Effectiveness of an Entropy-Based Approach for Detecting Low- and High-Rate DDoS Attacks against the SDN Controller: Experimental Analysis

Abstract

Software-defined networking (SDN) is a unique network architecture isolating the network control plane from the data plane, offering programmable elastic features that allow network operators to monitor their networks and efficiently manage them. However, the new technology is security deficient. A DDoS attack is one of the common attacks that threaten SDN controllers, leading to the degradation or even collapse of the entire SDN network. Entropy-based approaches and their variants are considered the most efficient approaches to detecting DDoS attacks on SDN controllers. Therefore, this work analyzes the feasibility and impacts of an entropy-based DDoS attack detection approach for detecting low-rate and high-rate DDoS attacks against the controller, measured in terms of detection rate (DR) and false-positive rate (FPR), triggered by a single or multiple host attacks targeting a single or multiple victims. Eight simulation scenarios, representing low and high DDoS attack traffic rates on the controller, have been used to evaluate an entropy-based DDoS attack detection approach. The experimental results reveal that the entropy-based approach enhances the average DR for detecting high-rate DDoS attack traffic compared with low-rate DDoS attack traffic by 6.25%, 20.26%, 6.74%, and 8.81%. In addition, it reduces the average FPRs for detecting a high DDoS attack traffic rate compared with a low DDoS attack traffic rate by 67.68%, 77.54%, 66.94%, and 64.81.

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

“…Moreover, DDoS attacks are significant threats to SDN networks. However, traditional defense approaches may be ineffective in detecting and mitigating these attacks since attackers nowadays use new techniques to flood the SDN networks with different traffic variations (i.e., high and low rates), leading to the degrading of the SDN controller and making it unavailable to legitimate individuals [9].…”

“…Figure 5 illustrates the DDoS attack mechanism on the SDN network. Furthermore, DDoS attacks pose critical threats to the SDN network, especially if the controller becomes a target, directly or indirectly [9]. For example, when a switch receives invalid network packets, it buffers all packets and then forwards only the packets' headers to the controller using Packet-In messages.…”

A Comprehensive Detection and Mitigation Mechanism to Protect SD-IoV Systems Against Controller-Targeted DDoS Attacks

“…SDN is one of the emerging technologies that decouples the control plane from the forwarding plane [6]. Its architecture typically involves three planes: the application plane, the control plane, and the data plane [7]. The application plane consists of network applications such as driving safety apps, infotainment, and mobility management that leverage the exposed northbound application interface to interact with the control plane [8].…”

“…The deployment of the detection and mitigation system directly on the controller necessitates a lightweight solution to avoid adding undue burden to the controller. Therefore, an information theory-based system, as demonstrated in related research [6], [7], is deemed preferable for attacks targeting the controller. Previous studies, including [14], [15], and [16], have explored DDoS attack detection in SDN using entropy theory with a fixed threshold value.…”