Deep Learning-Based Approach for Detecting DDoS Attack on Software-Defined Networking Controller

Mansoor, A.; Anbar, Mohammed; Bahashwan, Abdullah Ahmed; Alabsi, Basim Ahmad; Rihan, Shaza Dawood Ahmed

doi:10.3390/systems11060296

Cited by 7 publications

(6 citation statements)

References 31 publications

(50 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…GCN [123] CNN [122] GRU [126] GANs [127] DBNs [131] SAE [128] DA [132] Cu-DNNGRU and Cu-BLSTM [135] RNN with DA [137] CNN with LSTM [136] LSTM and CNN with a stack autoencoder [138] RNN [134] FIGURE 15. DL Approaches applied SDN.…”

Section: Supervised Learning Approaches Unsupervised Learning Approac...mentioning

confidence: 99%

“…Enhanced DDoS attack detection on SDN controllers addresses the limitations of existing approaches presented in [134]. This study introduces a new distributed layered adaptive detection and suppression of cyberattacks (DLADSC) approach that combines cross-feature selection and a recurrent neural network (RNN) model to identify DDoS attacks accurately.…”

Section: Supervised Learning Approaches Unsupervised Learning Approac...mentioning

confidence: 99%

See 1 more Smart Citation

Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI, and MTD Approaches to Security Solutions

Abdi,

Audah,

Salh

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is a groundbreaking technology that has transformed network management significantly. By integrating data and control, SDN offers unparalleled flexibility and responsiveness, thereby overcoming the limitations of conventional network architectures. However, a centralized controller, which is a hallmark of SDN, is a double-edged security sword that offers easy control. This also becomes a dangerous point of failure for the entire network. To the best of our knowledge, this is the first comprehensive study to explore traditional-based, artificial intelligence (AI)-based, and moving target defense (MTD) approaches to securing SDN. The study begins with a survey of traditional security solutions for SDN, encompassing authentication, authorization, encryption, security protocols, firewalls, and flow verification, by addressing security threats and vulnerabilities in both data and control planes. The study then investigates the application of AI-based security solutions in an SDN environment, focusing on how Machine Learning (ML) and Deep Learning (DL) techniques are leveraged to address advanced security threats. Additionally, the survey examines MTD mechanisms within data and control plane security. Several in-depth techniques, including the randomization of Internet Protocol (IP) and Media Access Control (MAC) addresses, port numbers, and flow tables, and delving into the relationship between security threats, MTD strategies, and the specific controllers employed in experimental implementations. We utilized the widely recognized STRIDE cybersecurity framework to systematically identify and evaluate the potential threats to SDN security. Our analysis resulted in a comprehensive list of security challenges, and we propose future research directions aimed at addressing emerging threats in both the data and control planes.

show abstract

Section: Supervised Learning Approaches Unsupervised Learning Approac...mentioning

confidence: 99%

Section: Supervised Learning Approaches Unsupervised Learning Approac...mentioning

confidence: 99%

Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI, and MTD Approaches to Security Solutions

Abdi,

Audah,

Salh

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Mansoor et al, [ 8 ] introduced a DL approach that utilized Recurrent Neural Networks (RNN) for the detection of DDoS attacks directed at the controller. They tested their approach with a realistic dataset and achieved noteworthy performance results.…”

Section: Relevant Workmentioning

confidence: 99%

“…These limitations include: (i) most DL-based approaches in SDN networks primarily focus on detecting high-rate DDoS attacks, and (ii) the evaluation of these approaches frequently employs unrealistic datasets that do not accurately represent the characteristics of SDN network architecture. Lastly, (iii) certain approaches, such as those proposed by [ 8 , 12 , 17 ], exhibit inadequate performance when it comes to detecting standard or conventional DDoS flooding attacks.…”

