Distributed denial of service attacks detection for software defined networks based on evolutionary decision tree model

Abstract

The software defined networks (SDN) system has modern techniques in networking, it separates the forwarding plane from the control plane and works to collect control functions in a central unit (controller), and this separation process leads to many advantages, such as cost reduction and programming ability. Concurrently, because of its centralized architecture, it is prone to a variety of attacks. Distributed denial of service (DDoS) attack has a significant impact on SDN, it is characterized by its ability to consume network resources as well as its ability to turn off the entire network. The work in this study aims to improve and increase the security and robustness of SDN systems against the attack or intrusion, by using a machine learning model to detect attack traffic and classify traffic of SDN as (attack or normal), and optimization algorithm (genetic algorithm) for improving the accuracy of the classification. After preparing and preprocessing the dataset, we used the genetic algorithm (GA) to optimize the hyperparameters of the decision tree (DT) model, and the proposed evolutionary decision tree (EDT) model was used to classify traffic into normal and attack traffic. The results indicate that the suggested model achieved a high classification accuracy of 99.46.

Machine learning approach for intrusion detection system using dimensionality reduction

“…It can be claimed that the system's effectiveness rises in direct proportion to the accuracy of the data. The suggested approach for intrusion detection is validated using the distributed denial of service (DDoS) [24]− [27], CIC-DDoS2019 dataset (87 features) in order to get over these challenges as is represented in Figures 2 and 3. In this phase, all 87 features of the dataset is collected and preprocessed for checking the validation of data.…”

“…In this phase in order to increase the task scheduling reaction time, Algorithm 1 divides the priority instances into various priority queues. For training the model, the algorithm takes in 87 features as input (CIC-DDos2019 dataset) , and is given to the procedure data_ processing selection where priority resolver is used as the classifier and dimensionality reduction method [26], [27] is applied to reduce features from 87 to 67 maintaining the efficiency and giving the required accuracy and other evaluation metrics. Algorithm: the model is designed to perform the following actions: input data, perform feature selection based on priority resolver, train the model, and classification of label data.…”

A Comparative Review on DDoS Attack Detection Using Machine Learning Techniques

“…Other pre-processing methods include category value encoding, addressing missing values, and null value elimination. Categorical variables lacking numerical values, including source-destination IP and protocol, were encoded using one-hot encoding [50].…”

Feature-based real-time distributed denial of service detection in SDN using machine learning and Spark

“…As the name suggests, DT is a tree-based model characterized by its simplicity in understanding decisions and the ability to select the most preferential features [19]. In addition, it can classify data without vast calculations [20]. b.…”