Enabling disaster-resilient SDN with location trustiness

Nguyen, Van-Quyet; Nguyen, Sinh Ngoc; Kim, Kyungbaek

doi:10.1109/caipt.2017.8320668

Cited by 1 publication

(1 citation statement)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, when links and devices errors are caused by unexpected traffic volumes, network communication cannot work smoothly. In order to reduce the recovering time about the failures of links and devices, the proposed event handler module uses the trustiness of links and switches derived from location trustiness [31]. The event handler module communicates with the received requests to the corresponding components of framework and routes requests and messages that are sent to the collaborators.…”

Section: Event Handler Modulementioning

confidence: 99%

LSTM-Based Collaborative Source-Side DDoS Attack Detection

2022

Self Cite

View full text Add to dashboard Cite

As denial of service attacks become more sophisticated, the source-side detection techniques are being studied to solve the limitations of target-side detection techniques such as delayed detection and difficulty in tracking attackers. Recently, some source-side detection techniques are being studied to use an adaptive attack detection threshold considering seasonal behavior of network traffic. However, because patterns of network traffic usage have become irregular with increased randomness and explosive traffic, the performance of the adaptive threshold technique has deteriorated. In addition, by limitations of the local view of a single site, distributed attacks from multiple sites may not be detected. In this paper, we propose a LSTM (Long Short Term Memory) based collaborative source-side DDoS (Distributed Denial of Service) attack detection framework which provides the attack detection result of a collaboration network in a global view. The proposed framework applies LSTM-based adaptive thresholds to each source-side network to mitigate performance degradation caused by irregular network traffic behavior. Also, in order to overcome the limitation of performance caused by the local view of single source-side network, the proposed framework constructs a collaborative network through multiple detection sites and aggregates feedback from each site, such as detection rates, local traffic patterns, and timestamp. The collaborative attack detection technique uses the aggregated feedback to determine whether the attack is finally detected and shares the finial detection results with multiple sites. Depending on this final detection result, the adaptive thresholds of each site are reset. Through extensive evaluation of actual network traffic data, the proposed collaborative source-side attack detection technique shows around 15% lower false positive rate than the single source-side attack detection technique while maintaining a high detection rate.

show abstract

Section: Event Handler Modulementioning

confidence: 99%