Distributed Denial Of Service Mitigation Research Articles

Smart network security using advanced ensemble-DDoS attack detection and hybrid JA-SLOA-linked optimal routing-based mitigation

ABSTRACT Distributed Denial of Service (DDoS) attacks are distributed at a faster rate, and they are considered to be fatal threats over the Internet. Moreover, several deep learning approaches are insufficient to attain the maximum efficiency and appropriate detection due to the complexity and diversity of DDoS attack traffic under fast fast-speed network environment since they are providing with individual performance. Hence, an ensemble learning model is developed for DDoS detection and mitigation with the hybrid optimization algorithm to ensure good detective performance against DDoS attacks. The pre-processed data is fed to the feature extraction process where it is done through the Deep Belief Network (DBN) and Autoencoder techniques for acquiring the deep features. The optimized fusion of deep features takes place using hybrid meta-heuristic algorithm of Adaptive Sound Speed-based Jaya Sea Lion Optimization (ASS-JSLnO). The attack detection is performed by the Improved Ensemble Learning (IEL) approach. Then, the mitigation strategy is applied by the optimal routing and multi-objective function. Finally, the experiments are made to establish the high detection efficacy of the implemented attack detection and mitigation framework.

A comprehensive survey on DDoS attacks detection & mitigation in SDN-IoT network

The Internet of Things (IoT) has transformed our lives by introducing new services and enhancing productivity. However, the widespread adoption of IoT devices and communication units has posed challenges in network management. In response, there is a growing necessity to rethink and redesign IoT network control. Software-defined networking (SDN) has emerged as a promising solution, leveraging its programmability and centralized management capabilities. SDN can simplify network management, offer network abstraction, facilitate development, and efficiently handle the complexities of IoT networks. Despite these advantages, security concerns, particularly the threat of Distributed Denial of Service (DDoS) attacks, persist in the IoT landscape. This survey focuses on exploring the collaboration between SDN and IoT. It investigates various types of DDoS attacks and highlights different types of defense, detection, and mitigation methods employed to address DDoS threats in SDN-based IoT (SDN-IoT) networks.

DDOS Attack Detection

A Distributed Denial of Service (DDoS) attack is an attempt to make a service unavailable by overwhelming the server with malicious traffic. DDoS attacks have become the most tedious and cumbersome issue in recent past. The number and magnitude of attacks have increased from few megabytes of data to 100s of terabytes of data these days. Due to the differences in the attack patterns or new types of attack, it is hard to detect these attacks effectively. In this paper, we devise new techniques for causing DDoS attacks and mitigation which are clearly shown to perform much better than the existing techniques. We also categorize DDoS attack techniques as well as the techniques used in their detection and thus attempt an extensive scoping of the DDoS problem. We also compare our attack module with a couple of tools available

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

The widespread adoption of software-defined networking (SDN) technology has brought revolutionary changes to network control and management. Compared to traditional networks, SDN enhances security by separating the control plane from the data plane and replacing the traditional network architecture with a more flexible one. However, due to its inherent architectural flaws, SDN still faces new security threats. This paper expounds on the architecture and security of SDN, analyzes the vulnerabilities of SDN architecture, and introduces common distributed denial of service (DDoS) attacks within the SDN architecture. This article also provides a review of the relevant literature on DDoS attack detection and mitigation in the current SDN environment based on the technologies used, including statistical analysis, machine learning, policy-based, and moving target defense techniques. The advantages and disadvantages of these technologies, in terms of deployment difficulty, accuracy, and other factors, are analyzed. Finally, this study summarizes the SDN experimental environment and DDoS attack traffic generators and datasets of the reviewed literature and the limitations of current defense methods and suggests potential future research directions.

