An Adaptive Profile-Based Approach for Detecting Anomalous Traffic in Backbone

Zang, Xiaodong; Gong, Jian; Hu, Xiaoyan

doi:10.1109/access.2019.2914303

Cited by 9 publications

(4 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Zang et al [9] started from the flow features and proposed a finer-grained and more comprehensive flow index set. The author extracted 9 single attributes and 39 dual attributes from multiple dimensions such as time, space, category and intensity to form the IP address traffic behavior features spectrum.…”

Section: A Researches On Ddos Detection and Defense Methodsmentioning

confidence: 99%

A New Framework for DDoS Attack Detection and Defense in SDN Environment

et al. 2020

View full text Add to dashboard Cite

While software defined network (SDN) brings more innovation to the development of future networks, it also faces a more severe threat from DDoS attacks. In order to deal with the single point of failure on SDN controller caused by DDoS attacks, we propose a framework for detection and defense of DDoS attacks in the SDN environment. Firstly, we deploy a trigger mechanism of DDoS attack detection on data plane to screen for abnormal flows in the network. Then, we use a combined machine learning algorithm based on K-Means and KNN to exploit the rate characteristics and asymmetry characteristics of the flows and to detect the suspicious flows determined by the detection trigger mechanism. Finally, the controller will take corresponding actions to defense against the attacks. In this paper, we propose a new framework of cooperative detection methods of control plane and data plane, which effectively improve the detection accuracy and efficiency, and prevent DDoS attacks on SDN. INDEX TERMS Software Defined Network, Distributed Denial of Service (DDoS), collaborative detection, traffic characteristics, detection trigger.

show abstract

Section: A Researches On Ddos Detection and Defense Methodsmentioning

confidence: 99%

A New Framework for DDoS Attack Detection and Defense in SDN Environment

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Xiao-Dong Zang et al [19] proposed a comprehensive metric set to characterize IP traffic behavior: temporal, spatial, category, and intensity. The author proposed an ant colony optimization (ACO) based traffic profile for normal traffic and an updating strategy to reduce the false positive ratio.…”

Section: Related Workmentioning

confidence: 99%

Low Rate DDoS Detection Using Weighted Federated Learning in SDN Control Plane in IoT Network

et al. 2023

View full text Add to dashboard Cite

The Internet of things (IoT) has opened new dimensions of novel services and computing power for modern living standards by introducing innovative and smart solutions. Due to the extensive usage of these services, IoT has spanned numerous devices and communication entities, which makes the management of the network a complex challenge. Hence it is urgently needed to redefine the management of the IoT network. Software-defined networking (SDN) intrinsic programmability and centralization features simplify network management, facilitate network abstraction, ease network evolution, has the potential to manage the IoT network. SDN’s centralized control plane promotes efficient network resource management by separating the control and data plane and providing a global picture of the underlying network topology. Apart from the inherent benefits, the centralized SDN architecture also brings serious security threats such as spoofing, sniffing, brute force, API exploitation, and denial of service, and requires significant attention to guarantee a secured network. Among these security threats, Distributed Denial of Service (DDoS) and its variant Low-Rate DDoS (LR-DDoS), is one of the most challenging as the fraudulent user generates malicious traffic at a low rate which is extremely difficult to detect and defend. Machine Learning (ML), especially Federated Learning (FL), has shown remarkable success in detecting and defending against such attacks. In this paper, we adopted Weighted Federated Learning (WFL) to detect Low-Rate DDoS (LR-DDoS) attacks. The extensive MATLAB experimentation and evaluation revealed that the proposed work ignites the LR-DDoS detection accuracy compared with the individual Neural Networks (ANN) training algorithms, existing packet analysis-based, and machine learning approaches.

show abstract

“…The trigger mechanism applied on the controller's control plane effectively attacks but increases the controller's workload. Zang et al [29] proposed a finer-grained method that uses the flow features to detect an attack. It extracts the 39 different traffic features from the flow and improves the detection accuracy.…”

Section: Related Researchmentioning

confidence: 99%

DDoS Detection in SDN using Machine Learning Techniques

Kumar¹,

Sastry²,

Marriboyina³

et al. 2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Software-defined network (SDN) becomes a new revolutionary paradigm in networks because it provides more control and network operation over a network infrastructure. The SDN controller is considered as the operating system of the SDN based network infrastructure, and it is responsible for executing the different network applications and maintaining the network services and functionalities. Despite all its tremendous capabilities, the SDN face many security issues due to the complexity of the SDN architecture. Distributed denial of services (DDoS) is a common attack on SDN due to its centralized architecture, especially at the control layer of the SDN that has a network-wide impact. Machine learning is now widely used for fast detection of these attacks. In this paper, some important feature selection methods for machine learning on DDoS detection are evaluated. The selection of optimal features reflects the classification accuracy of the machine learning techniques and the performance of the SDN controller. A comparative analysis of feature selection and machine learning classifiers is also derived to detect SDN attacks. The experimental results show that the Random forest (RF) classifier trains the more accurate model with 99.97% accuracy using features subset by the Recursive feature elimination (RFE) method.

show abstract

An Adaptive Profile-Based Approach for Detecting Anomalous Traffic in Backbone

Cited by 9 publications

References 41 publications

A New Framework for DDoS Attack Detection and Defense in SDN Environment

A New Framework for DDoS Attack Detection and Defense in SDN Environment

Low Rate DDoS Detection Using Weighted Federated Learning in SDN Control Plane in IoT Network

DDoS Detection in SDN using Machine Learning Techniques

Contact Info

Product

Resources

About