TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Shen, Yi; Wu, Chunming; Kong, Dezhang; Yang, Mingyong

doi:10.1109/icc40277.2020.9149276

Cited by 7 publications

(4 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…[59], [60], [61], [62], [63], [64], [65], [66], [67], [68], [69], [70], [71], [72], [73], [74], [75], [76], [77], [78], [79], [80], [81], [82], [83], [84], [85], [86], [87], [88], [89], [90], [91], [92], [93], [94], [95], [96], [97], [98], [99] IM 5 3.0 % [100], [101], [102], [103], [104] NOMS 15 9.0 % [105], [106], [107], [108], [109], [110],…”

Section: Publication Venuesunclassified

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

Dietz,

Mühlhauser,

Kögel

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Intrusion Detection Systems (IDS) tackle the challenging task of detecting network attacks as fast as possible. As this is getting more complex in modern enterprise networks, Artificial Intelligence (AI) and Machine Learning (ML) have gained substantial popularity in research. However, their adoption into real-world IDS solutions remains poor. Academic research often overlooks the interconnection of users and technical aspects. This leads to less explainable AI/ML models that hinder trust among AI/ML non-experts. Additionally, research often neglects secondary concerns such as usability and privacy. If IDS approaches conflict with current regulations or if administrators cannot deal with attacks more effectively, enterprises will not adopt the IDS in practice. To identify those problems systematically, our literature survey takes a user-centric approach; we examine IDS research from the perspective of stakeholders by applying the concept of personas. Further, we investigate multiple factors limiting the adoption of AI/ML in security and suggest technical, non-technical, and user-related considerations to enhance the adoption in practice. Our key contributions are threefold. (i) We derive personas from realistic enterprise scenarios, (ii) we provide a set of relevant hypotheses in the form of a review template, and (iii), based on our reviews, we derive design guidelines for practical implementations. To the best of our knowledge, this is the first paper that analyzes practical adoption barriers of AI/ML-based intrusion detection solutions concerning appropriateness of data, reproducibility, explainability, practicability, usability, and privacy. Our guidelines may help researchers to holistically evaluate their AI/ML-based IDS approaches to increase practical adoption.

show abstract

Section: Publication Venuesunclassified

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

Dietz,

Mühlhauser,

Kögel

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Other than the reviewed ML-DL-based IDS solutions in SDN, researchers all over the world also adopted numerous other technologies to detect various attacks in the context of SDNs. For instance, statistics algorithms [37], [111], [253]- [255], [134], [144], [159], [167], [170]- [172], [226], similarity-based methods [256], graph model-based methods [257]- [259], third-party software like Snort [57], [94], [95], [260]- [262], threshold-based methods [51], [108], [254], [263], [264], fuzzy evaluations [265]- [267], inference-based methods [257], [268], blockchainbased methods [269]- [271], and honeynet-based methods [71], [272]- [274].…”

Section: Random Forest (Rf)mentioning

confidence: 99%

Intrusion Detection System in Software-Defined Networks Using Machine Learning and Deep Learning Techniques –A Comprehensive Survey

Rayhan¹,

Islam²,

Shatabda³

et al. 2022

Preprint

View full text Add to dashboard Cite

<div>At present, the Internet is facing numerous attacks of different kinds that put its data at risk. The safety of information within the network is, therefore, a significant concern. In order to prevent the loss of incredibly valuable information, the Intrusion Detection System (IDS) was developed to recognize the outbreak of a stream of attacks and notify the network system administrator providing network security. IDS is an extrapolative model used to detect network traffic as routine or attack. Software-Defined Networks (SDN) is a revolutionary paradigm that isolates the control plane from the data plane, transforming the concept of a software-driven network. Through this data and control plane separation, SDN provides us the opportunity to create a manageable and programmable network, allowing applications in the top plane to access physical devices via the controller. The controller functioning inside the control plane executes network modules and establishes flow rules to forward packets in the switches residing in the data plane. Cyber attackers target the SDN controller to subdue the control plane, which is considered the brain of the SDN, providing a plethora of functionalities such as regulating flow control to switches or routers in the data plane below via southbound Application Programming Interfaces (APIs) and business and application logic in the application plane above via northbound APIs to implement sophisticated networks. However, the control plane becomes a tempting prospect for security attacks from adversaries because of its centralization feature. This paper includes an in-depth overview of the notable published articles from 2015 to 2021 that used Machine Learning (ML) and Deep Learning (DL) techniques to construct an IDS solution to provide security for SDN. We also present two detailed taxonomic studies regarding IDS, and ML-DL techniques based on their learning categories, exploring various IDS solutions to secure the SDN paradigm. We have also conducted brief research on a few benchmark datasets used to construct IDS in the SDN paradigm. To conclude the survey, we provide a discussion that sheds light on continuous challenges and IDS issues for SDN security.</div>

show abstract

“…According to the above description, δq(t) and δW(t) in the queue model (2) under DDoS attacks will be transformed as follows:…”

Section: Attack Model As Depicted Inmentioning

confidence: 99%

“…e motivations of DDoS attacks range from commercial competition to extortion and even political motives. ere are growing research interests on DDoS attacks, mainly including detecting DDoS attacks and mitigating DDoS attacks [1][2][3]. e biggest disadvantage of intrusion detection system (IDS), as a DDoS defense platform, is that IDS can only detect the attacks, but it does nothing to alleviate the attacks [4,5].…”

Section: Introductionmentioning

confidence: 99%

Stability of SDE-LJN System in the Internet to Mitigate Constant-Rate DDoS Attacks

Huang

Tan

Peng

2021

Security and Communication Networks

View full text Add to dashboard Cite

The Internet is nowadays suffering dramatically serious attacks, with the distributed denial of service (DDoS) attacks being the representative and dominant ones. It is seen that, to stabilize the buffer queue length around a given target under DDoS attacks in the relevant routes is vitally important and helpful to mitigate the attacks and to improve the quality of service (QoS) for normal users. In the current paper, a stochastic queue dynamic model with L e ´ vy jump noise, which is affected by the continuous Brownian motion and the discontinuous Poisson process, is worked out to develop a novel and accurate mathematical framework for the stability of a route queue that deals with constant-rate DDoS attacks. This article proposes a security defensive mechanism in the network for solving the network collapse that can possibly be caused by DDoS attacks, otherwise. Particularly, based on the formulation of a stochastic queue dynamic with L e ´ vy jump noise, the mechanism that characterizes the behavior of the queue at routers is presented for stabilizing the queue length under constant-rate DDoS attacks. By applying the stochastic control theory into analyzing the performance of queue dynamic under constant-rate DDoS attacks, some explicit conditions are established under which the instantaneous queue length converges to any given target in a route. Simulation results demonstrate the satisfaction of the proposed defense mechanism with sharp contrast to the state of the art active queue management (AQM) schemes.

show abstract

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Cited by 7 publications

References 15 publications

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

Intrusion Detection System in Software-Defined Networks Using Machine Learning and Deep Learning Techniques –A Comprehensive Survey

Stability of SDE-LJN System in the Internet to Mitigate Constant-Rate DDoS Attacks

Contact Info

Product

Resources

About