Advancements in Time Series-Based Detection Systems for Distributed Denial-of-Service (DDoS) Attacks: A Comprehensive Review

Distributed denial-of-service assaults, often known as DDoS attacks, pose a significant danger to the stability and security of the internet, particularly in light of the increasing number of devices that are linked to the internet. Intelligent detection systems are absolutely necessary in order to lessen the impact of distributed denial of service assaults. In this study, a comprehensive overview of recent research on intelligent approaches, such as Machine Learning (ML), Deep Learning (DL), and Artificial Intelligence (AI), is presented. The review focuses on the application of these techniques in the detection of Distributed Denial of Service (DDoS) assaults. In addition to providing a taxonomy and conceptual framework for DDoS mitigation, the study places particular emphasis on the application of time series data analysis for the detection of distributed denial of service attacks. A number of different intelligent techniques are investigated in this paper. Some of these techniques include clustering, deep reinforcement learning, graph neural networks, support vector machines, and others. For the purpose of performance evaluation, real datasets are utilized, and prospective future research areas in this area are explored.

Cyber-Secure SDN: A CNN-Based Approach for Efficient Detection and Mitigation of DDoS attacks

Software Defined Networking (SDN) has become popular due to its flexibility and agility in network management, enabling rapid adaptation to changing business requirements, enhancing network performance, and reducing operational costs. However, the ubiquity of internet-based services has given rise to an alarming increase in cyber-attacks, posing serious threats to the security and stability of modern networks. Among these attacks, Distributed Denial of Service (DDoS) attacks have emerged as one of the most devastating, capable of disrupting critical services. Recent studies have shown that Deep Learning (DL) techniques with Software-defined networking have the potential to mitigate these threats effectively. However, existing solutions suffer from issues such as reliance on pre-defined rules and signatures, computational efficiency, low detection rates, and inefficient notification mechanisms, making them ineffective in detecting DDoS attacks. This paper proposes an efficient approach (BRS + CNN) using Balanced Random Sampling (BRS) and Convolutional Neural Networks (CNNs) to detect DDoS attacks in SDN environments. We have applied various mitigation techniques to mitigate these threats, such as filtering, rate limiting, and iptables rule for blocking spoofed IPs. In addition, we introduce a monitoring system that utilizes rate-limiting to oversee blocked IP addresses, ensuring that legitimate traffic is processed efficiently. The proposed model achieves high performance in binary and multi-classification, with an accuracy of over 99.99% for binary classification and 98.64% for multi-classification. Our proposed DDoS detection system not only detects the attack but also sends detailed contextual information to a designated email address. We compare our model with existing literature and demonstrate its superiority using Area Under The Curve (AUC) analysis. Moreover, we evaluated the efficiency and effectiveness of our proposed DDoS mitigation system by conducting a series of experiments across three distinct scenarios: Attack-Free, Attack-No Mitigation, and Attack-Mitigation. These results demonstrate the robustness of our proposed mitigation system in effectively combating DDoS attacks while also safeguarding the seamless continuity of regular network operations.

Mitigating DDoS attacks in cloud computing using machine learning algorithms

Distributed Denial of Service (DDoS) attacks pose a significant threat to the availability and performance of cloud computing systems. As these attacks continue to evolve in complexity and scale, traditional mitigation techniques may prove insufficient. This research explores the application of machine learning algorithms as an intelligent and adaptive approach to enhance DDoS detection and mitigation in cloud environments.The study leverages the dynamic and scalable nature of cloud computing to implement a robust defence mechanism against DDoS attacks. Machine learning models, such as supervised and unsupervised learning algorithms, are trained on network traffic data to identify patterns indicative of DDoS activity. The proposed system adapts to evolving attack strategies and is capable of real-time analysis, ensuring swift responses to emerging threats.

ML-DDoS: A Blockchain-Based Multilevel DDoS Mitigation Mechanism for IoT Environments

Distributed denial of service (DDoS) attacks as well as botnet-based attacks are among the most important security vulnerabilities in Internet of Things (IoT) environments. Most of the existing research approaches use centralized defense mechanisms to prevent DDoS attacks in IoT environments. However, it is important to provide a reliable and scalable solution to prevent DDoS attacks. Combining technologies such as distributed blockchain-based mechanisms and smart contracts facilitates the construction of a trusted distributed framework that can defend against DDoS attacks in IoT. In this article, we have proposed a multilevel DDoS mitigation approach (ML-DDoS) to protect IoT devices and other computing resources or machines using the blockchain-based framework. The core concept of the proposed system is to use a device-based verification mechanism using blockchain and exclude malicious devices from IoT environments. The proposed framework was developed using Hyperledger Caliper (a blockchain benchmark tool) and its performance was evaluated using three benchmark applications. Compared to the state of the art, the results show that the proposed framework achieves up to 35% improvement in throughput, up to 40% improvement in latency, and up to 25% better utilization of CPU.

