ADAM: An Adaptive DDoS Attack Mitigation Scheme in Software-Defined Cyber-Physical System

Abstract

With the widespread innovation of the Internet of Things (IoT), Software-Defined Networking (SDN), and Cloud Computing, Cyber-Physical System (CPS) have been developed and widely adopted to facilitate our daily life and economy. In particular, modern society heavily relies on all kinds of CPSs, such as smart grids, and transportation systems. So the shutdown of critical services can lead to serious consequences. Meanwhile, Distributed Denial-of-Service (DDoS) attacks are becoming a major threat to the internet-enabled CPSs due to their ease of execution and the devastation it causes to the target systems. In addition, since the constant updating of attack methods, there is an urgent need for a method to defend against both known and unknown DDoS attacks. In this paper, we present an adaptive DDoS attack mitigation (ADAM) scheme to detect and mitigate DDoS attacks in Software-Defined CPSs. By combining information entropy and unsupervised anomaly detection methods, ADAM can not only automatically determine the current state, but also adaptively identify suspicious features which are thereafter used to mitigate DDoS attacks in a more precise way. We also propose a pipeline filtering mechanism to accurately drop attack traffic, and this method can be implemented in existing SDN networks without additional devices required. Unlike most of the classification-based DDoS mitigation scenarios, we aim to mitigate a wide spectrum of DDoS attacks without defining attack characteristics in advance. Namely, the main goal of ADAM is to effectively and adaptively defend against DDoS attacks that are constantly updating. Real data-driven experimental results show that ADAM has an average mitigation accuracy of 99.13% under high-intensity DDoS attacks. Compared with similar work, our method reduces the false positive rate by 35% <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula> 59%.