CATH: an effective method for detecting denial-of-service attacks in software defined networks

Abstract

Software defined networks (SDNs) are innovative networkframeworks that have recently received wide attention. Their programmingflexibility facilitates automatic network management and control, thusmitigating existing issues in the traditional network architecture. However,SDNs face several security risks, in particular denial-of-service (DoS)attacks, the most common and serious network attacks. To address such athreat, an SDN-DoS attack detection method is proposed based on fusingmultiple flow features for describing the network catastrophe between thenormal and the attack state. Several statistic attributes of SDN flowinformation are first chosen as detection features; subsequently, the cuspmodel is used to establish a catastrophe equilibrium surface for SDN states.After being trained, the cusp catastrophe model can be utilized to inferwhether an SDN is under DoS attack. The experimental results demonstratethat the method can effectively and timely perceive SDN-DoS attacks, notonly in simple networks but also in larger enterprise networks.