DDoS family: A novel perspective for massive types of DDoS attacks

Distributed Denial of Service (DDoS) defense is a profound research problem. In recent years, adversaries tend to complicate their attack strategies by crafting vast DDoS variants. On the one hand, this trend exacerbates both extremes of classification granularity (i.e., binary and attack level) in existing machine learning methods. On the other hand, massive attack categories make the filter rule table bulky, as well as cause problems of slow reaction presented in the recent state-of-the-art DDoS mitigation system. Therefore, we propose the concept of a DDoS family to reconcile/cope with these issues. The specific technical roadmap includes traffic pattern characterization, attack fingerprint production, and cross-executed family partition by community detection. Through extensive evaluations, we demonstrate the benefits of the proposal in terms of portraying similarities, guiding model classification/unknown attack detection, optimizing defense strategies, and speeding filtering reactions. For instance, our results show that using only one rule can defend 15 types of attacks due to their homogeneous behavioral representation. Particularly, we find the interesting observation that counting the backward packet is more efficient and robust against some attacks (e.g., Tor's Hammer Attack), which is very different from previous solutions.

DDoS attack detection and mitigation using deep neural network in SDN environment

In the contemporary digital landscape, the escalating threat landscape of cyber attacks, particularly distributed denial-of-service (DDoS) attacks, has become a paramount concern for network security. This research introduces an innovative approach to DDoS detection leveraging a deep neural network (DNN) architecture rooted in deep learning (DL) principles. The proposed model exhibits a scalable and adaptable framework, enabling meticulous analysis of network traffic data to discern intricate patterns indicative of DDoS attacks. To validate the efficacy of our methodology, rigorous evaluations were conducted using authentic real-world traffic data. The results unequivocally establish the superiority of our DNN-based approach over traditional DDoS detection techniques. This research holds significant promise for bolstering network security, particularly within the dynamic landscape of software-defined network (SDN) environments. The study's findings contribute to the continual refinement and eventual deployment of advanced measures in fortifying digital infrastructure against the evolving threat landscape. Performance metrics, including detection accuracy and loss rates, further emphasize the effectiveness of our approach across different datasets. With detection accuracy rates of 99.98%, 100%, and 99.99% for the InSDN, CICIDS2018, and Kaggle DDoS datasets, respectively, coupled with low loss rates, our DNN-based model demonstrates robust capabilities in mitigating contemporary DDoS threats. This study not only presents a novel DDoS detection approach within SDN infrastructures but also offers insights into practical implications and challenges associated with deploying DNNs in real-world SDN environments. Network security professionals can benefit from the nuanced perspectives provided, contributing to the ongoing discourse on fortifying digital networks against evolving cyber threats.

Distributed Denial of Service Classification for Software-Defined Networking Using Grammatical Evolution

Software-Defined Networking (SDN) stands as a pivotal paradigm in network implementation, exerting a profound influence on the trajectory of technological advancement. The critical role of security within SDN cannot be overstated, with distributed denial of service (DDoS) emerging as a particularly disruptive threat, capable of causing large-scale disruptions. DDoS operates by generating malicious traffic that mimics normal network activity, leading to service disruptions. It becomes imperative to deploy mechanisms capable of distinguishing between benign and malicious traffic, serving as the initial line of defense against DDoS challenges. In addressing this concern, we propose the utilization of traffic classification as a foundational strategy for combatting DDoS. By categorizing traffic into malicious and normal streams, we establish a crucial first step in the development of effective DDoS mitigation strategies. The deleterious effects of DDoS extend to the point of potentially overwhelming networked servers, resulting in service failures and SDN server downtimes. To investigate and address this issue, our research employs a dataset encompassing both benign and malicious traffic within the SDN environment. A set of 23 features is harnessed for classification purposes, forming the basis for a comprehensive analysis and the development of robust defense mechanisms against DDoS in SDN. Initially, we compare GenClass with three common classification methods, namely the Bayes, K-Nearest Neighbours (KNN), and Random Forest methods. The proposed solution improves the average class error, demonstrating 6.58% error as opposed to the Bayes method error of 32.59%, KNN error of 18.45%, and Random Forest error of 30.70%. Moreover, we utilize classification procedures based on three methods based on grammatical evolution, which are applied to the aforementioned data. In particular, in terms of average class error, GenClass exhibits 6.58%, while NNC and FC2GEN exhibit average class errors of 12.51% and 15.86%, respectively.

