Mitigate Distributed Denial Of Service Attacks Research Articles

Empowering DDoS Attack Mitigation with Programmable Switches

Distributed denial-of-service (DDoS) attacks have long been the most severe and destructive attack on modern networks. Some solutions place several middleboxes that run security-oriented network functions (SNFs) in the network to defend against DDoS attacks. However, middleboxes are proprietary and fixed-function, making them costly and inflexible when handling attack dynamics. Another class of solutions exploits the capability of software-defined networking (SDN) and network function virtualization (NFV) to run virtualized SNFs on commodity servers. This reduces the cost of DDoS attack mitigation while enabling high flexibility by dynamically removing or adding SNF instances. However, this class of solutions sacrifices packet processing performance and incurs non-trivial end-to-end latency, which is unacceptable for many latency-sensitive Internet services. Recently, the emergence of programmable switches brings a promising alternative solution: arbitrary SNFs can be directly performed in line-rate ASIC pipelines of programmable switches, enabling low-cost, flexible, and high-performance DDoS attack mitigation. In this article, we present an illustrative survey of recent solutions that leverage programmable switches to provide DDoS attack mitigation. Our survey can help understand how to make full use of the benefits of programmable switches to defend against DDoS attacks.

Design and implementation of computer network security protection system based on artificial intelligence technology

Abstract With the rapid development of the Internet, security issues are becoming more and more prominent, and since most information is transmitted through the Internet today, Internet security is particularly important. When the Internet was designed, only mutual compatibility and interoperability between networks were considered, and security issues were not fully considered. As a result, as the Internet continues to grow, security issues are becoming more and more serious. One of the more difficult attacks is the Distributed Denial of Service (DDoS) attack, which has many forms of attacks, is harmful, and is difficult to identify and defend. Therefore, building a global Internet security protection system to achieve effective protection against DDoS attacks is the main work of this research paper. In this paper, we propose an artificial intelligence DDoS attack protection system, which implements a controller and switch auto-detection model by extending the protocol and establishing an optimization model to realize a low-load and low-latency traffic monitoring scheme; for DDoS attacks. We propose the attack inspection algorithm SCVAE based on Variational Encoder (VAE) and Spectral Clustering. in order to mitigate DDoS attack traffic, the protection system uses the QoS traffic control method, builds the application flow hierarchy model, and filters the attack traffic endured by the system by setting the application flow bandwidth limit as well as the traffic priority dual policy. Finally, a Mininet-based simulation test environment is built to evaluate the model, and different test indexes are set for different system modules to evaluate their actual performance. The results of this paper show that in the network traffic monitoring test, the artificial intelligence DDoS attack protection algorithm can respond to the attack more quickly by reducing the average 73ms per sampling compared with other algorithms; in the attack traffic identification test, the comparison accuracy (P) is improved by 15.14%, the accuracy (AC) is improved by 13.26%, the recall (R) is reduced by 9.23%, and the F1 measurement criteria improved by 23%. The test verifies that the artificial intelligence DDoS attack protection system can achieve real-time monitoring of each performance parameter and also illustrates the feasibility and practicality of the research content of this paper, which strengthens the construction of the technical means of Internet security protection and further enhances the Internet security defense capability.

Analyzing effective mitigation of DDoS attack with software defined networking

Distributed Denial of Service (DDoS) attack prevention research is mostly focused upon attack detection. Early attack detection facilitates the network administrator to quickly manage these attacks with least impact on the legitimate users. The approach generally used to manage/mitigate the DDoS attacks is to start dropping the attack/suspicious flows at the location of detection, which affects the communication of legitimate users of the network as well. This paper is focused on comparing the DDoS attack mitigation approaches, as well as, the location of mitigation in the network that will impose the least impact on the legitimate users in the network, resulting in least network performance degradation. A mathematical analysis of packet filtering, rate limiting and controller/server migration techniques for mitigation of DDoS attacks is done, followed by Mininet implementation with realistic traffic. It provides a detailed insight of the pros and cons of respective techniques w.r.t. various network requirements. Further, the identification of appropriate location to deploy desired mitigation technique is done.

