SGS: Safe-Guard Scheme for Protecting Control Plane Against DDoS Attacks in Software-Defined Networking

Wang, Yang; Hu, Tao; Tang, Guangming; Xie, Jin; Lu, Jie

doi:10.1109/access.2019.2895092

Cited by 87 publications

(49 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In addition, the knearest neighbor algorithm (KNN) is also a simple and effective machine learning algorithm, which classifies flows by measuring the abstract distance between traffic feature vectors. Peng et al [14] proposed the abnormal traffic detection algorithm, DPTCM-KNN. This algorithm can effectively improve the accuracy of abnormal flow detection, and at the same time reduce the false alarm rate in the process of DDoS detection.…”

Section: A Researches On Ddos Detection and Defense Methodsmentioning

confidence: 99%

A New Framework for DDoS Attack Detection and Defense in SDN Environment

et al. 2020

View full text Add to dashboard Cite

While software defined network (SDN) brings more innovation to the development of future networks, it also faces a more severe threat from DDoS attacks. In order to deal with the single point of failure on SDN controller caused by DDoS attacks, we propose a framework for detection and defense of DDoS attacks in the SDN environment. Firstly, we deploy a trigger mechanism of DDoS attack detection on data plane to screen for abnormal flows in the network. Then, we use a combined machine learning algorithm based on K-Means and KNN to exploit the rate characteristics and asymmetry characteristics of the flows and to detect the suspicious flows determined by the detection trigger mechanism. Finally, the controller will take corresponding actions to defense against the attacks. In this paper, we propose a new framework of cooperative detection methods of control plane and data plane, which effectively improve the detection accuracy and efficiency, and prevent DDoS attacks on SDN. INDEX TERMS Software Defined Network, Distributed Denial of Service (DDoS), collaborative detection, traffic characteristics, detection trigger.

show abstract

Section: A Researches On Ddos Detection and Defense Methodsmentioning

confidence: 99%

A New Framework for DDoS Attack Detection and Defense in SDN Environment

et al. 2020

View full text Add to dashboard Cite

show abstract

“…The results of the study indicated that the proposed scheme is a practical approach. SGS, a safeguard scheme for protecting the control plane against DDoS attacks in SDN, is proposed in [26]. SGS uses a controller's clustering method to deploy multiple controllers in the control plane.…”

Section: B Machine Learning Approachmentioning

confidence: 99%

Bandwidth Control Mechanism and Extreme Gradient Boosting Algorithm for Protecting Software-Defined Networks Against DDoS Attacks

Alamri

Thayananthan

2020

IEEE Access

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is an emerging network architecture that addresses the limitation of the traditional network by providing centralized management through a central controller that decouples the control and data planes. However, this development has made the controller a severe target for malicious users to execute attacks such as Distributed Denial of Service (DDoS) attacks. Several schemes have been proposed to mitigate DDoS attacks in SDN, but the challenges still exist. This paper proposes a DDoS mitigation scheme for SDN to ensure accurate attack detection and efficient network resource utilization. The scheme employs two stages: a bandwidth control mechanism and Extreme Gradient Boosting (XGBoost) Algorithm. The bandwidth control mechanism utilizes an adaptive bandwidth profile-based threshold and bandwidth control algorithm that trigger the XGBoost algorithm in case of threshold violations. The use of multiple bandwidth profiles in stetting the threshold ensures the threshold's adaptivity to consider the network traffic variation and reduce the packets drop ratio, which shows an outstanding result. The XGBoost algorithm classifies network traffic flow that violates a set threshold into normal or abnormal traffic. We evaluated the performance of our scheme using CICDDoS2019, NSL-KDD, and CAIDA datasets. Furthermore, we validated our proposed solution in real-time with the SDN environment. The results obtained show that our scheme protects SDN against DDoS attacks with high accuracy, low error, and efficient utilization of the network resources. The proposed system achieved 99.9% accuracy in detecting DDoS attacks with a low false-positive rate of 0.0002% in SDN.

show abstract

“…Experimental results show that this mechanism performs well in reducing TCAM occupation. Wang et al [12] proposed a safe-guard scheme (SGS), which deployed multiple controllers on the control plane through clustering algorithm to improve the defense capability of the control plane. However, this scheme required high performance of the switch.…”

Section: Related Workmentioning

confidence: 99%

Low-Rate DDoS Attack Detection Based on Factorization Machine in Software Defined Network

Wang

et al. 2020

IEEE Access

View full text Add to dashboard Cite

As the Software Define Network (SDN) adopts centralized control logic, it is vulnerable to various types of Distributed Denial of Service (DDoS) attacks. At present, almost all the research work focuses on high-rate DDoS attack against the SDN control layer. Moreover, most of the existing detection methods are effective for high-rate DDoS attack detection of the control layer, while a low-rate DDoS attack against the SDN data layer is highly concealed, and the detection accuracy against this kind of attack is low. In order to improve the detection accuracy of the low-rate DDoS attack against the SDN data layer, this paper studies the mechanism of such attacks, and then proposes a multi-feature DDoS attack detection method based on Factorization Machine (FM). The features extracted from the flow rules are used to detect low-rate DDoS attacks, and the detection of low-rate DDoS attacks based on FM machine learning algorithms is implemented. The experimental results show that the method can effectively detect the low-rate DDoS attack against the SDN data layer, and the detection accuracy reaches 95.80 percent. Because FM algorithm can achieve fine-grained detection for low-rate DDoS attack, which provides a reliable condition for defending against such attacks. Finally, this paper proposes a defense method based on dynamic deletion of flow rules, and carries out experimental simulation and analysis to prove the effectiveness of the defense method, and the success rate of forwarding normal packets reached 97.85 percent. INDEX TERMS Low-rate denial of service, factorization machine, software defined network, detection, multi-feature.

show abstract

SGS: Safe-Guard Scheme for Protecting Control Plane Against DDoS Attacks in Software-Defined Networking

Cited by 87 publications

References 25 publications

A New Framework for DDoS Attack Detection and Defense in SDN Environment

A New Framework for DDoS Attack Detection and Defense in SDN Environment

Bandwidth Control Mechanism and Extreme Gradient Boosting Algorithm for Protecting Software-Defined Networks Against DDoS Attacks

Low-Rate DDoS Attack Detection Based on Factorization Machine in Software Defined Network

Contact Info

Product

Resources

About