Implementing a Machine Learning based Hybrid Model to Counter Attacks in Mobile Edge Computing

This study focuses on the security of 5G mobile network major technology called Multi-Access Edge Computing (MEC) and its susceptibility to distributed denial of service (DDoS) attacks. The goal of the research is to address the effects of DDoS attacks and implement effective mitigation techniques. Several supervised Machine Learning (ML) techniques, which include Random Forest (RF), Decision Tree, Naïve Bayes, K-Nearest Neighbour, Logistics Regression, and Blending/Stack Model, are evaluated using multiple performance metrics such as accuracy, detection/recall, F1-Measure, Matthew’s correlation coefficient, Receiver Operating Characteristic, and Area Under Receiver Operating Characteristic. According to literature, ML algorithms achieve the best performance in mitigating DDoS attacks, therefore, they can be optimized to enhance their effectiveness. The research provides an overview of the existing mitigation schemes in the MEC and proposes a DDoS mitigation scheme. The findings show that hybrid models outperformed traditional ML models. Among the mitigation techniques evaluated, RF proved to be the most effective in mitigating DDoS attacks in MEC.

DDoS Mitigation by Blockchain With Approach of Cost Model

Computer networks and internet services are increasingly threatened by attacks like Distributed Denial-of-Service (DDoS). DDoS attack mitigation techniques now in use are ineffective due to a lack of resources and a lack of adaptability. Using blockchains like Ethereum, DDoS attacks can be thwarted in innovative ways. With smart contracts, it is possible to track down the IP addresses of attackers without additional hardware. This study examines blockchain-based solutions to combat DDoS attacks for feasibility, effectiveness, as well as cost and performance. The cost model delves into economic aspects like gas, gas price, and Ether value. In it, the evaluation of various smart contracts for the signalization of DDoS attacks is documented and compared to assess three system variants, analyzing gas costs, deployment, speed, and accuracy. It also details Ethereum's ecosystem and how that affects smart contract design and it also acknowledges scalability challenges and suggests outsourcing data for a more scalable solution, advocating for specialized blockchains for DDoS signaling applications. The analysis provides insights into the gas costs associated with different variants, considering various scenarios and highlighting the trade-offs and efficiencies of each approach.

Detecting and mitigating DDoS attacks with moving target defense approach based on automated flow classification in SDN networks

The Distributed Denial of Service (DDoS) coordinates synchronized attacks on systems on the Internet using a set of infected hosts (bots). Bots are programmed to attack a determined target by firing a lot of synchronized requests, causing slowness or unavailability of the service. This type of attack has recently grown in magnitude, diversity, and economic cost. Thus, this paper presents a DDoS detection and mitigation architecture based on Software Defined Networking (SDN). It considers the Moving Target Defense (MTD) approach, redirecting malicious floods to expendable low-capacity servers to protect the main server while discouraging the attacker. The redirecting decision is based on a sensor, that employs Machine Learning (ML) algorithms for flow classification. When malicious flows are detected, the sensor notifies the SDN controller to include them in the malicious hosts lists and to realize the redirection. The validation and evaluation of the proposed architecture are conducted by simulation. Results considering different classification models (probabilistic, linear model, neural networks, and trees) and attack types indicate that the proposed architecture is efficient in detecting and mitigating DDoS attacks in approximately 3 seconds.

