An Effective Defense Against SYN Flooding Attack in SDN

Kim, DongHyuk; Dinh, Phuc Trinh; Noh, Sichul; Yi, Junmin; Park, Min‐Ho

doi:10.1109/ictc46691.2019.8939937

Cited by 8 publications

(7 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Blocking and discard classes are the simplest and fastest mitigation techniques that completely block possible sources of attack 12,30‐32 . This technique provides immediate mitigation to network resources.…”

Section: Background On Sdn and Ddos Syn Flooding Attacksmentioning

confidence: 99%

“…Although the solution is effective, blocking the switch port can penalize all legitimate flows linked to that port. Kim et al proposed to detect the attack using the mechanism TCP Time Out and Round Trip Time (RTT) 32 . The solution discards the first SYN packet from any host and estimates the holding time based on the time between the first and second SYN packets, removing the half‐open TCP sessions after the holding time.…”

Section: Related Workmentioning

confidence: 99%

“…The solution discards the first SYN packet from any host and estimates the holding time based on the time between the first and second SYN packets, removing the half‐open TCP sessions after the holding time. If the RTT of the ACK is less than the noted RTT, the ACK packet is forwarded to the server, otherwise is discarded by the solution 32 . Although the solution is effective, having a very short RTT can penalize legitimate hosts that have trouble completing a connection.…”

Section: Related Workmentioning

confidence: 99%

“…Blocking and discard classes are the simplest and fastest mitigation techniques that completely block possible sources of attack. 12,[30][31][32] This technique provides immediate mitigation to network resources. However, if a legitimate node (host) or port is compromised, it will be completely blocked, resulting in the discard of any legitimate traffic from such sources.…”

Section: Ddos Attack Mitigation Techniquesmentioning

confidence: 99%

See 3 more Smart Citations

DataPlane‐ML: An integrated attack detection and mitigation solution for software defined networks

Carvalho

Costa

Bordim

et al. 2022

Concurrency and Computation

View full text Add to dashboard Cite

Summary Software defined network (SDN) is a paradigm that emphasizes the separation of the control plane from the data plane, offering advantages such as flexibility and programmability. However, from a security perspective, SDN also introduces new vulnerabilities due to the communication required between these planes. SYN Flood attacks are typical distributed denial‐of‐service (DDoS) attacks that especially challenge network administrators since they produce a large volume of semi‐open TCP connections to a target, compromising its availability. Most of the current solutions to detect and mitigate these attacks are designed to operate at the control plane, imposing an additional overhead on controller functions. Moreover, traffic‐blocking mechanisms, a widely used alternative to protect network resources, have the drawback of restricting legitimate traffic. This work proposes DataPlane‐ML, an integrated solution to detect and mitigate DDoS attacks on SDN, acting directly in the data plane. DataPlane‐ML uses machine learning techniques for attack detection and a mitigation solution based on the node's reputation to avoid blocking legitimate traffic during an attack. Experimental results show that DataPlane‐ML is prefix≈26%$$ \approx 26\% $$ faster than statistical‐based solutions for attack detection while presenting better accuracy. Moreover, the DataPlane‐ML mitigation solution can preserve more than 95%$$ 95\% $$ of legitimate traffic during an attack.

show abstract

Section: Background On Sdn and Ddos Syn Flooding Attacksmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Ddos Attack Mitigation Techniquesmentioning

confidence: 99%

See 2 more Smart Citations

DataPlane‐ML: An integrated attack detection and mitigation solution for software defined networks

Carvalho

Costa

Bordim

et al. 2022

Concurrency and Computation

View full text Add to dashboard Cite

show abstract

“…DDoS attacks against the control layer require extraordinarily extensive botnet; the attack characteristics are relatively obvious with lower concealment [6][7][8]. By comparison, the DDoS attack on the data layer owns lower attack rate and more powerful concealment, which can be quite challenging to detect, getting focal point in recent research [9][10][11].…”

Section: Introductionmentioning

confidence: 99%

Cross-Plane DDoS Attack Defense Architecture Based on Flow Table Features in SDN

Yan

Zheng

2022

Security and Communication Networks

View full text Add to dashboard Cite

Software-Defined Networking (SDN) actualizes the separation of control and forwarding and innovates network functionalities with a logically centralized controller. Contemporary SDN infrastructure exposes the potential bottlenecks which are prone to engage in distributed denial of service attack (DDoS) thus posing an ever-increasing threat. This paper adopts the idea of “cross-plane collaboration” accomplishing DDoS attack defense and incorporates a two-phase project deploying the lightweight detection mechanism in data layer and the fine-grained filtering model in control layer. The coadjutant detection mechanism introduces a novel three-dimensional entropy consisting of five flow table features performing real-time feature detection; the defense strategy schedules an attack classification algorithm based on neural network by means of extracting four flow rule features designed to locate compromised interfaces occupied by malicious traffic. Extensive experiments are implemented to demonstrate the method we proposed brings excellent superiority. The detection rate of the classification filtering model is 99.4%, and it is real-time, with a detection time of 0.51s. In addition, the method of cross-layer defense reduces the CPU utilization of the controller.

show abstract

Mitigating TCP SYN flooding based EDOS attack in cloud computing environment using binomial distribution in SDN

Shah

Khan

Ahmad

2022

Computer Communications

View full text Add to dashboard Cite

An Effective Defense Against SYN Flooding Attack in SDN

Cited by 8 publications

References 3 publications

DataPlane‐ML: An integrated attack detection and mitigation solution for software defined networks

DataPlane‐ML: An integrated attack detection and mitigation solution for software defined networks

Cross-Plane DDoS Attack Defense Architecture Based on Flow Table Features in SDN

Mitigating TCP SYN flooding based EDOS attack in cloud computing environment using binomial distribution in SDN

Contact Info

Product

Resources

About