduction of false positives, the minimization of central processing unit utilization and control channel bandwidth consumption, the improvement of packet delivery ratio, and the decrease in the number of flow requests submitted to the controller. These results confirm that our Two‐Phase Authentication for Attack Detection architecture identifies and mitigates SDN DoS attacks with low overhead.

IA-DD: An SDN Topological Poisoning Attack Defense Scheme Based on Blockchain

Combination Attacks and Defenses on SDN Topology Discovery.

Design of a Blockchain-Based Trust Model for Detecting Cache Poisoning Attakcs in NDN

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Defending Against SDN Network Topology Poisoning Attacks

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

Novel Mitm Attacks On Security Protocols In Sdn: A Feasibility Study

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

SDNShield: Towards More Comprehensive Defense Against DDoS Attacks on SDN Control Plane

SDNShield: NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane.

SD-Anti-DDoS: Fast and efficient DDoS defense in software-defined networks

Manipulating OpenFlow Link Discovery Packet Forwarding for Topology Poisoning

When Match Fields Do Not Need to Match: Buffered Packets Hijacking in SDN

SDN-Defend: A Lightweight Online Attack Detection and Mitigation System for DDoS Attacks in SDN

TPAAD: Two‐phase authentication system for denial of service attack detection and mitigation using machine learning in software‐defined network

Blockchain-Based Control Plane Attack Detection Mechanisms for Multi-Controller Software-Defined Networks

DDoS Defense Mechanism Based on Software Defined Network

The DAG blockchain: A secure edge assisted honeypot for attack detection and multi-controller based load balancing in SDN 5G

Disrupting the SDN Control Channel Via Shared Links: Attacks and Countermeasures.

THP: A Novel Authentication Scheme to Prevent Multiple Attacks in SDN-Based IoT Network.

DoSDefender: A Kernel-Mode TCP DoS Prevention in Software-Defined Networking