P4-HLDMC: A Novel Framework for DDoS and ARP Attack Detection and Mitigation in SD-IoT Networks Using Machine Learning, Stateful P4, and Distributed Multi-Controller Architecture

Distributed Denial of Service (DDoS) and Address Resolution Protocol (ARP) attacks pose significant threats to the security of Software-Defined Internet of Things (SD-IoT) networks. The standard Software-Defined Networking (SDN) architecture faces challenges in effectively detecting, preventing, and mitigating these attacks due to its centralized control and limited intelligence. In this paper, we present P4-HLDMC, a novel collaborative secure framework that combines machine learning (ML), stateful P4, and a hierarchical logically distributed multi-controller architecture. P4-HLDMC overcomes the limitations of the standard SDN architecture, ensuring scalability, performance, and an efficient response to attacks. It comprises four modules: the multi-controller dedicated interface (MCDI) for real-time attack detection through a distributed alert channel (DAC), the MSMPF, a P4-enabled stateful multi-state matching pipeline function for analyzing IoT network traffic using nine state tables, the modified ensemble voting (MEV) algorithm with six classifiers for enhanced detection of anomalies in P4-extracted traffic patterns, and an attack mitigation process distributed among multiple controllers to effectively handle larger-scale attacks. We validate our framework using diverse test cases and real-world IoT network traffic datasets, demonstrating high detection rates, low false-alarm rates, low latency, and short detection times compared to existing methods. Our work introduces the first integrated framework combining ML, stateful P4, and SDN-based multi-controller architecture for DDoS and ARP detection in IoT networks.

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers.

Software defined networking (SDN) improves the flexibility and programmability of the network by separating the control plane and the data plane and effectively realizes the global control of the network infrastructure. However, the centralized structure design of SDN exposes the controller to potential threats. Attackers have used the active flow table delivery mode to launch distributed denial of service (DDoS) attacks on the SDN controller, resulting in the controller failure and seriously affecting the network performance. To overcome this problem, this paper proposes a defense framework called CC-Guard. The framework consists of four modules: attack detection triggering, switch migration, anomaly detection, and mitigation. Among them, the attack detection trigger module improves the system's timely response to DDoS attacks. The switch migration module effectively unclogs the controller congestion problem and provides convenience for network flow transmission. The anomaly detection module uses a coarse-grained method for two-stage detection, which improves the detection accuracy. The mitigation module uses the idea of cross-domain cooperation of the controller to clear the abnormal flow in the blacklist. Experimental results show that our proposed CC-Guard has real-time DDoS attack defense capability and high detection accuracy, as well as efficient network resource utilization.

ADAM: An Adaptive DDoS Attack Mitigation Scheme in Software-Defined Cyber-Physical System

With the widespread innovation of the Internet of Things (IoT), Software-Defined Networking (SDN), and Cloud Computing, Cyber-Physical System (CPS) have been developed and widely adopted to facilitate our daily life and economy. In particular, modern society heavily relies on all kinds of CPSs, such as smart grids, and transportation systems. So the shutdown of critical services can lead to serious consequences. Meanwhile, Distributed Denial-of-Service (DDoS) attacks are becoming a major threat to the internet-enabled CPSs due to their ease of execution and the devastation it causes to the target systems. In addition, since the constant updating of attack methods, there is an urgent need for a method to defend against both known and unknown DDoS attacks. In this paper, we present an adaptive DDoS attack mitigation (ADAM) scheme to detect and mitigate DDoS attacks in Software-Defined CPSs. By combining information entropy and unsupervised anomaly detection methods, ADAM can not only automatically determine the current state, but also adaptively identify suspicious features which are thereafter used to mitigate DDoS attacks in a more precise way. We also propose a pipeline filtering mechanism to accurately drop attack traffic, and this method can be implemented in existing SDN networks without additional devices required. Unlike most of the classification-based DDoS mitigation scenarios, we aim to mitigate a wide spectrum of DDoS attacks without defining attack characteristics in advance. Namely, the main goal of ADAM is to effectively and adaptively defend against DDoS attacks that are constantly updating. Real data-driven experimental results show that ADAM has an average mitigation accuracy of 99.13% under high-intensity DDoS attacks. Compared with similar work, our method reduces the false positive rate by 35% <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula> 59%.

