DDoS attack protection in the era of cloud computing and Software-Defined Networking

Wang, Bing; Zheng, Yao; Lou, Wenjing; Hou, Yu

doi:10.1016/j.comnet.2015.02.026

Cited by 316 publications

(91 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The middle-boxes can provide high DDoS attack detection performance. However, due to various interfaces provided by them, different middle-boxes seldom share information, causing them and network operators to lack holistic view of DDoS attacks [20]. Mahimkar et al in [19] proposed a method to deploy middleboxes dynamically in the protected network, but without the global perspective of a network, where deploying them could be a nerve-racking problem.…”

Section: Middle-boxes Based Defensementioning

confidence: 99%

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

Han

Yang

Sun

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks are one of the biggest concerns for security professionals. Traditional middle-box based DDoS attack defense is lack of network-wide monitoring flexibility. With the development of software-defined networking (SDN), it becomes prevalent to exploit centralized controllers to defend against DDoS attacks. However, current solutions suffer with serious southbound communication overhead and detection delay. In this paper, we propose a cross-plane DDoS attack defense framework in SDN, called OverWatch, which exploits collaborative intelligence between data plane and control plane with high defense efficiency. Attack detection and reaction are two key procedures of the proposed framework. We develop a collaborative DDoS attack detection mechanism, which consists of a coarse-grained flow monitoring algorithm on the data plane and a finegrained machine learning based attack classification algorithm on the control plane. We propose a novel defense strategy offloading mechanism to dynamically deploy defense applications across the controller and switches, by which rapid attack reaction and accurate botnet location can be achieved. We conduct extensive experiments on a real-world SDN network. Experimental results validate the efficiency of our proposed OverWatch framework with high detection accuracy and real-time DDoS attack reaction, as well as reduced communication overhead on SDN southbound interface.

show abstract

Section: Middle-boxes Based Defensementioning

confidence: 99%

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

Han

Yang

Sun

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…The experimental study showed that the growing of network topology will lead to an increase in the attack detection rate. Wang et al [9] proposed a graphical probabilistic inference model with an updating phase in order to cope with dataset shift problem which appears when the network traffic conditions differ from the actual conditions. Taekyoung and Yanghee [10] employed a content-oriented networking architecture in which each access router is called an "agent".…”

Section: Introductionmentioning

confidence: 99%

A novel intelligent approach for detecting DoS flooding attacks in software-defined networks

Latah

Toker

2018

Int. J. Adv. Intell. Informatics

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is an emerging networking paradigm that provides an advanced programming capability and moves the control functionality to a centralized controller. This paper proposes a two-stage novel intelligent approach that takes advantage of the SDN approach to detect Denial of Service (DoS) flooding attacks based on calculation of packet rate as the first step and followed by Support Vector Machine (SVM) classification as the second step. Flow concept is an essential idea in OpenFlow protocol, which represents a common interface between an SDN switch and an SDN controller. Therefore, our system calculates the packet rate of each flow based on flow statistics obtained by SDN controller. Once the packet rate exceeds a predefined threshold, the system will activate the packet inspection unit, which, in turn, will use the (SVM) algorithm to classify the previously collected packets. The experimental results showed that our system was able to detect DoS flooding attacks with 96.25% accuracy and 0.26% false alarm rate.

show abstract

“…Incidents of attacks over the Internet especially DDOS attacks [1] are increasing day by day. News are dominated by successful DDOS attacks against a number of major Fortune 100 organizations in this arena.…”

Section: Introductionmentioning

confidence: 99%

“…Centralized collection of activities through every phase of the disruptive activity like DDOS attack [1] process can identify and alert on suspicious patterns and stop it in its tracks, even where evasive techniques such as geographical dispersion and Internet service provider (ISP) switching are employed. The purpose of the DDOS attack [3] is normally about breaking the business continuity.…”

Section: Introductionmentioning

confidence: 99%

An Adaptive Approach to Mitigate Ddos Attacks in Cloud

Singh¹,

Panda²

2015

ijacsa

View full text Add to dashboard Cite

Abstract-Distributed denial of service (DDOS) attack constitutes one of the prominent cyber threats and among the hardest security problems in modern cyber world. This research work focuses on reviewing DDOS detection techniques and developing a numeric stable theoretical framework used for detecting various DDOS attacks in cloud. Main sections in the paper are devoted to review and analysis of algorithms used for detection of DDOS attacks. The framework theorized here deals with the variability calculation method in conjunction with sampling, searching methods to find a current state of a particular parameter under observation for detecting DDOS attacks. This way a solution is to build that measure the performance and conduct the monitoring framework to capture adversity related to DDOS attacks. The described algorithm intends to capture the current context value of the parameters that determine the reliability of the detection algorithm and the online pass algorithm helps to maintain the variability of those collected values thus maintaining numerical stability by doing robust statistical operations at endpoints of traffic in cloud based network.

show abstract

DDoS attack protection in the era of cloud computing and Software-Defined Networking

Cited by 316 publications

References 15 publications

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

A novel intelligent approach for detecting DoS flooding attacks in software-defined networks

An Adaptive Approach to Mitigate Ddos Attacks in Cloud

Contact Info

Product

Resources

About