A Comprehensive Review on Detection of DDoS Attacks using ML in SDN Environment

Gupta, Shaveta; Grover, Dinesh

doi:10.1109/icais50930.2021.9395987

Cited by 8 publications

(4 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…ML can be used in data planes to develop new and effec- tive intrusion detection systems (IDSs) and denial-of-service (DoS) attack mitigation techniques [88]. ML-based IDSs can be trained by using traditional rule-based systems to identify malicious traffic patterns that are difficult to detect [89].…”

Section: A Machine Learning-based Approaches In Sdn Networkmentioning

confidence: 99%

Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI, and MTD Approaches to Security Solutions

Abdi,

Audah,

Salh

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is a groundbreaking technology that has transformed network management significantly. By integrating data and control, SDN offers unparalleled flexibility and responsiveness, thereby overcoming the limitations of conventional network architectures. However, a centralized controller, which is a hallmark of SDN, is a double-edged security sword that offers easy control. This also becomes a dangerous point of failure for the entire network. To the best of our knowledge, this is the first comprehensive study to explore traditional-based, artificial intelligence (AI)-based, and moving target defense (MTD) approaches to securing SDN. The study begins with a survey of traditional security solutions for SDN, encompassing authentication, authorization, encryption, security protocols, firewalls, and flow verification, by addressing security threats and vulnerabilities in both data and control planes. The study then investigates the application of AI-based security solutions in an SDN environment, focusing on how Machine Learning (ML) and Deep Learning (DL) techniques are leveraged to address advanced security threats. Additionally, the survey examines MTD mechanisms within data and control plane security. Several in-depth techniques, including the randomization of Internet Protocol (IP) and Media Access Control (MAC) addresses, port numbers, and flow tables, and delving into the relationship between security threats, MTD strategies, and the specific controllers employed in experimental implementations. We utilized the widely recognized STRIDE cybersecurity framework to systematically identify and evaluate the potential threats to SDN security. Our analysis resulted in a comprehensive list of security challenges, and we propose future research directions aimed at addressing emerging threats in both the data and control planes.

show abstract

Section: A Machine Learning-based Approaches In Sdn Networkmentioning

confidence: 99%

Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI, and MTD Approaches to Security Solutions

Abdi,

Audah,

Salh

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…A real-time mitigation approach toward DDoS attacks is presented in [22], which uses the Flow mitigation technique by analyzing the network traffic and rules. A Convolution Neural Network with Long Short-Term Memory (CNN-LSTM) based approach is presented in [23] to support SDN networks. An RF algorithm-based early detection scheme is presented in [24], which uses flow features and rules to support the detection of DDoS attacks.…”

Section: Related Workmentioning

confidence: 99%

RMCARTAM For DDoS Attack Mitigation in SDN Using Machine Learning

Revathi¹,

Ramalingam²,

Amutha³

2023

Computer Systems Science and Engineering

View full text Add to dashboard Cite

The impact of a Distributed Denial of Service (DDoS) attack on Software Defined Networks (SDN) is briefly analyzed. Many approaches to detecting DDoS attacks exist, varying on the feature being considered and the method used. Still, the methods have a deficiency in the performance of detecting DDoS attacks and mitigating them. To improve the performance of SDN, an efficient Real-time Multi-Constrained Adaptive Replication and Traffic Approximation Model (RMCARTAM) is sketched in this article. The RMCARTAM considers different parameters or constraints in running different controllers responsible for handling incoming packets. The model is designed with multiple controllers to handle network traffic but can turn the controllers according to requirements. The multi-constraint adaptive replication model monitors different features of network traffic like rate of packet reception, class-based packet reception and target-specific reception. According to these features, the method estimates the Replication Turning Weight (RTW) based on which triggering controllers are performed. Similarly, the method applies Traffic Approximation (TA) in the detection of DDoS attacks. The detection of a DDoS attack is performed by approximating the incoming traffic to any service and using various features like hop count, payload, service frequency, and malformed frequency to compute various support measures on bandwidth access, data support, frequency support, malformed support, route support, and so on. Using all these support measures, the method computes the value of legitimate weight to conclude the behavior of any source in identifying the malicious node. Identified node details are used in the mitigation of DDoS attacks. The method stimulates the network performance by reducing the power factor by switching the controller according to different factors, which also reduces the cost. In the same way, the proposed model improves the accuracy of detecting DDoS attacks by estimating the features of incoming traffic in different corners.

show abstract

“…16 We initially select two datasets: the "DDoS attack SDN" 17 and the "SDN-DDOS-TCP-SYN". 18 Let's call Din 1 the dataset "DDoS attack SDN" and Din 2 the dataset "SDN-DDOS-TCP-SYN." We attempt to evaluate the quality of each one and choose the most appropriate.…”

Section: Data Quality Assessmentmentioning

confidence: 99%

“…Particularly, we focus on four important types of DDoS (see

P

): LAND, ICMP flood, UDP flood, and TCP syn, that have a dangerous impact on SDN 16 . We initially select two datasets: the “DDoS attack SDN” 17 and the “SDN‐DDOS‐TCP‐SYN” 18 . Let's call

Di{n}_1

the dataset “DDoS attack SDN” and

Di{n}_2

the dataset “SDN‐DDOS‐TCP‐SYN.” We attempt to evaluate the quality of each one and choose the most appropriate.…”

Section: Experimental Studymentioning

confidence: 99%

Risk based intrusion detection system in software defined networking

Chetouane,

Karoui

2023

Concurrency and Computation

View full text Add to dashboard Cite

SummarySoftware defined networking (SDN) separates control from data operations. However, this technology adds a new security cost to the network architecture because of the ongoing and developing security vulnerabilities. An intrusion detection system must be continuously improved and integrated into the SDN architecture in order to provide a network defense against attacks. In this study, we propose a continual learning system based on risk assessment to detect intrusion in SDN. We suggest a technique for continually enhancing datasets to produce a more accurate prediction. The proposed system includes various processes, including risk assessment and the selection of the deep learning (DL) approach. We propose assessing the risks related to different intrusion types. Based on the risk value, we can identify which intrusion types are more important and have a dangerous impact. We use the risk values to choose the most appropriate DL approach and for the dataset's continual enrichment. We compare different DL methods using the standard metrics and two proposed metrics. Then, we propose to use a method based on the bit alternation approach to obtain a unique metric for decision‐making. Finally, we have studied the efficacy of our system using two case studies.

show abstract

A Comprehensive Review on Detection of DDoS Attacks using ML in SDN Environment

Cited by 8 publications

References 16 publications

Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI, and MTD Approaches to Security Solutions

Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI, and MTD Approaches to Security Solutions

RMCARTAM For DDoS Attack Mitigation in SDN Using Machine Learning

Risk based intrusion detection system in software defined networking

Contact Info

Product

Resources

About