DDoS attack modeling and resistance using trust based protocol for the security of Internet of Things

The rapid growth of Internet of Things (IoT) devices has led to an increase in security challenges, particularly for wireless sensor networks (WSNs). This work addresses the issue of distributed denial of service (DDoS) attacks in the IoT environment, with a focus on replay attacks. This study introduces a novel technique to counter reactive DDoS attacks in the Internet of Things (IoT) environment. The objective is to enhance the security of the IoT by preventing and mitigating DDoS attacks. The proposed technique involves the use of a dynamic frequency hopping mechanism that shifts the operating frequency of the system in real-time, making it difficult for the attacker to interfere with the system. The simulation-based methodology based on network simulator was employed to evaluate the performance of the proposed technique. Results show that the proposed technique effectively reduces the impact of reactive DDoS attacks by up to 95%, with minimal overhead on the system. The evaluation proved that our work outperforms state-of-the-art schemes such as EDDK and HAPOSCO in terms of computational cost, throughput, and delay. Performance metrics considered in the evaluation include energy consumption, packet loss, and computational time Overall, the study demonstrates the effectiveness of the proposed technique in enhancing the security of IoT systems against reactive attacks.

A Transfer Double Deep Q Network Based DDoS Detection Method for Internet of Vehicles

Distributed denial of service (DDoS) attacks have become one of the main factors restricting the development of internet of vehicles (IoV). Although some intelligent reinforcement learning based methods have been introduced to mitigate DDoS attacks, there are still many constraints in the training process, such as the long training time and dependence on large labeled data. In this paper, we propose a transfer double deep Q-network (DDQN) based DDoS detection method for IoV. By constructing a Kalman filter based reinforcement learning model, we can constantly improve the performance of DDoS detection in DDQN without depending on large labeled data. Furthermore, by utilizing the knowledge obtained by adjacent similar base stations, we design a transfer DDQN method based on traffic flow similarity to speed up the training of DDQN for a newly added base station. This enables the new base station to obtain DDoS detection policies quickly. We compare our proposed method with other popular machine learning based DDoS detection methods. The experimental results show that the transfer DDQN based DDoS detection method improves F1-measure and detection accuracy by 79.4% and 17.5% on average. Meanwhile, by means of traffic flow similarity based transfer learning, the time consumption and convergence time can be reduced by 41.3% and 31.1%, which makes our method adapt to the dynamic network.

Using Machine Learning in Software Defined Networks to Recognize and Avoid DDOS Attacks

Abstract: In recent years, Distributed Denial of Service (DDoS) attacks have become a significant concern for network administrators and internet service providers. DDoS attacks are designed to overwhelm a target network with a flood of traffic, causing it to crash or become unavailable. These attacks can have severe consequences, including financial losses, reputational damage, and disruption of critical services. In response to this growing threat, researchers have been exploring various techniques to detect and mitigate DDoS attacks. One promising approach is to use machine learning (ML) algorithms in software-defined networks (SDN). SDN provides a centralized control plane that enables fine-grained control over network traffic, making it an ideal platform for deploying ML-based DDoS detection and mitigation techniques. This paper discusses the use of ML in SDN to recognize and avoid DDoS attacks, providing an overview of the key concepts, techniques, and challenges involved in this emerging field. Six ML algorithms were assessed, viz. Logistic Regression (LR), Naive Bayes (NB), K-Nearest Neighbor (KNN), Support Vector Machine (SVM), Decision Tree (DT), and Random Forest (RF). The inspection showed that KNN, DT and RF is the best appearing ML algorithm. Results showed that our model is able to recognize attacks precisely and rapidly.

Service separation assisted DDoS attack mitigation in cloud targets

DDoS (Distributed denial of service) attacks target on the availability of the victim services. DDoS attacks, being resource intensive attacks, create a heavy resource contention. In the state of the art, we found that resource isolation for legitimate users assists in maintaining service availability even in the presence of DDoS attacks. Resource isolation is an important method to minimize performance interference originated by the resource contention. In this paper, we propose resource isolation through service separation at two levels: physical machine level and virtual machine level. We compare four methods of resource segregation for legitimate users at physical machine level, virtual machine level, container level, and page level. The results of our experiments suggest that adopting different separation levels improve in the response time for legitimate user request even in the presence of DDoS attacks. By using different separation levels, we were able to see a considerable increase in the service availability time of target machines. In addition, there are notable improvements in number of requests failures and response time of target and co-located services.

