An Evolutionary SVM Model for DDOS Attack Detection in Software Defined Networks

Abstract

Software-Defined Network (SDN) has become a promising network architecture in current days that provide network operators more control over the network infrastructure. The controller, also called as the operating system of the SDN, is responsible for running various network applications and maintaining several network services and functionalities. Despite all its capabilities, the introduction of various architectural entities of SDN poses many security threats and potential targets. Distributed Denial of Services (DDoS) is a rapidly growing attack that poses a tremendous threat to the Internet. As the control layer is vulnerable to DDoS attacks, the goal of this paper is to detect the attack traffic, by taking the centralized control aspect of SDN. Nowadays, in the field of SDN, various machine learning (ML) techniques are being deployed for detecting malicious traffic. Despite these works, choosing the relevant features and accurate classifiers for attack detection is an open question. For better detection accuracy, in this work, Support Vector Machine (SVM) is assisted by kernel principal component analysis (KPCA) with genetic algorithm (GA). In the proposed SVM model, KPCA is used for reducing the dimension of feature vectors, and GA is used for optimizing different SVM parameters. In order to reduce the noise caused by feature differences, an improved kernel function (N-RBF) is proposed. The experimental results show that compared to single-SVM, the proposed model achieves more accurate classification with better generalization. Moreover, the proposed model can be embedded within the controller to define security rules to prevent possible attacks by the attackers.

Machine Learning Approaches for Combating Distributed Denial of Service Attacks in Modern Networking Environments

“…However, the authors must validate their approach with recent real traffic datasets. Sahoo et al [135] proposed a detection mechanism that employs SVM as the learning algorithm for malicious traffic classification. The model used kernel principal component analysis (KPCA) during the feature extraction phase and utilized a genetic algorithm (GA) for optimizing different settings of the SVM classifier.…”

Deep learning for load balancing of SDN‐based data center networks

“…SDN is a real revolution in the world of network 4,12,24,25 . Traditional network devices contain both control and data planes.…”

Bandwidth Control Mechanism and Extreme Gradient Boosting Algorithm for Protecting Software-Defined Networks Against DDoS Attacks

“…It can be observed that the traffic flow exceeded the threshold multiple times, which results in dropping the packet due to the proposed bandwidth control mechanism. The single profile-based threshold was calculated on the whole features set (time and byte rate) using equation (4). Consequently, the threshold adaptivity that considers the traffic rate variation over time was not achieved.…”

“…SDN is an emerging network architecture that decouples the network control plane from the data (forwarding) plane [4]. The control plane is centralized as a software control logic implemented in a controller, while the forwarding plane remains on the forwarding devices for forwarding traffic [5].…”