A DDoS Attack Mitigation Scheme in ISP Networks Using Machine Learning Based on SDN

Abstract

Keeping Internet users protected from cyberattacks and other threats is one of the most prominent security challenges for network operators nowadays. Among other critical threats, distributed denial-of-service (DDoS) becomes one of the most widespread attacks in the Internet, which is very challenging to mitigate appropriately as DDoS attacks cause the system to stop working by resource exhaustion. Software-defined networking (SDN) has recently emerged as a new networking technology offering unprecedented programmability that allows network operators to configure and manage their infrastructures dynamically. The flexible processing and centralized management of the SDN controller allow flexibly deploying complex security algorithms and mitigation methods. In this paper, we propose a novel DDoS attack mitigation in SDN-based Internet Service Provider (ISP) networks for TCP-SYN and ICMP flood attacks utilizing machine learning approach, i.e., K-Nearest-Neighbor (KNN) and XGBoost. By deploying a testbed, we implement the proposed algorithms, evaluate their accuracy, and address the trade-off between the accuracy and mitigation efficiency. Through extensive experiments, the results show that the algorithms can efficiently mitigate the attack by over 98.0% while benign traffic is not affected.

Voting‐based intrusion detection framework for securing software‐defined networks

“…The main reason behind the selection of these metrics for performance evaluation is that they are popularly used in the literature to evaluate the performance of classification algorithms. 52,54,58,59 Moreover, our focus is on studying the effectiveness of classifiers in terms of their capability to detect attacks. Therefore, we have chosen precision, recall, and F-measure over false alarm rate (FAR).…”

“…The classifier with high accuracy and less false positive rate is selected for attack detection. Recently, a new DDoS mitigation system against flooding attacks in SDN was proposed by Tuan et al 54 In this system, k ‐NN and XGBoost are used as detection engines. The performance of the classifiers as a detection system is evaluated using CAIDA2007 dataset in terms of accuracy, precision, recall, and F‐measure.…”

“…Thus, to study the effectiveness of the proposed system we have used accuracy, precision, recall, and F‐measure as performance indicators. The main reason behind the selection of these metrics for performance evaluation is that they are popularly used in the literature to evaluate the performance of classification algorithms 52,54,58,59 . Moreover, our focus is on studying the effectiveness of classifiers in terms of their capability to detect attacks.…”

Voting based Intrusion Detection Framework for Securing Software-Defined Networks

“…An IDS is supposed to have high accuracy and high detection rate.Thus, to study the effectiveness of the proposed system we have used accuracy, precision, recall, and F-measure as performance indicators. The main reason behind the selection of these metrics for performance evaluation is that they are popularly used in the literature to evaluate the performance of classification algorithms 52,54,58,59 . Moreover, our focus is on studying the effectiveness of classifiers in terms of their capability to detect attacks.…”

“…The classifier with high accuracy and less false positive rate is selected for attack detection. Recently, a new DDoS mitigation system against flooding attacks in SDN was proposed by Tuan et al 54 . In this system, k-NN and XGBoost are used as detection engines.…”