RMCARTAM For DDoS Attack Mitigation in SDN Using Machine Learning

The impact of a Distributed Denial of Service (DDoS) attack on Software Defined Networks (SDN) is briefly analyzed. Many approaches to detecting DDoS attacks exist, varying on the feature being considered and the method used. Still, the methods have a deficiency in the performance of detecting DDoS attacks and mitigating them. To improve the performance of SDN, an efficient Real-time Multi-Constrained Adaptive Replication and Traffic Approximation Model (RMCARTAM) is sketched in this article. The RMCARTAM considers different parameters or constraints in running different controllers responsible for handling incoming packets. The model is designed with multiple controllers to handle network traffic but can turn the controllers according to requirements. The multi-constraint adaptive replication model monitors different features of network traffic like rate of packet reception, class-based packet reception and target-specific reception. According to these features, the method estimates the Replication Turning Weight (RTW) based on which triggering controllers are performed. Similarly, the method applies Traffic Approximation (TA) in the detection of DDoS attacks. The detection of a DDoS attack is performed by approximating the incoming traffic to any service and using various features like hop count, payload, service frequency, and malformed frequency to compute various support measures on bandwidth access, data support, frequency support, malformed support, route support, and so on. Using all these support measures, the method computes the value of legitimate weight to conclude the behavior of any source in identifying the malicious node. Identified node details are used in the mitigation of DDoS attacks. The method stimulates the network performance by reducing the power factor by switching the controller according to different factors, which also reduces the cost. In the same way, the proposed model improves the accuracy of detecting DDoS attacks by estimating the features of incoming traffic in different corners.

Analytical study of effects of DDoS mitigation methods

Distributed Denial of Service (DDoS) attacks continue to pose a significant threat to network infrastructure and services. Software Defined Networks (SDNs) have emerged as a promising technology to enhance network flexibility and adaptability. This paper explores various DDoS attack mitigation approaches within the context of SDNs, with a focus on their effectiveness, limitations, and key considerations. The study begins by providing an overview of DDoS attacks and their evolving complexities. It then delves into the fundamental principles of SDNs and their potential advantages in combating DDoS attacks. Various mitigation techniques are analyzed, including rate limiting, flow diversion, and traffic anomaly detection, and their applicability in an SDN environment is discussed Our research takes a multi-dimensional approach, evaluating the performance of mitigation methods in terms of attack detection, response time, false positives, and the impact on legitimate traffic. Additionally, the study considers the adaptability of these methods to emerging threats, such as IoT-based attacks and zero-day vulnerabilities. Furthermore, we discuss the trade-offs and challenges associated with the implementation of these methods, including their impact on user experience, resource utilization, and operational overhead. The results of this comparative analysis aim to provide valuable insights for organizations and network security professionals in selecting appropriate DDoS mitigation strategies. This paper provides insights into the evolving landscape of DDoS attack mitigation in Software Defined Networks, emphasizing the need for a proactive and dynamic defence strategy to protect network infrastructure and ensure uninterrupted service availability. This study serves as a valuable resource for mitigating the risks and consequences of DDoS attacks in today's interconnected and digitally-dependent world.

Using Machine Learning and Software-Defined Networking to Detect and Mitigate DDoS Attacks in Fiber-Optic Networks

Fiber optic networks (FONs) are considered the backbone of telecom companies worldwide. However, the network elements of FONs are scattered over a wide area and managed through a centralized controller based on intelligent devices and the internet of things (IoT), with actuators used to perform specific tasks at remote locations. During the COVID-19 pandemic, many telecom companies advised their employees to manage the network using the public internet (e.g., working from home while connected to an IoT network). Theses IoT devices mostly have weak security algorithms that are easily taken-over by hackers, and therefore can generate Distributed Denial of Service (DDoS) attacks in FONs. A DDoS attack is one of the most severe cyberattack types, and can negatively affect the stability and quality of managing networks. Nowadays, software-defined networks (SDN) constitute a new approach that simplifies how the network can be managed through a centralized controller. Moreover, machine learning algorithms allow the detection of incoming malicious traffic with high accuracy. Therefore, combining SDN and ML approaches can lead to detecting and stopping DDoS attacks quickly and efficiently, especially compared to traditional methods. In this paper, we evaluated six ML models: Logistic Regression, K-Nearest Neighbor, Support Vector Machine, Naive Bayes, Decision Tree, and Random Forest. The accuracy reached 100% while detecting DDoS attacks in FON with two approaches: (1) using SVM with three features (SOS, SSIP, and RPF) and (2) using Random Forest with five features (SOS, SSIP, RPF, SDFP, and SDFB). The training time for the first approach was 14.3 s, whereas the second approach only requires 0.18 s; hence, the second approach was utilized for deployment.

