A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

Abstract

Software defined networking (SDN) improves the flexibility and programmability of the network by separating the control plane and the data plane and effectively realizes the global control of the network infrastructure. However, the centralized structure design of SDN exposes the controller to potential threats. Attackers have used the active flow table delivery mode to launch distributed denial of service (DDoS) attacks on the SDN controller, resulting in the controller failure and seriously affecting the network performance. To overcome this problem, this paper proposes a defense framework called CC-Guard. The framework consists of four modules: attack detection triggering, switch migration, anomaly detection, and mitigation. Among them, the attack detection trigger module improves the system’s timely response to DDoS attacks. The switch migration module effectively unclogs the controller congestion problem and provides convenience for network flow transmission. The anomaly detection module uses a coarse-grained method for two-stage detection, which improves the detection accuracy. The mitigation module uses the idea of cross-domain cooperation of the controller to clear the abnormal flow in the blacklist. Experimental results show that our proposed CC-Guard has real-time DDoS attack defense capability and high detection accuracy, as well as efficient network resource utilization.

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

“…Traditional machine learning SVM [31][32][33][34][35] Decision Tree [36][37][38] KNN [38][39][40][41] Naive Bayes [38,[42][43][44] Random Forest [36][37][38] Deep learning SOM [41,45,46] ANN [47][48][49] LSTM [48][49][50] DNN [51][52][53] RNN [50,53] The SVM algorithm is a binary classification model utilized for distinguishing between normal and abnormal data in the context of DDoS attack detection based on traffic characteristics. Based on the traffic characteristics observed in the SDN network environment, the SVM detection algorithm is employed to gather input feature vectors in order to develop an algorithm for detecting malicious behavior within the network.…”