Detection and Classification of DDoS Flooding Attacks on Software-Defined Networks: A Case Study for the Application of Machine Learning

Abstract

Software-defined networks (SDNs) offer robust network architectures for current and future Internet of Things (IoT) applications. At the same time, SDNs constitute an attractive target for cyber attackers due to their global network view and programmability. One of the major vulnerabilities of typical SDN architectures is their susceptibility to Distributed Denial of Service (DDoS) flooding attacks. DDoS flooding attacks can render SDN controllers unavailable to their underlying infrastructure, causing service disruption or a complete outage in many cases. In this paper, machine learning-based detection and classification of DDoS flooding attacks on SDNs is investigated using popular machine learning (ML) algorithms. The ML algorithms, classifiers and methods investigated are quadratic discriminant analysis (QDA), Gaussian Naïve Bayes (GNB), k-nearest neighbor (k-NN), and classification and regression tree (CART). The general principle is illustrated through a case study, in which, experimental data (i.e. jitter, throughput, and response time metrics) from a representative SDN architecture suitable for typical midsized enterprise-wide networks is used to build classification models that accurately identify and classify DDoS flooding attacks. The SDN model used was emulated in Mininet and the DDoS flooding attacks (i.e. hypertext transfer protocol (HTTP), transmission control protocol (TCP), and user datagram protocol (UDP) attacks) have been launched on the SDN model using low orbit ion cannon (LOIC). Although all the ML methods investigated show very good efficacy in detecting and classifying DDoS flooding attacks, CART demonstrated the best performance on average in terms of prediction accuracy (98%), prediction speed (5.3 ×10 5 observations per second), training time (12.4 ms), and robustness.

Probe Attack Detection Using an Improved Intrusion Detection System

“…These findings reveal the significant impact of using the FS (based on GWO) on enhancing the IDS performance significantly. Besides, the performance of the proposed IDS was also compared against that of advanced counterparts mentioned in the literature including [11][12][13][14][15] to identify its efficiency. Although the IDSs attained comparable outcomes following accuracy, precision, recall, and F-measure, the proposed IDS outperformed the current IDSs in all evaluation metric as outlined in Fig.…”

“…Such techniques are extensively deployed in traditional networks and ML-assisted SDNs. For example, ML-based IDS of DDoS flooding attacks on SDNs was presented in [11]. The common principle is depicted using a case study where experimental data (jitter, throughput, and response time metrics) from a representative SDN environment, which proves adequate for typical mid-sized and enterprise-wide networks, is employed to structure classification models that precisely determine and categorize DDoS flooding attacks.…”

Safeguarding the IoT: Taxonomy, security solutions, and future research opportunities

“…At the same time, there is massive HTTP Flooding, which targets many people 58 . Sangodoyin et al 59 proposed a Software Defined Network on tree topology using Mininet emulator so that it can be used in wide area networks. This machine learning‐based method gave good accuracy in detecting HTTP Flooding attacks.…”

Ubiquitous Control of a CNC Machine: Proof of Concept for Industrial IoT Applications

“…Even though such mobile or ubiquitous HMIs will adequately support the quasi or full decentralisation of the control architectures of their associated ICs, as discussed above, they also make their ICSs prone to cyber attacks or threats due to their dedicated internet connectivity [35]. Several frameworks and/or methodologies such as the National Institute of Standards and Technology (NIST) framework [36,37] are available today to assess cyber attacks or threats such as denial of service [38] and devise the means of mitigating them in industrial applications, but cybersecurity has remained an area of ongoing research due to its very broad and dynamic nature in industrial applications [39].…”