Ensemble Deep Learning Models for Mitigating DDoS Attack in Software-Defined Network

Abstract

Software-defined network (SDN) is an enabling technology that meets the demand of dynamic, adaptable, and manageable networking architecture for the future. In contrast to the traditional networks that are based on a distributed control plane, the control plane of SDN is based on a centralized architecture. As a result, SDNs are susceptible to critical cyber attacks that exploit the single point of failure. A distributed denial of service (DDoS) attack is one of the most crucial and risky attacks, targeting the SDN controller and disrupting its services. Several researchers have proposed signature-based DDoS mitigation and detection techniques that rely on manually configuring the policies. As the massive traffic from heterogeneous networks increases, conventional solutions are ineffective due to the lack of automation and human interference. This necessitates producing a detection solution, more effective than traditional ones, to ensure SDN security, resiliency, and availability. This paper addresses this problem by proposing a deep learning (DL)-based ensemble solution for efficient DDoS attack detection in SDN. Four hybrid models are presented by adopting three ensemble techniques and different DL architectures, namely convolutional neural network, long short-term memory, and gated recurrent unit, to improve the SDN traffic classification. The experimentation was conducted on the benchmark flow-based dataset CICIDS2017. High detection accuracy (99.77%) with a small number of flow-based features was achieved by our ensemble model, as our experimental results will demonstrate. The proposed solution was evaluated by several standard assessment matrices and by comparing against other state-of-the-art algorithms from the network security literature.

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

“…Ref. [96] used CNN, gated recurrent unity (GRU), and long-short-term memory (LSTM) for classifying DDoS attacks. The proposed model was trained with the CICIDS 2017 dataset and achieved 99.77% detection accuracy in the case of a small number of features.…”

Deep Learning-Based Approach for Detecting DDoS Attack on Software-Defined Networking Controller

“…There are several DL-based approaches that have been proposed. For example, Alanazi et al [10] proposed an ensemble approach based on a combination of Gated Recurrent Unit (GRU), Convolutional Neural Network (CNN), and Long Short-Term Memory (LSTM) to detect DDoS attacks in SDN networks. The ensemble was evaluated using the CICIDS2020 dataset and achieved high detection accuracy by selecting only four features.…”

“…As shown in Table 2, several approaches in the literature have achieved low detection accuracies, such as those of Santos et al [12], Sudar et al [8], Celesova et al [25], Hsieh et al [26], and Deepa et al [11]. Additionally, some of these approaches have been evaluated using non-SDN datasets, including Celesova et al [25], Sudar et al [8], Boukria et al [28], and Alanazi et al [10]. Moreover, most of the existing approaches are implemented on SDN controllers, which can increase overhead during DDoS attacks.…”

“…Regrettably, the SDN controller lacks an integrated security defense system that can efficiently distinguish between normal and abnormal network traffic [6,7]. Furthermore, numerous researchers have proposed different approaches to detect DDoS attacks on SDN controllers [8][9][10][11][12]. However, despite the efficiency of these approaches, detecting DDoS attacks on SDN controllers remains a challenging problem.…”

“…For example, Wan et al [9] demonstrated that relying on non-qualified features resulted in the classifier's inability to differentiate between attack traffic and normal traffic for detecting DDoS attacks. Similarly, Iasc et al [10] showed that using non-realistic datasets does not accurately reflect the essential features of real SDN traffic and may lead to unfair performance comparisons with other state-of-the-art approaches.…”