Abstract:Distributed Denial of Service (DDoS) attack is one of the most severe threats to the current network security. As a new network architecture, Software-Defined Networking (SDN) draws notable attention from both industry and academia. The characteristics of SDN such as centralized management and flow-based traffic monitoring make it an ideal platform to defend against DDoS attacks. When designing a network intrusion detection system (NIDS) in SDN, how to obtain fine-grained flow information with minimal overhead to the SDN architecture is a problem to be solved. In this paper, we propose TPDD, a two-phase DDoS detection system to detect DDoS attacks in SDN. In the first phase, we utilize the characteristics of SDN to collect coarse-grained flow information from the core switches and locate the potential victim. Then we monitor the edge switches located close to the potential victim to obtain finer-grained traffic information in the second phase. The collection method of each phase fully considers the impact on the bandwidth between the controller and switches. Without modifying the existing flow rules, the collection module can obtain sufficient information about traffic. By using entropy-based and machine learning-based methods, the detection module can effectively detect anomalies and identify whether the potential victim marked in the first phase is the target of attacks. Experimental results show that TPDD can effectively detect DDoS attacks with little overhead.

JESS: Joint Entropy-Based DDoS Defense Scheme in SDN

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

A hybrid method of entropy and SSAE-SVM based DDoS detection and mitigation mechanism in SDN

SDN-Defend: A Lightweight Online Attack Detection and Mitigation System for DDoS Attacks in SDN

An entropy and machine learning based approach for DDoS attacks detection in software defined networks

A DDoS attack detection and defense scheme using time-series analysis for SDN

SDNShield: Towards More Comprehensive Defense Against DDoS Attacks on SDN Control Plane

SD-Anti-DDoS: Fast and efficient DDoS defense in software-defined networks

Collaborative detection and mitigation of DDoS in software-defined networks

DDoS Detection Using a Cloud-Edge Collaboration Method Based on Entropy-Measuring SOM and KD-Tree in SDN

Synchronizing DDoS detection and mitigation based graph learning with programmable data plane, SDN

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

Lightweight Statistical Approach towards TCP SYN Flood DDoS Attack Detection and Mitigation in SDN Environment

DDoS attack detection in software defined networking controller using machine learning techniques

SDNShield: NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane.

Overview of DDoS Attack Detection in Software-Defined Networks

Defense mechanisms against DDoS attack based on entropy in SDN-cloud using POX controller

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

Efficient Distributed Denial-of-Service Attack Defense in SDN-Based Cloud

A Deep Learning Based DDoS Detection System in Software-Defined Networking (SDN)