Detecting DDoS Attacks on SDN Data Plane with Machine Learning

Carvalho, Ranyelson Neres; Costa, Lucas Rodrigues; Bordim, Jacir Luiz; Alchieri, Eduardo

doi:10.1109/candarw53999.2021.00030

Cited by 8 publications

(4 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…When an attack is detected, flows are blocked based on the list they belong to. This work extends and combines our previous published papers, which appeared in References 17 and 18, by using a more evolving solution using reputation algorithms, node priority, and ML detecting mechanism applied to the SDN data plane. As far as we are aware, this is the first work to apply ML techniques for attack detection and mechanisms for attack mitigation directly in the data plane.…”

Section: Introductionsupporting

confidence: 52%

DataPlane‐ML: An integrated attack detection and mitigation solution for software defined networks

Carvalho

Costa

Bordim

et al. 2022

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

Summary Software defined network (SDN) is a paradigm that emphasizes the separation of the control plane from the data plane, offering advantages such as flexibility and programmability. However, from a security perspective, SDN also introduces new vulnerabilities due to the communication required between these planes. SYN Flood attacks are typical distributed denial‐of‐service (DDoS) attacks that especially challenge network administrators since they produce a large volume of semi‐open TCP connections to a target, compromising its availability. Most of the current solutions to detect and mitigate these attacks are designed to operate at the control plane, imposing an additional overhead on controller functions. Moreover, traffic‐blocking mechanisms, a widely used alternative to protect network resources, have the drawback of restricting legitimate traffic. This work proposes DataPlane‐ML, an integrated solution to detect and mitigate DDoS attacks on SDN, acting directly in the data plane. DataPlane‐ML uses machine learning techniques for attack detection and a mitigation solution based on the node's reputation to avoid blocking legitimate traffic during an attack. Experimental results show that DataPlane‐ML is prefix≈26%$$ \approx 26\% $$ faster than statistical‐based solutions for attack detection while presenting better accuracy. Moreover, the DataPlane‐ML mitigation solution can preserve more than 95%$$ 95\% $$ of legitimate traffic during an attack.

show abstract

Section: Introductionsupporting

confidence: 52%

DataPlane‐ML: An integrated attack detection and mitigation solution for software defined networks

Carvalho

Costa

Bordim

et al. 2022

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

show abstract

“…In the performance analysis, we find that the choice of kernel functions greatly affects the accuracy results. For all the experimental cases, the "RBF" kernel remains the most favorable 93 but takes a lot of time to train the classifier. Either we can use PCA for dimensionality reduction or use the linear kernel.…”

Section: Results With Svmmentioning

confidence: 99%

Performance evaluation of machine learning models for distributed denial of service attack detection using improved feature selection and hyper‐parameter optimization techniques

Habib

Khursheed

2022

Concurrency and Computation

View full text Add to dashboard Cite

This article gives the framework of extensive experimentation of various machine learning models to detect distributed denial of service attacks (DDoS). We use six-tier feature ranking methods that use statistical techniques as well as machine learning based classifiers to obtain the significant features. The measurable statistical based feature selection involves Chi-Square (Chi2), information gain (IG), merged Chi-Square (Chi2)-IG ranking and machine learning classifiers involve ensemble classifiers, that is, decision tree, random forest and eXtreme gradient boosting (XGBoost). Different supervised machine learning models (logistic regression, decision tree classifier, linear support vector machine, k-nearest neighbors, Gaussian Naive Bayes, random forest classifier, XGBoost) are trained on a feature-engineered datasets. To further our research, we use neural networks (ANN and CNN) using both feature-selected and auto-feature selection training setup. We check the validation and adaptability of these models with the optimal tuning of various parameters using GridSearchCV and the effectiveness of random sampling in overcoming the class imbalance problem. Based on various feature selection methods, the models are evaluated for their best performance. The experimental results show that our trained machine learning models and neural networks outperformed the ones in the state of art. The performance analysis is done based on confusion matrix scores, that is, accuracy, false alarm rate, sensitivity, specificity, false-positive rate, F1 score, area under curve analysis and loss functions on well-known KDD Cup 99 and UNSW-NB15 datasets. This study is significant for furthering the research in DDoS detection with machine learning and deep neural networks.

show abstract

“…Algorithm 1 Example of a P4 Match/Action table defined for the n-th decision tree level [55]. [49] 2021 Paolucci et al [52] 2021 Zhang et al [56] 2021 Barradas et al [50] 2021 Zheng et al [57] 2022 Hardegen et al [58] 2022 Ganesan et al [59] 2022 Heggi et al [60] 2022 Zang et al [61] 2022 Carvalho et al [62] 2022 Coelho et al [63] 2022 Roshani et al [64] 2022 Gaikar et al [65] 2023 Al Sadi et al [66] 2023 Zang et al [67] 2023 González et al [68] 2023 Doriguzzi et al [69] 2023 Wang et al [70] 2023 Khedr et al [71] 2023…”

Section: ) Machine Learning (Ml)mentioning

confidence: 99%

P4 Cybersecurity Solutions: Taxonomy and Open Challenges

Garzón,

Ríos-Guiral,

Leal

et al. 2024

IEEE Access

View full text Add to dashboard Cite

The field of cybersecurity has witnessed a significant shift towards Programmable Data Planes with the emergence of the P4 programming P4. The existing literature lacks a comprehensive taxonomy that provides collaborative classifications and characterization of P4-based cybersecurity solutions. In this paper, we propose a novel taxonomy to better characterize published works in the field of cybersecurity solutions developed leveraging P4 and Programmable Data Planes. Our taxonomy introduces three main categories: detection techniques, mitigation actions, and deployment platforms. Unlike existing classification approaches present in literature, our taxonomy allows categorizing a given work according to different criteria, thus enabling collaborative classifications and the identification of shared features by highlighting intra-category and inter-category relationships that can be established among different works. Through our comprehensive characterization of the works identified in the literature, we present key findings that contribute to extend the current understanding of the field. By identifying the diverse range of techniques employed and the platforms utilized, we aim at addressing the needs to understand the area, which is fundamental for future advancements. Notably, we emphasize the significance of security provisioning through the adoption of cybersecurity functional abstractions. These abstractions enable the emulation of the behavior of conventional security devices, leveraging the capabilities of P4. Furthermore, we discuss several research challenges and possible future directions that have emerged from our analysis. This paper focuses on providing valuable insights and knowledge for researchers and practitioners in the field of cybersecurity solutions based on Programmable Data Planes leveraging P4, with the final goal of opening avenues for new research.

show abstract

Detecting DDoS Attacks on SDN Data Plane with Machine Learning

Cited by 8 publications

References 19 publications

DataPlane‐ML: An integrated attack detection and mitigation solution for software defined networks

DataPlane‐ML: An integrated attack detection and mitigation solution for software defined networks

Performance evaluation of machine learning models for distributed denial of service attack detection using improved feature selection and hyper‐parameter optimization techniques

P4 Cybersecurity Solutions: Taxonomy and Open Challenges

Contact Info

Product

Resources

About