Parallel path selection mechanism for DDoS attack detection

Abstract

DDoS attack have always been a polular topic in the field of network security. As an emerging networking paradigm, SDN’s characteristics such as centralized control and management and monitoring flow-based traffic make it an ideal platform to detect DDoS attacks. NFV can reduce equipment costs, simplify operation complexity, and improve operation performance, which provides a major opportunity for effective DDoS detection. Thus, with the help of SDN/NFV technology, this paper proposes a parallel path selection method to detect various types of DDoS attacks. This article virtualizes detection methods as service functions, and combines different service functions to form sequential paths. We first propose a HABS method to parallelize the service functions and construct a parallel path set. Then, we propose a PPCP method to reduce the delay between parallel branches. Next, the parallel path selection problem is formulated as a MDP. Then, we propose a QLBP method to choose the optimal path that balance detection performance, delay and load. Finally, the proposed QLBP method is deployed in a prototype system. We validate the performance of the QLBP method under various DDoS attack scenarios. Besides, we compare the path performance before and after applying the QLBP method. The experimental results indicate that this method can provide optimal parallel path against different attack types.