Detecting DoS Attacks Based on Multi-Features in SDN

Abstract

Denial of Service (DoS) attack is a serious threat to Software Defined Network (SDN). Although many research efforts have been devoted to identify new features for DoS attack detection, the existing approaches are not able to detect various types of DoS attacks. In SDN, DoS attacks against data plane are mainly organized in two ways: 1) DoS attack with multiple flow entries (M-DoS) to exhaust the Ternary Content-Addressable Memory (TCAM) resource of the switch. 2) DoS attack with a single well-designed entry (S-DoS) to overwhelm the target link and further impact the controller. To detect these two attacks, we propose a new approach by extracting six features of flow table, and using the back propagation (BP) neural network to construct the classifier. Test results of test-bed experiments indicate that the accurate detection probability of proposed approach is 98.9%, which can effectively distinguish M-DoS flows and S-DoS flows without being affected by Flash crowd scene. INDEX TERMS SDN security, DoS, Feature detection, Flow table, Flash crowd I.INTRODUCTION Software Defined Network (SDN), as a new type of network management architecture, provides network with flexible control, simple network architecture, and great programmability by decoupling the control plane and the data plane of the traditional network. The control plane enables upper-level managers to implement the required functions by simply deploying the network. In terms of development, SDN provides developers with rich programming interfaces, enabling them to change the network deployment according to actual needs. The logically centralized controller not only provides powerful technical support for complex network services, but also can obtain network status information from a global perspective, which is convenient for monitoring the network in real-time. Moreover, the separation of the control plane and the data plane simplifies the process of packet forwarding, reduces the load on the switch, and makes network configuration more convenient. SDN has been widely used in network virtualization, wireless LANs, cloud computing and other fields due to its advantages[1]-[4]. However, as SDN is still in the development stage, many technical details are not mature enough, it can easily become a key target of network attacks. SDN has serious security vulnerabilities, thus faces great security threats[5]-[7]. Denial of Service (DoS) attacks is one of the major threats to SDN. Previous researches have noted that there exist many types of DoS attacks in SDN[8]-[10]. The victim may be control plane, data plane or application[9][11]. DoS attacks against data plane, control plane or SDN application commonly have different principles and features, corresponding to specialized detection methods. Therefore, DoS attacks should be studied according to different planes, and existing studies are commonly conducted in this way. Currently, DoS attacks on data plane have attracted wide attention, as the vulnerabilities of this plane are exposed. These attacks can be class...

Traffic Anomaly Detection in Wireless Sensor Networks Based on Principal Component Analysis and Deep Convolution Neural Network

“…Datasets Metrics Year BPNN [25] World Cup 1998 Dataset Precision / Recall / F1-score / Accuracy 2020 UADAIN [26] ISCX 2012 / NSL-KDD Accuracy / Detection rate / FAR 2022 OCSA-RNN [28] KDD99 Precision / Recall / F-Measure / Accuracy 2021 LSTM-GRU-SVM [29] SCADA Accuracy / Sensitivity / Specificity / Precision / F1-score Confusion matrix 2022…”

“…Although ML algorithms achieve good network traffic anomaly detection results, the rapid change of network data and the large data volume have caused more attention to be given to DL techniques. Meng Yue et al [25] combined backpropagation neural networks (BPNN) in software-defined networks (SDN) for DoS detection, achieving a detection rate. Y Shi and H Shen [26] proposed an unsupervised network anomaly traffic detection method based on an artificial immune network (UADAIN), which has a better detection effect than unsupervised methods such as K-means clustering.…”

Cross-Plane DDoS Attack Defense Architecture Based on Flow Table Features in SDN

“…In Reference [22], Yue et al proposed M-DoS attack and S-DoS attack, respectively, representing the DoS attack with multiple flow entries (M-DoS) to exhaust the Ternary Content-Addressable Memory resource of the switch and DoS attack with a single well-designed entry (S-DoS) to overwhelm the target link then further impacting the controller. For these two kinds of attacks, they extracted six characteristics of the flow table, and used BP neural network to construct a classifier to distinguish the attack flow from normal flow.…”

Usando o particionamento de switch para mitigar o problema de acoplamento

“…Este trabalho foi parcialmente financiado pelo CNPq, pela CAPES e pela CODATA-PB. segurança, portanto, enfrenta grandes ameaças de segurança [4] [5] [6].…”

“…Ataques DoS contra plano de dados, plano de controle ou aplicação SDN geralmente têm princípios e recursos diferentes, correspondentes a métodos de detecção especializados. Portanto, os ataques DoS devem ser estudados de acordo com diferentes planos, e os estudos existentes são comumente conduzidos dessa forma [6].…”