Section: Relevant Workmentioning

confidence: 99%

HLD-DDoSDN: High and low-rates dataset-based DDoS attacks against SDN

Bahashwan,

Anbar,

Manickam

et al. 2024

PLoS ONE

Self Cite

View full text Add to dashboard Cite

Software Defined Network (SDN) has alleviated traditional network limitations but faces a significant challenge due to the risk of Distributed Denial of Service (DDoS) attacks against an SDN controller, with current detection methods lacking evaluation on unrealistic SDN datasets and standard DDoS attacks (i.e., high-rate DDoS attack). Therefore, a realistic dataset called HLD-DDoSDN is introduced, encompassing prevalent DDoS attacks specifically aimed at an SDN controller, such as User Internet Control Message Protocol (ICMP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP). This SDN dataset also incorporates diverse levels of traffic fluctuations, representing different traffic variation rates (i.e., high and low rates) in DDoS attacks. It is qualitatively compared to existing SDN datasets and quantitatively evaluated across all eight scenarios to ensure its superiority. Furthermore, it fulfils the requirements of a benchmark dataset in terms of size, variety of attacks and scenarios, with significant features that highly contribute to detecting realistic SDN attacks. The features of HLD-DDoSDN are evaluated using a Deep Multilayer Perception (D-MLP) based detection approach. Experimental findings indicate that the employed features exhibit high performance in the detection accuracy, recall, and precision of detecting high and low-rate DDoS flooding attacks.

show abstract

“…The investigation encompasses a range of techniques, including support vector machine (SVM), RF, artificial neural networks (ANNs), and deep learning models such as CNNs and RNNs. Mansoor et al [6] underscored the escalating threat of DDoS attacks on SDN controllers, noting their potential to compromise network security and disrupt operations. The limitations of conventional detection systems are highlighted, with the authors advocating for the adoption of deep learning approaches to refine the precision and efficacy of DDoS detection.…”

Section: Literature Reviewmentioning

confidence: 99%

Evaluating Machine Learning and Deep Learning Models for Enhanced DDoS Attack Detection

Owaid,

Hammoodi

2024

MMEP

View full text Add to dashboard Cite

In the realm of network security, distributed denial of service (DDoS) attacks pose a formidable threat, often resulting in operational disruptions and substantial financial losses. Traditional methods for DDoS detection struggle to adapt to the rapidly evolving attack methodologies, leading to compromised detection robustness and accuracy. The urgent need for more sophisticated detection mechanisms is evident. This investigation explores the effectiveness of advanced deep learning and ensemble machine learning models in identifying DDoS threats. A comprehensive approach is employed, leveraging a multitude of base classifiers to construct a robust and precise detection system. Integral to this study is the application of convolutional neural networks (CNNs), a deep learning variant, adept at discerning complex patterns and relationships within network traffic data. These models excel in autonomously extracting pertinent features, thereby enabling efficient detection of intricate DDoS attacks. A critical step in this methodology involves the collection of a comprehensive network traffic dataset, encompassing both normal and DDoS attack scenarios. This dataset undergoes a rigorous preprocessing and enhancement phase to ensure a balanced and representative training set. Subsequently, the augmented data is utilized to train the proposed models. The performance of these models is evaluated using a variety of metrics. Results from the experiments demonstrate that both machine learning and deep learning models significantly surpass existing techniques in DDoS detection. By amalgamating the strengths of various classifiers and neural networks, the method enhances detection precision and resistance to diverse attack variations. Comparative analyses reveal impressive performance metrics, with models such as CNN 1D and Alex Net achieving high levels of accuracy and precision. The outcomes of this study underscore the superiority of deep learning models in identifying both prevalent and novel DDoS attack patterns, thereby highlighting their potential in countering evolving cyber threats. The findings advocate for the enhanced precision and adaptability of the proposed approach in DDoS detection, marking a significant advancement in the field.

show abstract

Deep Learning-Based Approach for Detecting DDoS Attack on Software-Defined Networking Controller

Cited by 7 publications

References 31 publications

Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI, and MTD Approaches to Security Solutions

Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI, and MTD Approaches to Security Solutions

HLD-DDoSDN: High and low-rates dataset-based DDoS attacks against SDN

Evaluating Machine Learning and Deep Learning Models for Enhanced DDoS Attack Detection

Contact Info

Product

Resources

About