An Efficient IDS Framework for DDoS Attacks in SDN Environment

Varghese, Josy Elsa; Muniyal, Balachandra

doi:10.1109/access.2021.3078065

Cited by 49 publications

(18 citation statements)

References 61 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [10], Eslamnezhad et al (2014) proposed novel IDSs based on MinMax KMCs to overcome starting center issues in KMCs and improving clustering quality. Their experimentations on NSL-KDD data set showed that their approach was more efficient than KMCs.…”

Section: Related Workmentioning

confidence: 99%

Adaptive Learning Based Whale Optimization and Convolutional Neural Network Algorithm for Distributed Denial of Service Attack Detection in Software Defined Network Environment

Shyamala

Saraswathi³

2022

IJRITCC

View full text Add to dashboard Cite

SDNs (Software Defined Networks) have emerged as a game-changing network concept. It can fulfill the ever-increasing needs of future networks and is increasingly being employed in data centres and operator networks. It does, however, confront certain fundamental security concerns, such as DDoS (Distributed Denial of Service) assaults. To address the aforementioned concerns, the ALWO+CNN method, which combines ALWOs (Adaptive Learning based Whale Optimizations) with CNNs (Convolution Neural Networks), is suggested in this paper. Initially, preprocessing is performed using the KMC (K-Means Clustering) algorithm, which is used to significantly reduce noise data. The preprocessed data is then used in the feature selection process, which is carried out by ALWOs. Its purpose is to pick out important and superfluous characteristics from the dataset. It enhances DDoS classification accuracy by using the best algorithms. The selected characteristics are then used in the classification step, where CNNs are used to identify and categorize DDoS assaults efficiently. Finally, the ALWO+CNN algorithm is used to leverage the rate and asymmetry properties of the flows in order to detect suspicious flows specified by the detection trigger mechanism. The controller will next take the necessary steps to defend against DDoS assaults. The ALWO+CNN algorithm greatly improves detection accuracy and efficiency, as well as preventing DDoS assaults on SDNs. Based on the experimental results, it was determined that the suggested ALWO+CNN method outperforms current algorithms in terms of better accuracies, precisions, recalls, f-measures, and computational complexities.

show abstract

Section: Related Workmentioning

confidence: 99%

Adaptive Learning Based Whale Optimization and Convolutional Neural Network Algorithm for Distributed Denial of Service Attack Detection in Software Defined Network Environment

Shyamala

Saraswathi³

2022

IJRITCC

View full text Add to dashboard Cite

show abstract

“…But it needed to reduce false positive rate and switch buffer utilisation. According to Varghese et al, their proposed method was the first Data Plane Development Kit (DPDK) based DDoS defence framework built on single feature anomaly detection in SDN [11]. Instead of using an OVS switch, here DPDK-OVS switches were used.…”

Section: Related Work S Shin Et Al Developedmentioning

confidence: 99%

DDoSMitigator: An On-The-Fly Method of Mitigating Denial of Service Attack in Software Defined Networking

Sreejesh¹

2022

IJRASET

View full text Add to dashboard Cite

Started in the early 2000s, the Software Defined Networking (SDN) paradigm has become the backbone for various network based technologies. It has the advantage of being simple to manage and easy to add new features to the network. In comparison to legacy hardware-based networks, scalability, performance, and maintainability become more advanced. However, hackers are more likely to target the SDN, putting the entire network at risk. Denial of Service is a common example of such a threat. It is feasible to reduce such attacks by carefully planning and building the SDN controller as well as the network applications that administer the SDN. This paper presents a novel and efficient method applicable to various types of protocol based Distributed Denial of Service (DDoS) attacks in SDN/OpenFlow networks. It can be used to detect and mitigate Transmission Control Protocol (TCP) SYN attacks, Internet Control Message Protocol (ICMP) ping flood attacks and User Datagram Protocol (UDP) flood attacks that happen against the SDN devices and/or any host. This feature stands above the controller and conforms to the OpenFlow policy without leveraging additional devices. All the detection and mitigation are done based on a True Host list which is created by tracking the Address Resolution Protocol (ARP) requests and replies from hosts. As ARP protocol is necessarily used by all hosts, this method can be effectively utilised for true host list creation and further attack detection and mitigation

