Handling intrusion and DDoS attacks in Software Defined Networks using machine learning techniques

Ashraf, Javed; Latif, Seemab

doi:10.1109/nsec.2014.6998241

Cited by 99 publications

(55 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [36] the authors use machine learning algorithms to predict potential target host attacks based on historical network attack data for SDNs. In [37] the authors describe machine learning techniques to handle intrusions and Distributed Denial of Service (DDoS) attacks in SDNs. In [38] the author discusses different anomaly detection mechanisms for SDNs.…”

Section: Related Workmentioning

confidence: 99%

Learning from Network Device Statistics

2017

View full text Add to dashboard Cite

We estimate end-to-end service metrics from network device statistics. Our approach is based upon statistical, supervised learning, whereby the mapping from device-level to service-level metrics is learned from observations, i.e., through monitoring the system. The approach enables end-to-end performance prediction without requiring an explicit model of the system, which is different from traditional engineering techniques that use stochastic modeling and simulation. The fact that end-to-end service metrics can be estimated from local network statistics with good accuracy in the scenarios we consider suggests that service-level properties are ''encoded'' in network-level statistics. We show that the set of network statistics needed for estimation can be reduced to a set of measurements along the network path between client and service backend, with little loss in estimation accuracy. The reported work is largely experimental and its results have been obtained through testbed measurements from a video streaming service and a KV store over an OpenFlow network .

show abstract

Section: Related Workmentioning

confidence: 99%

Learning from Network Device Statistics

2017

View full text Add to dashboard Cite

show abstract

“…Unsupervised ML techniques are seeing a surging interest in SDN community as can be seen by a spate of recent work. A popular application of unsupervised ML techniques in SDNs relates to the application of intrusion detection and mitigation of security attacks [287]. Another approach for detecting anomalies in cloud environment using unsupervised learning model has been proposed by Dean et al [288] that uses SOM to capture emergent system behavior and predict unknown and novel anomalies without any prior training or configuration.…”

Section: E Emerging Networking Applications Of Unsupervised Learningmentioning

confidence: 99%

Unsupervised Machine Learning for Networking: Techniques, Applications and Research Challenges

et al. 2019

View full text Add to dashboard Cite

While machine learning and artificial intelligence have long been applied in networking research, the bulk of such works has focused on supervised learning. Recently there has been a rising trend of employing unsupervised machine learning using unstructured raw network data to improve network performance and provide services such as traffic engineering, anomaly detection, Internet traffic classification, and quality of service optimization. The interest in applying unsupervised learning techniques in networking emerges from their great success in other fields such as computer vision, natural language processing, speech recognition, and optimal control (e.g., for developing autonomous self-driving cars). Unsupervised learning is interesting since it can unconstrain us from the need of labeled data and manual handcrafted feature engineering thereby facilitating flexible, general, and automated methods of machine learning. The focus of this survey paper is to provide an overview of the applications of unsupervised learning in the domain of networking. We provide a comprehensive survey highlighting the recent advancements in unsupervised learning techniques and describe their applications for various learning tasks in the context of networking. We also provide a discussion on future directions and open research issues, while also identifying potential pitfalls. While a few survey papers focusing on the applications of machine learning in networking have previously been published, a survey of similar scope and breadth is missing in literature. Through this paper, we advance the state of knowledge by carefully synthesizing the insights from these survey papers while also providing contemporary coverage of recent advances.

show abstract

“…In [11], the authors presented their approach that uses Self Organizing Maps (SOMs) to analyze traffic characteristics captured by NOX controller in an OpenFlowenabled network. In [12], the authors developed machine learning approaches for mitigating DDoS attacks in softwaredefined networks. The SDN controller performs traffic analysis and defines mitigation rules that are installed in the switches.…”

Section: Related Workmentioning

confidence: 99%

Crossfire Attack Detection Using Deep Learning in Software Defined ITS Networks

Narayanadoss¹,

Truong-Huu

Mohan

et al. 2019

2019 IEEE 89th Vehicular Technology Conference (VTC2019-Spring)

View full text Add to dashboard Cite

Recent developments in intelligent transport systems (ITS) based on smart mobility significantly improves safety and security over roads and highways. ITS networks are comprised of the Internet-connected vehicles (mobile nodes), roadside units (RSU), cellular base stations and conventional core network routers to create a complete data transmission platform that provides real-time traffic information and enable prediction of future traffic conditions. However, the heterogeneity and complexity of the underlying ITS networks raise new challenges in intrusion prevention of mobile network nodes and detection of security attacks due to such highly vulnerable mobile nodes. In this paper, we consider a new type of security attack referred to as crossfire attack, which involves a large number of compromised nodes that generate low intensity traffic in a temporally coordinated fashion such that target links or hosts (victims) are disconnected from the rest of the network. Detection of such attacks is challenging since the attacking traffic flows are indistinguishable from the legitimate flows. With the support of software-defined networking that enables dynamic network monitoring and traffic characteristic extraction, we develop a machine learning model that can learn the temporal correlation among traffic flows traversing in the ITS network, thus differentiating legitimate flows from coordinated attacking flows. We use different deep learning algorithms to train the model and study the performance using Mininet-WiFi emulation platform. The results show that our approach achieves a detection accuracy of at least 80%.

show abstract

Handling intrusion and DDoS attacks in Software Defined Networks using machine learning techniques

Cited by 99 publications

References 11 publications

Learning from Network Device Statistics

Learning from Network Device Statistics

Unsupervised Machine Learning for Networking: Techniques, Applications and Research Challenges

Crossfire Attack Detection Using Deep Learning in Software Defined ITS Networks

Contact Info

Product

Resources

About