Detection and Analysis of TCP-SYN DDoS Attack in Software-Defined Networking

Swami, Rochak; Dave, Mayank; Ranga, Virender

doi:10.1007/s11277-021-08127-6

Cited by 23 publications

(8 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Ref. [67] investigated a variety of ML classification models, such as DT, random forest (RF), AdaBoost (AB), multiayer perceptron (MLP), and logistic regression (LR), to analyze and detect TCP-SYN flood DDoS attacks against the SDN controller. The experiment results show that all classification models achieved high performance.…”

Section: Hybrid ML Approachesmentioning

confidence: 99%

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

Bahashwan

Anbar

Manickam

et al. 2023

Sensors

View full text Add to dashboard Cite

Software-defined networking (SDN) is a revolutionary innovation in network technology with many desirable features, including flexibility and manageability. Despite those advantages, SDN is vulnerable to distributed denial of service (DDoS), which constitutes a significant threat due to its impact on the SDN network. Despite many security approaches to detect DDoS attacks, it remains an open research challenge. Therefore, this study presents a systematic literature review (SLR) to systematically investigate and critically analyze the existing DDoS attack approaches based on machine learning (ML), deep learning (DL), or hybrid approaches published between 2014 and 2022. We followed a predefined SLR protocol in two stages on eight online databases to comprehensively cover relevant studies. The two stages involve automatic and manual searching, resulting in 70 studies being identified as definitive primary studies. The trend indicates that the number of studies on SDN DDoS attacks has increased dramatically in the last few years. The analysis showed that the existing detection approaches primarily utilize ensemble, hybrid, and single ML-DL. Private synthetic datasets, followed by unrealistic datasets, are the most frequently used to evaluate those approaches. In addition, the review argues that the limited literature studies demand additional focus on resolving the remaining challenges and open issues stated in this SLR.

show abstract

Section: Hybrid ML Approachesmentioning

confidence: 99%

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

Bahashwan

Anbar

Manickam

et al. 2023

Sensors

View full text Add to dashboard Cite

show abstract

“…Several significant studies on SDN security proposed approaches [29,30] to detect and mitigate DDoS attacks on SDN. Unfortunately, most existing approaches have limitations in detecting low-and high-rate DDoS attacks when both occur simultaneously.…”

Section: Related Workmentioning

confidence: 99%

Renyi Joint Entropy-Based Dynamic Threshold Approach to Detect DDoS Attacks against SDN Controller with Various Traffic Rates

et al. 2022

View full text Add to dashboard Cite

The increasing incidence of distributed denial-of-service (DDoS) attacks has made software-defined networking (SDN) more vulnerable to the depletion of controller resources. DDoS attacks prevent the SDN controller from processing all incoming data efficiently, potentially disrupting a network or denying legitimate users access to network services. Thus, the protection of the SDN controller is crucial, especially from the ones that exploit the SDN characteristics. In this paper, the authors propose an efficient detection approach for low- and high-rate DDoS attacks on the controller with a high detection rate and a low false positive rate by adapting a dynamic threshold algorithm rather than a static one and proposing a new rule-based detection mechanism. In addition, the proposed approach was evaluated using eight simulation scenarios representing all potential attacks against the SDN controller in terms of attack traffic rates (low or high), sources (either single or multiple hosts), and targets (single or multiple victims). The experiment results show that the proposed approach is more effective than the existing approaches based on attack detection and false positive rates.

show abstract

“…Tuan et al 29 detected TCP SYN and ICMP flood attacks by applying KNN and XGBoost classification algorithms and mitigated the attack flows by 98% without affecting the normal traffic. Similarly, Swami et al 30 detected TCP‐SYN flood attacks using five classifiers, DT, RF, AdaBoost, MLP, logistic regression, on their self‐generated dataset using RYU controller. The impact of the attack was analyzed on the controller's CPU at various traffic rates.…”

Section: Related Workmentioning

confidence: 99%

ONOS Flood Defender: An Intelligent Approach to Mitigate DDoS Attack in SDN

Aslam

Srivastava

Gore

2022

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Software-Defined Networking (SDN) has made its place in the networks as new technology. SDN's programmable behavior enables it to change behavior on the fly, provides instructions for the task's automatic performance, dynamic scaling, and service integration. These advantages have made SDN necessary in networks. However, SDN suffers from the threat of DDoS attack. We have developed an approach to mitigate these threats by creating an ONOS Flood Defender Application (OFD App). This app effectively detects DDoS attack using supervised and ensemble machine learning techniques and mitigates them by tracebacking the attack traffic to its origin. Our results show that ensemble machine learning techniques perform better than single machine learning algorithm to detect DDoS attack. Random Forest classifier (RFC), an ensemble technique, performs best with the highest accuracy of 99.3% in detecting DDoS attack, followed by XGBoost classifier with an accuracy of 99%. The proposed framework of the OFD app is implemented in a Mininet emulator and ONOS SDN controller. The application performs effectively in terms of time, accuracy, and overhead of the system. Our app efficiently mitigates the attacks, thereby preventing a tremendous amount of damage to legitimate users.

show abstract

Detection and Analysis of TCP-SYN DDoS Attack in Software-Defined Networking

Cited by 23 publications

References 31 publications

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

Renyi Joint Entropy-Based Dynamic Threshold Approach to Detect DDoS Attacks against SDN Controller with Various Traffic Rates

ONOS Flood Defender: An Intelligent Approach to Mitigate DDoS Attack in SDN

Contact Info

Product

Resources

About