Abstract
While software defined network (SDN) brings more innovation to the development of future networks, it also faces a more severe threat from DDoS attacks. In order to deal with the single point of failure on SDN controller caused by DDoS attacks, we propose a framework for detection and defense of DDoS attacks in the SDN environment. Firstly, we deploy a trigger mechanism of DDoS attack detection on data plane to screen for abnormal flows in the network. Then, we use a combined machine learning algorithm based on K-Means and KNN to exploit the rate characteristics and asymmetry characteristics of the flows and to detect the suspicious flows determined by the detection trigger mechanism. Finally, the controller will take corresponding actions to defense against the attacks. In this paper, we propose a new framework of cooperative detection methods of control plane and data plane, which effectively improve the detection accuracy and efficiency, and prevent DDoS attacks on SDN.
Highlights
Software defined network (SDN) has become a revolutionary network paradigm
Distributed Denial of Service (DDoS) DETECTION AND DEFENSE IN SDN ENVIRONMENT The DDoS detection and defense framework we proposed includes the trigger mechanism for DDoS attacks detection on data plane, the combined machine learning algorithm based on K-Means and k-nearest neighbor algorithm (KNN) on the controller for detecting the suspicious flows found by the detection trigger mechanism and the DDoS attack defense mechanism
In order to solve this problem, we introduce a detection trigger mechanism in this paper which determines the start time of DDoS attack detection through the trigger mechanism
Summary
Software defined network (SDN) has become a revolutionary network paradigm. It can meet the growing demands of future networks, and it is increasingly used in data centers and operator networks. Our contributions are summarized as follows: 1) We deploy a DDoS detection trigger mechanism on the data plane This mechanism uses the CPU resources of switches to count the sending rate of packet_in messages on switches. In literature [11], the author uses sFlow technology to sample network traffic, which is compared with SDN’s own flow table collection method based on OpenFlow (OF) protocol and effectively reduces the overhead of control plane. DDoS DETECTION AND DEFENSE IN SDN ENVIRONMENT The DDoS detection and defense framework we proposed includes the trigger mechanism for DDoS attacks detection on data plane, the combined machine learning algorithm based on K-Means and KNN on the controller for detecting the suspicious flows found by the detection trigger mechanism and the DDoS attack defense mechanism.
Sign-in/Register to view highlights & summary 
Published Version (
Free)
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call