Abstract:Distributed Denial of Service Attack (DDoS) has emerged as a major threat to cyber space. A DDoS attack aims at exhausting the resources of the victim causing financial and reputational damages to it. The availability of free software make launching of DDoS attacks easy. The difficulty in differentiating a DDoS traffic from a legitimate traffic burst such as a flash crowd makes DDoS difficult to be identified. A wide range of techniques have been used in conventional networks to detect and mitigate DDoS attacks. Though the advent of Software Defined Networking (SDN) makes a network easy to be managed even SDN is vulnerable to DDoS attacks. In this case, the controller of the SDN gets overloaded with the incoming packets from the switches. In fact, a solution based on security analytics can be put in place to ward off this threat as a proactive security measure using the flow level statistics available from the SDN. Compared to the packet analysis used in traditional networks which is resource expensive the flow level statistics is relatively inexpensive. This paper focuses on the design and implementation of an attack detection system for detecting the flooding DDoS attacks TCP SYN flooding attacks, HTTP request flooding attacks, UDP flooding attacks and ICMP flooding attacks over SDN network traffic. The system uses various classification algorithms to classify a traffic into normal or attack. The feature sets for classification were arrived at using a feature selection module with ANOVA (Analysis of Variance) F-Test statistical method. Performance evaluation of each of the classifiers was carried out for the three feature sets obtained from the feature selection module using various performance measures and the results have been tabulated. The feature set which gives the best performance in detecting malicious traffic has been identified.

An elastic intrusion detection system for software networks

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Flow Table Saturation Attack Against Dynamic Timeout Mechanisms in SDN

Flow Anomaly Telemetry Driven by Programmable Data Plane

Flowfence: a denial of service defense system for software defined networking

FlowCloak: Defeating Middlebox-Bypass Attacks in Software-Defined Networking.

FloRa: Flow Table Low-Rate Overflow Reconnaissance and Detection in SDN

Detection and Mitigation of DoS Attacks in Software Defined Networks

Exploring Traffic Patterns Through Network Programmability: Introducing SDNFLow, a Comprehensive OpenFlow-Based Statistics Dataset for Attack Detection

Securing Middlebox Policy Enforcement in SDN

Exploiting the Vulnerability of Flow Table Overflow in Software-Defined Network: Attack Model, Evaluation, and Defense

SDN-Based Intrusion Detection System for Early Detection and Mitigation of DDoS Attacks

Towards Detecting Flooding DDOS Attacks Over Software Defined Networks Using Machine Learning Techniques

A Proactive Model for Intrusion Detection Using Image Representation of Network Flows

Network attack detection at flow level

Detecting and mitigating DDoS attacks with moving target defense approach based on automated flow classification in SDN networks

SDN-Assisted Network-Based Mitigation of Slow DDoS Attacks

Detection of Distributed Denial of Service Attacks Carried Out by Botnets in Software-Defined Networks

Research on Detection and Mitigation Methods of Adaptive Flow Table Overflow Attacks in Software-Defined Networks

Source-Based Defense Against DDoS Attacks in SDN Based on sFlow and SOM

A DoS Resilient Flow-level Intrusion Detection Approach for High-speed Networks