Machine Learning Based Signaling DDoS Detection System for 5G Stand Alone Core Network

Research to deal with distributed denial of service (DDoS) attacks was kicked off from long ago and has seen technological advancement along with an extensive 5G footprint. Prior studies, and still newer ones, in the realm of DDoS attacks in the 5G environment appear to be focused primarily on radio access network (RAN) and voice service network, meaning that there is no attempt to mitigate DDoS attacks targeted on core networks (CN) by applying artificial intelligence (AI) in modeling. In particular, such components of a CN as the Access and Mobility Management Function (AMF), Session Management Function (SMF), and User Plane Function (UPF), all being principal functions enabled to provide 5G services as base stations do, provide expansive connectivity with geographically very large area coverage that cannot be matched by the base stations. Moreover, to complete re-registration for one UE, required messages in protocols Packet Forwarding Control Protocol (PFCP) and HTTP/2 are approximately 40 in number. This implies that a DDoS attack targeting the CN has, once accomplished, a greater than expected impact, when compared to DDoS attacks targeting the RAN. Therefore, security mechanisms for the CN must be put into practice. This research proposes a method, along with a threat detection system, to mitigate signaling DDoS attacks targeted on 5G SA (standalone) CNs. It is verified that the use of fundamental ML classifiers together with preprocessing with entropy-based analysis (EBA) and statistics-based analysis (SBA) enables us to proactively react against signaling DDoS attacks. Additionally, the evaluation results manifest that the random forest achieves the best detection performance, with an average accuracy of 98.7%.

A resource-based pricing collaborative approach for mitigating DDoS attack in mobile edge computing

Resource-constrainted and located closer to users, edge servers are more vulnerable to Distributed Denial of Service (DDoS) attacks. In order to mitigate the impact of DDoS attacks on benign users, this paper designed a Resource-based Pricing Collaborative approach (RPC) in mobile edge computing. By introducing the influence of resource prices on requester in economics, a collaboration model based on resource pricing was established, and the allocation of user request was regarded as a game strategy to obtain the overall minimum offloading cost of the user in network. The article theoretically proved the existence and rationality of the Nash equilibrium. Finally, simulation results verified the effectiveness and feasibility of the proposed approach in two experimental scenes. Experimental results shows that RPC can effectively improve the network ability to mitigate DDoS attacks, and alleviate the adverse effects of server attacks under delay constraints.

Resource Provisioning for Mitigating Edge DDoS Attacks in MEC-Enabled SDVN

Vehicular ad hoc network (VANET) has become an accessible technology for improving road safety and driving experience, the problems of heterogeneity and lack of resources it faces have also attracted widespread attention. With the development of software-defined networking (SDN) and multiaccess edge computing (MEC), a variety of resource allocation strategies in MEC-enabled software-defined networking-based VANET (SDVN) have been proposed to solve these problems. However, we note that few of these work involves the situation where SDVN is under Distributed Denial of Service (DDoS) attacks. Actually, Internet of Things (IoT) devices are extremely easy to be compromised by malicious users, and compromised IoT devices may be used to launch edge DDoS attacks against the MEC servers in MEC-enabled SDVN at any time. In this article, we propose a graph neural network (GNN)-based collaborative deep reinforcement learning (GCDRL) model to generate the resource provisioning and mitigating strategy. The model evaluates the trust value of the vehicles, formulates mitigation of edge DDoS attacks and resource provisioning strategies to ensure that the MEC servers can work normally under edge DDoS attacks. In addition, GNN is adopted in the DRL model to extract the structure feature of the graph composed of MEC servers, and help transfer computing tasks between MEC servers to alleviate the problem of resources imbalance between them. Experimental results show that the method of estimating the vehicular trust value is effective, and our method can make the average throughput of edge nodes more stable and lower down the average delay and the average energy consumption under the edge DDoS attack. Also, a real-world case study is conducted to verify our conclusion.

