Physical Assessment of an SDN-Based Security Framework for DDoS Attack Mitigation: Introducing the SDN-SlowRate-DDoS Dataset

Abstract

Slow-read Distributed Denial of Service (DDoS) attacks are complex to detect and mitigate.Although existing tools allow one to identify these attacks, these tools mainly generate alerts. However, in real scenarios, a large number of attack detection alerts will put the security workforce in a bottleneck, as they will not be able to implement mitigation actions in a complete and timely manner. Furthermore, since most existing security solutions for DDoS attack mitigation are tested using datasets and simulated scenarios, their applicability to production networks could be unfeasible or ineffective due to possibly incomplete assumptions in their design. Therefore, automated security solutions against DDoS attacks are needed not only to be designed but also to be implemented and evaluated in real scenarios. This study presents a Software-Defined Networking (SDN)-based security framework, which automates the monitoring, detection, and mitigation of slow-rate DDoS attacks. The framework is implemented in a physical network that uses equipment from the European Experimental Facility Smart Networks for Industry (SN4I). The results demonstrate that the framework effectively mitigates malicious connections, with a mitigation efficiency between 91.66% -100% for different conditions of the number of attackers and victims. In addition, the SDN-SlowRate-DDoS dataset is presented, which contains multiple experiments of slowrate DDoS attacks performed on the real testbed. The resources provided in this security dataset are useful to the scientific and industry communities in designing and testing realistic solutions for intrusion detection systems.INDEX TERMS Dataset, deep learning, slow-rate DDoS, software defined networking (SDN), intrusion detection system (IDS), intrusion prevention system (IPS). CARLOS MARTINEZ-CAGNAZZO received the B.Sc. degree in electrical engineering from Universidad de la Republica, Montevideo, Uruguay, in 1998. He has worked in the internet industry in different roles, including large network design and network security. He is currently the Chief Technical Officer with Latin American Network Address Registry. His research interests include internet measurements, inter-domain routing, BGP security, IPv6, and DNS. He has taught courses on computer networking and cybersecurity and partnered in different research projects trying to bridge the gap between academia and the industry.

Surveying Emerging Trends in DDoS Defense

“…It is a strong and powerful weapon for safeguarding digital systems from the continuously changing threat landscape of the modern age. [3] The combination of SDN (Software-Defined Networking) technologies with DL (Deep Learning) principles is definitely the next big step in cybersecurity, providing organizations with the ability to proactively and in time respond to cyber threats as part of a fully automated security system. SDN-based security frameworks use the centralized control with programability, given by the SDN architecture, as a basis to enhance network visibility, automate defenses and orchestrate the fast reactions to security incidents.…”

“…In general, PUF-based network structures offer a very strong method for authentication, access control, and DDoS attack resistance, thus, it is a good strategy for companies pursuing better cybersecurity. [3] The SDN framework-based security plan with automatic detection and capabilities for response in a timely manner for slow-rate DDoS attacks opens new perspectives to deal with cyberattacks in real time. Using the central control and programmability of SDN helps speeding up a real-time monitoring and mitigation mechanisms that when detecting anomalies indicative of a slow-rate DDoS attacks, the traffic forwarding policies can dynamically be changed ,and the suspicious traffic paths directed to the center for futher processing and filtering too.…”

“…Empirical assessments of the proposed structures have better results than reactive filtering, what reinforces the option of introducing it into the cybersecurity system to harden infrastructures against the DDoS attacks sophistication. [3] Organizations that make use of Software-Defined Networking (SDN)-based automation systems encounter DDoS mitigation effectiveness that is as great as indicated by the studies. The ability of SDN to use the centralized control and programmability is enabling a change in the defense mechanisms of the frameworks, which become dynamic and proactive with the power to identify abnormal connections and block them in realtime.…”

HLD-DDoSDN: High and low-rates dataset-based DDoS attacks against SDN

“…Yungaicela et al, [ 22 ] proposed a DL-based framework for detecting and preventing DDoS attacks. Additionally, they contribute the SDN-SlowRate DDoS dataset, which proves to be more recent and complex than the high-rate DDoS attacks dataset.…”

“…However, this dataset is limited to UDP DDoS attacks, has limited traffic features, and is not publicly available. On the other side [ 22 ], dataset is focusing solely on HTTP slow attacks against victim servers. Therefore, the contributed HLD-DDoSDN dataset considers the prevailing realistic SDN DDoS attack (TCP, UDP, and ICMP) with traffic variation rates (i.e., high-rate and low-rate) and contains 71 statistically qualified traffic features.…”