show abstract

“…The authors [12] propose a lightweight approach to detect DDoS attacks aimed at resource-constrained environments such as IoT and shows that their lightweight random forest technique can achieve as high as 99% of detection accuracy. Varghese et al [13] proposed a statistical anomaly detection algorithm implemented in the data plane of Software Defined Network (SDN) to detect DDoS attacks near real-time as a part of an Intrusion Detection System (IDS). Pontes et al [14] propose an Energy-based Flow Classifier (EFC) which utilizes inverse statistics to infer anomaly scores base on labeled benign examples.…”

Section: A Machine Learning Based Approachesmentioning

confidence: 99%

“…[22], [23]. Many state-of-the-VOLUME 4, 2016 [6] KNN, NB, RF, SVM IDS 98.86 ≈ 99.54 (Accuracy) CICDDoS2017 Ullah et al [7] NB, LR, DT, RF IoT 99.99 ≈ 100 (F1-score) IoT Botnet Gohil et al [8] DT, NB, LR, SVM, KNN IDS 97.72 ≈ 99.99 (Accuracy) CICDDoS2019 Alamri et al [9] XGBoost SDN 99.9 (Accuracy) CICDDoS2019 Khoei et al [10] Stacking, Bagging, Boosting Smart Grid 92.2 ≈ 93.4 (Accuracy) CICDDoS2019 Parfenov et al [11] Gradient Boosting IDS 96.8 (F1-score) CICDDoS2019 Parfenov et al [11] CatBoost IDS 96.9 (F1-score) CICDDoS2019 Sanchez et al [12] Random Forest IoT 99.97 (Accuracy) CICDDoS2019 Varghese et al [13] D3 SDN 84.54 (Accuracy) CICDDoS2019 Pontes et al [14] EFC IDS 97.5 (F1-score) CICDDoS2019…”

Section: Introductionmentioning

confidence: 99%

AE-MLP: A Hybrid Deep Learning Approach for DDoS Detection and Classification

Wei¹,

Jang-Jaccard

Sabrina

et al. 2021

IEEE Access

View full text Add to dashboard Cite

Distributed Denial-of-Service (DDoS) attacks are increasing as the demand for Internet connectivity massively grows in recent years. Conventional shallow machine learning-based techniques for DDoS attack classification tend to be ineffective when the volume and features of network traffic, potentially carry malicious DDoS payloads, increase exponentially as they cannot extract high importance features automatically. To address this concern, we propose a hybrid approach named AE-MLP that combines two deep learning-based models for effective DDoS attack detection and classification. The Autoencoder (AE) part of our proposed model provides an effective feature extraction that finds the most relevant feature sets automatically without human intervention (e.g., knowledge of cybersecurity professionals). The Multilayer Perceptron Network (MLP) part of our proposed model uses the compressed and reduced feature sets produced by the AE as inputs and classifies the attacks into different DDoS attack types to overcome the performance overhead and bias associated with processing large feature sets with noise (i.e., unnecessary feature values). Our experimental results, obtained through comprehensive and extensive experiments on different aspects of performance on the CICDDoS2019 dataset, demonstrate both a very high and robust accuracy rate and F1-score that exceed 98% which also outperformed the performance of many similar methods. This shows that our proposed model can be used as an effective DDoS defense tool against the growing number of DDoS attacks.

show abstract

An Efficient IDS Framework for DDoS Attacks in SDN Environment

Cited by 49 publications

References 61 publications

Adaptive Learning Based Whale Optimization and Convolutional Neural Network Algorithm for Distributed Denial of Service Attack Detection in Software Defined Network Environment

Adaptive Learning Based Whale Optimization and Convolutional Neural Network Algorithm for Distributed Denial of Service Attack Detection in Software Defined Network Environment

DDoSMitigator: An On-The-Fly Method of Mitigating Denial of Service Attack in Software Defined Networking

AE-MLP: A Hybrid Deep Learning Approach for DDoS Detection and Classification

Contact Info

Product

Resources

About