A New Machine Learning-based Collaborative DDoS Mitigation Mechanism in Software-Defined Network

Mohammed, Saif Saad; Hussain, Rasheed; Sen’ko, O. V.; Bimaganbetov, Bagdat; Lee, Jooyoung; Hussain, Fatima; Kerrache, Chaker Abdelaziz; Barka, Ezedin; Bhuiyan, Zakirul Alam

doi:10.1109/wimob.2018.8589104

Cited by 43 publications

(28 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…All others had accuracy between that of linear regression and naïve Bayes. In [10], the authors used Naïve Bayes. They had an average precision of 0.98 for training dataset with all features inclusive.…”

Section: Related Workmentioning

confidence: 99%

An Investigation into the Application of Deep Learning in the Detection and Mitigation of DDOS Attack on SDN Controllers

et al. 2021

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is a new paradigm that revolutionizes the idea of a software-driven network through the separation of control and data planes. It addresses the problems of traditional network architecture. Nevertheless, this brilliant architecture is exposed to several security threats, e.g., the distributed denial of service (DDoS) attack, which is hard to contain in such software-based networks. The concept of a centralized controller in SDN makes it a single point of attack as well as a single point of failure. In this paper, deep learning-based models, long-short term memory (LSTM) and convolutional neural network (CNN), are investigated. It illustrates their possibility and efficiency in being used in detecting and mitigating DDoS attack. The paper focuses on TCP, UDP, and ICMP flood attacks that target the controller. The performance of the models was evaluated based on the accuracy, recall, and true negative rate. We compared the performance of the deep learning models with classical machine learning models. We further provide details on the time taken to detect and mitigate the attack. Our results show that RNN LSTM is a viable deep learning algorithm that can be applied in the detection and mitigation of DDoS in the SDN controller. Our proposed model produced an accuracy of 89.63%, which outperformed linear-based models such as SVM (86.85%) and Naive Bayes (82.61%). Although KNN, which is a linear-based model, outperformed our proposed model (achieving an accuracy of 99.4%), our proposed model provides a good trade-off between precision and recall, which makes it suitable for DDoS classification. In addition, it was realized that the split ratio of the training and testing datasets can give different results in the performance of a deep learning algorithm used in a specific work. The model achieved the best performance when a split of 70/30 was used in comparison to 80/20 and 60/40 split ratios.

show abstract

Section: Related Workmentioning

confidence: 99%

An Investigation into the Application of Deep Learning in the Detection and Mitigation of DDOS Attack on SDN Controllers

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Recently, Hosseini and Azizi in [57] have used naive Bayes, random forests, decision trees, multilayer perceptron (MLP), and K-NN for detecting high-rate DDoS. Sreeram and Vuppala in [68] have used machine learning metrics and a bioinspired bat algorithm for HTTP flood attack detection, Meti et al in [58] have used machine learning algorithms (Support Vector Machine and Neural Network) for detection of high-rate DDoS attacks in SDNs, and Mohammed et al have proposed in [69] a machine learning-based collaborative DDoS mitigation mechanism for SDNs. Alrehan and Alhaidari have reviewed in [70] the use of machine learning techniques to detect DDoS attacks on Vehicular Ad hoc NETworks (VANETs), Wani et al have reported in [61] the use of machine learning algorithms (Support Vector Machine, Naive Bayes, and Random Forest) to detect high-rate DDoS attacks on a cloud environment, Hou et al have reported in [71] the detection of high-rate DDos attacks through NetFlow analysis using Random Forest, and Aamir and Zaidi in [60] have used K-NN, Support Vector Machine and Random Forest algorithms for high-rate DDoS classification.…”

Section: Use Of Machine Learning Algorithms and Fuzzy Logic For Detection Of Ddos Attacksmentioning

confidence: 99%

Detection of reduction-of-quality DDoS attacks using Fuzzy Logic and machine learning algorithms

et al. 2021

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks are still among the most dangerous attacks on the Internet. With the advance of methods for detecting and mitigating these attacks, crackers have improved their skills in creating new DDoS attack types with the aim of mimicking normal traffic behaviour therefore becoming silently powerful. Among these advanced DDoS attack types, the so-called lowrate DoS attacks aim at keeping a low level of network traffic. In this paper, we study one of these techniques, called Reduction of Quality (RoQ) attack. To investigate the detection of this type of attack, we evaluate and compare the use of four machine learning algorithms: Multi-Layer Perceptron (MLP) neural network with backpropagation, K-Nearest Neighbors (K-NN), Support Vector Machine (SVM) and Multinomial Naive Bayes (MNB). We also propose an approach for detecting this kind of attack based on three methods: Fuzzy Logic (FL), MLP and Euclidean Distance (ED). We evaluate and compare the approach based on FL, MLP and ED to the above machine learning algorithms using both emulated and real traffic traces. We show that among the four Machine Learning algorithms, the best classification results are obtained with MLP, which, for emulated traffic, leads to a F1-score of 98.04% for attack traffic and 99.30% for legitimate traffic, while, for real traffic, it leads to a F1-score of 99.87% for attack traffic and 99.95% for legitimate traffic. Regarding the approach using FL, MLP and EC, for classification of emulated traffic, we obtained a F1-score of 98.80% for attack traffic and 99.60% for legitimate traffic, while, for real traffic, we obtained a F1-score of 100% for attack traffic and 100% for legitimate traffic. However, the better performance of the approach based on FL, MLP and ED is obtained at the cost of larger execution time, since MLP required 0.74 ms and 0.87ms for classification of the emulated and real traffic datasets, respectively, where as the approach using FL, MLP and ED required 11'46" and 46'48" to classify the emulated and real traffic datasets, respectively.

show abstract

“…The method would alleviate the impact of the DDoS attack on the weak point and trace back to the bots utilized by the attacker to run the attack however the personality of the first attack may, in any case, stay hidden. Saif Saad Mohammed et al [117] create a model for DDoS detection in SDN using NSL-KDD dataset and train the model. Results show the proposed the model can improve the performance and accuracy for DDoS detection.…”

Section: A Mitigating Ddos Attack In Sdnmentioning

confidence: 99%

A Survey on Distributed Denial of Service (DDoS) Attacks in SDN and Cloud Computing Environments

2019

View full text Add to dashboard Cite

Recently, software defined networks (SDNs) and cloud computing have been widely adopted by researchers and industry. However, widespread acceptance of these novel networking paradigms has been hampered by the security threats. Advances in the processing technologies have helped attackers in increasing the attacks too, for instance, the development of Denial of Service (DoS) attacks to distributed DoS (DDoS) attacks which are seldom identified by conventional firewalls. In this paper, we present the state of art of the DDoS attacks in SDN and cloud computing scenarios. Especially, we focus on the analysis of SDN and cloud computing architecture. Besides, we also overview the research works and open problems in identifying and tackling the DDoS attacks. INDEX TERMS Software defined network, cloud computing, distributed denial of service attacks (DDoS), DDoS attack and detection, experimental setup, survey.

show abstract

A New Machine Learning-based Collaborative DDoS Mitigation Mechanism in Software-Defined Network

Cited by 43 publications

References 12 publications

An Investigation into the Application of Deep Learning in the Detection and Mitigation of DDOS Attack on SDN Controllers

An Investigation into the Application of Deep Learning in the Detection and Mitigation of DDOS Attack on SDN Controllers

Detection of reduction-of-quality DDoS attacks using Fuzzy Logic and machine learning algorithms

A Survey on Distributed Denial of Service (DDoS) Attacks in SDN and Cloud Computing Environments

Contact Info

Product

Resources

About