Efficient DDoS Detection Based on K-FKNN in Software Defined Networks

Xu, Yuhua; Sun, Houtao; Feng, Xinglei; Sun, Zhixin

doi:10.1109/access.2019.2950945

Cited by 44 publications

(28 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Xu et al [10] improved the DDoS detection algorithm. They proposed a DDoS detection method based on K-FKNN and a module detection system to improve detection efficiency and accuracy.…”

Section: A Researches On Ddos Detection and Defense Methodsmentioning

confidence: 99%

“…The original features of the dataset can better distinguish the normal flows and the attack flows, and reduce the detection efficiency while ensuring the accuracy of the algorithm. Thus, the original features in the DDoS detection dataset are used to detect traffic [10]. In order to improve the accuracy of the algorithm, 15 features are used, but at the same time, it also increases the detection delay of the algorithm.…”

Section: Evaluation With Simulated Datamentioning

confidence: 99%

See 1 more Smart Citation

A New Framework for DDoS Attack Detection and Defense in SDN Environment

et al. 2020

View full text Add to dashboard Cite

While software defined network (SDN) brings more innovation to the development of future networks, it also faces a more severe threat from DDoS attacks. In order to deal with the single point of failure on SDN controller caused by DDoS attacks, we propose a framework for detection and defense of DDoS attacks in the SDN environment. Firstly, we deploy a trigger mechanism of DDoS attack detection on data plane to screen for abnormal flows in the network. Then, we use a combined machine learning algorithm based on K-Means and KNN to exploit the rate characteristics and asymmetry characteristics of the flows and to detect the suspicious flows determined by the detection trigger mechanism. Finally, the controller will take corresponding actions to defense against the attacks. In this paper, we propose a new framework of cooperative detection methods of control plane and data plane, which effectively improve the detection accuracy and efficiency, and prevent DDoS attacks on SDN. INDEX TERMS Software Defined Network, Distributed Denial of Service (DDoS), collaborative detection, traffic characteristics, detection trigger.

show abstract

“…Xu et al [10] improved the DDoS detection algorithm. They proposed a DDoS detection method based on K-FKNN and a module detection system to improve detection efficiency and accuracy.…”

Section: A Researches On Ddos Detection and Defense Methodsmentioning

confidence: 99%

Section: Evaluation With Simulated Datamentioning

confidence: 99%

A New Framework for DDoS Attack Detection and Defense in SDN Environment

et al. 2020

View full text Add to dashboard Cite

show abstract

“…A technique that detects a DDoS attack in SDN is introduced in [13]. The algorithm depends mainly on K-means++ [13] and Fast K-Nearest Neighbors (K-FKNN). The modular detection system is implemented in the controller.…”

Section: Related Workmentioning

confidence: 99%

“…However, some introduced works focus on using ML algorithms, which prove to give the best detection results. They construct a classifier that detects DDoS attacks in SDN such as the technique introduced in [13]. The method uses KNN to create an ML-based model that can detect the attack in SDN architecture.…”

Section: Introductionmentioning

confidence: 99%

Machine Learning-based Distributed Denial of Service Attacks Detection Technique using New Features in Software-defined Networks

Gadallah¹,

Omar²,

Ibrahim³

2021

IJCNIS

View full text Add to dashboard Cite

Software-Defined Networking is a new network architecture that separates control and data planes. It has central network control and programmability facilities, so it improves manageability, scaling, and performance. However, it may suffer from creating a single point of failure against the controller, which represents the network control plane. So, defending the controller against attacks such as a distributed denial of service attack is a valuable and urgent issue. The advances of this paper are to implement an accurate and significant method to detect this attack with high accuracy using machine learning-based algorithms exploiting new advanced features obtained from traffic flow information and statistics. The developed model is trained with kernel radial basis function. The technique uses advanced features such as unknown destination addresses, packets inter-arrival time, transport layer protocol header, and type of service header. To the best knowledge of the authors, the proposed approach of the paper had not been used before. The proposed work begins with generating both normal and attack traffic flow packets through the network. When packets reach the controller, it extracts their headers and performs necessary flow calculations to get the needed features. The features are used to create a dataset that is used as an input to linear support ector machine classifier. The classifier is used to train the model with kernel radial basis function. Methods such as Naive Bayes, K-Nearest Neighbor, Decision Tree, and Random Forest are also utilized and compared with the SVM model to improve the detection operation. Hence, suspicious senders are blocked and their information is stored. The experimental results prove that the proposed technique detects the attack with high accuracy and low false alarm, compared to other related techniques.

show abstract

“…The possibility of network management via software allows numerous customization of network services [10] [18], including security. Further, SDN provides several advantages grounded by machine learning classification, pattern recognition, and meta-heuristic optimization to improve the administrator task [19].…”

Section: Introductionmentioning

confidence: 99%

Artificial Immune Systems and Fuzzy Logic to Detect Flooding Attacks in Software-Defined Networks

et al. 2020

View full text Add to dashboard Cite

Software-defined Networking (SDN) has been discovered as an architecture that uses applications to make networks flexible and centrally controlled. Although SDN provides innovative management, it still susceptible to attacks daily. Traditional detection approaches may not be sufficient to contain these threats. In this paper, we present an Artificial Immune System based IDS named AIS-IDS, which is inspired by the human body's defense cells. AIS-IDS can detect variations in network behavior and identify attacks without prior knowledge about them. Along with AIS, the fuzzy logic is applied on detection to minimize the uncertainty when there is no clear boundary between anomalous and normal traffic behavior. We have simulated portscan and flooding attacks as well as used a public dataset with several types of DDoS attacks to assess our proposal. We compared the AIS-IDS performance with Naive Bayes, k-nearest neighbors, and the Local Outlier Factor. The AIS-IDS outperformed the compared algorithms, achieving f-measure rates 99.97% and 92.28% when submitted to a simulated and a public dataset, respectively.

show abstract

Efficient DDoS Detection Based on K-FKNN in Software Defined Networks

Cited by 44 publications

References 31 publications

A New Framework for DDoS Attack Detection and Defense in SDN Environment

A New Framework for DDoS Attack Detection and Defense in SDN Environment

Machine Learning-based Distributed Denial of Service Attacks Detection Technique using New Features in Software-defined Networks

Artificial Immune Systems and Fuzzy Logic to Detect Flooding Attacks in Software-Defined Networks

Contact Info

Product

Resources

About