EXPLORING THE LANDSCAPE OF SDN-BASED DDOS DEFENSE: A HOLISTIC EXAMINATION OF DETECTION AND MITIGATION APPROACHES, RESEARCH GAPS AND PROMISING AVENUES FOR FUTURE EXPLORATION

Over the course of time, a multitude of security solutions have been proposed in order to safeguard the Internet architecture from an extensive array of malware threats. However, the task of ensuring the security of the Internet and its associated applications remains an ongoing research challenge. Researchers persistently delve into the exploration of innovative network architectures, such as the utilization of HTTP as the narrow waist, the implementation of Named Data Networking (NDN), the development of programmable networks, and the adoption of Software-Defined Networking (SDN), with the aim of designing a more dependable and resilient network infrastructure. Among these alternative approaches, SDN has emerged as a robust and secure solution for countering malicious activities. By separating the control plane from the data plane, SDN provides an array of advantages, including enhanced manageability, improved control, dynamic rule updates, advanced analysis capabilities, and a comprehensive network overview facilitated by a centralized controller. Despite its superiority over conventional IP-based networks, SDN is susceptible to various network intrusions and encounters significant challenges in terms of deployment. The purpose of this paper is to conduct a comprehensive review of approximately 70 prominent mechanisms employed for the detection and mitigation of Distributed Denial of Service (DDoS) attacks in SDN networks. These mechanisms are systematically categorized into four main groups, namely information theory-based methods, machine learning-based methods, approaches based on Artificial Neural Networks (ANN), and other miscellaneous methods. Furthermore, the paper identifies and discusses several unresolved research issues and gaps that exist in the deployment of a secure DDoS defense solution within SDN networks. The objective of this comprehensive review is to provide valuable insights to the research community, assisting in the development of more robust and reliable DDoS mitigation solutions that are specifically tailored for SDN networks.

Zero-Touch Security Management for mMTC Network Slices: DDoS Attack Detection and Mitigation

massive Machine Type Communications (mMTC) network slices in 5G aim to connect a massive number of MTC devices, opening the door for a widened attack surface. Network slices are well isolated, resulting in a low impact on other running slices when attackers control IoT devices belonging to a mMTC network slice (i.e., in-slice attack). However, the impact of the in-slice attacks on the shared infrastructure components with other slices, such as the 5G Core Network (CN), can be harmful, considering the massive number that can be part of mMTC slice. In this paper, we propose a zero-touch security management solution that uses Machine Learning (ML) to detect and mitigate in-slice attacks on 5G CN components, focusing on Distributed Denial of Service (DDoS) attacks. To this aim, we propose: (1) a novel closed-control loop that assists the 5G CN in detecting and mitigating attacks; (2) a ML algorithm that predicts the upper bound of expected MTC devices Attach Requests during a time interval (or an event); (3) a detection algorithm that analyzes an event and uses the ML output to compute a probability that a specific device has participated to an attack; (4) a mitigation algorithm that disconnects and blocks MTC devices suspected to be part of an attack; (5) a Proof of concept implementation on top of a 5G facility.

Mitigation and Detection of DDOS attacks using Software Defined Network (SDN) and Machine Learning

Abstract: An emerging networking paradigm called Software Defined Networking (SDN) enables network control to be restricted to a logically centralized controller. This makes network visibility and management simpler on a global scale. SDN is a suitable network model for extensive deployment in real-world settings since it can be programmed using high-level programming languages. SDN is still vulnerable to a number of network attacks, the most notable of which being the DDoS (distributed denial of service) attack. A DDoS attack has the potential to render the controller, the brain of SDN, inoperable. SDN security is still in its infancy, and both business and academics have done a lot of research in this area. The SDN DDoS mitigation strategy utilizing machine learning (ML) is the main topic of this study. This work also surveys network traffic aspects for DDoS detection