DataPlane‐ML: An integrated attack detection and mitigation solution for software defined networks

SummarySoftware defined network (SDN) is a paradigm that emphasizes the separation of the control plane from the data plane, offering advantages such as flexibility and programmability. However, from a security perspective, SDN also introduces new vulnerabilities due to the communication required between these planes. SYN Flood attacks are typical distributed denial‐of‐service (DDoS) attacks that especially challenge network administrators since they produce a large volume of semi‐open TCP connections to a target, compromising its availability. Most of the current solutions to detect and mitigate these attacks are designed to operate at the control plane, imposing an additional overhead on controller functions. Moreover, traffic‐blocking mechanisms, a widely used alternative to protect network resources, have the drawback of restricting legitimate traffic. This work proposes DataPlane‐ML, an integrated solution to detect and mitigate DDoS attacks on SDN, acting directly in the data plane. DataPlane‐ML uses machine learning techniques for attack detection and a mitigation solution based on the node's reputation to avoid blocking legitimate traffic during an attack. Experimental results show that DataPlane‐ML is faster than statistical‐based solutions for attack detection while presenting better accuracy. Moreover, the DataPlane‐ML mitigation solution can preserve more than of legitimate traffic during an attack.

Detecting and Mitigating DDoS Attacks in SDN Using Spatial-Temporal Graph Convolutional Network

With the development of data plane programmable Software-Defined Networking (SDN), Distributed Denial of Service (DDoS) attacks on the data plane increasingly become fatal. Currently, traditional attack detection methods are mainly used to detect whether a DDoS attack occurs and it is difficult to find the path that the attack flow traverses the network, which makes it difficult to accurately mitigate DDoS attacks. In this article, we propose a detection method based on Spatial-Temporal Graph Convolutional Network (ST-GCN) over the data plane programmable SDN, which maps the network into a graph. It senses the state of switches through In-band Network Telemetry (INT) with sampling, inputs the network state into the spatial-temporal graph convolutional network detection model, and finally finds out the switches through which DDoS attack flows pass. Based on this, we propose a defense method combined with an enhanced whitelist and a precise dropping strategy, which can effectively mitigate DDoS attacks and minimize the impact on legitimate network traffic. The evaluation results show that our detection method can accurately detect the path that the DDoS attack flows pass through, and can effectively mitigate the DDoS attack. Compared to classic methods, our method improves the detection accuracy by nearly 10%. At the same time, the southbound interface load and CPU overhead brought by our detection and defense process are much lower than the classic methods.

SDN-Defend: A Lightweight Online Attack Detection and Mitigation System for DDoS Attacks in SDN.

With the development of Software Defined Networking (SDN), its security is becoming increasingly important. Since SDN has the characteristics of centralized management and programmable, attackers can easily take advantage of the security vulnerabilities of SDN to carry out distributed denial of service (DDoS) attacks, which will cause the memory of controllers and switches to be occupied, network bandwidth and server resources to be exhausted, affecting the use of normal users. To solve this problem, this paper designs and implements an online attack detection and mitigation SDN defense system. The SDN defense system consists of two modules: anomaly detection module and mitigation module. The anomaly detection model uses a lightweight hybrid deep learning method-Convolutional Neural Network and Extreme Learning Machine (CNN-ELM) for anomaly detection of traffic. The mitigation model uses IP traceback to locate the attacker and effectively filters out abnormal traffic by sending flow rule commands from the controller. Finally, we evaluate the SDN defense system. The experimental results show that the SDN defense system can accurately identify and effectively mitigate DDoS attack flows in real-time.

Review of game theory approaches for DDoS mitigation by SDN

Some people are attempting to expand the service industry through networking, while others are working to undermine it. These individuals are evil actors whose sole purpose is to disturb the routine services by disrupting networking equipment through different types of attacks. Among them, Distributed Denial of Service Attacks (DDoS) are the most suitable choice of weapon. These attacks can quickly render a service capacity and unavailability of services resulting in massive financial losses. DDoS attacks have continued to expand in frequency, quantity, and intensity despite the availability of wide variety of traditional prevention, detection and mitigation solutions. Traditional solutions are static in nature and lacks a quantitative decision framework. In order to deal with shifting attacker dynamics, we need highly programmable adaptive technologies and a new networking paradigm in the form of software defined networks. In this paper we present a brief review Software-defined networking based solutions along with Game theory based approaches for defending against DDoS attacks.

Flow-Based Anomaly Detection Using BNN for Attack Mitigation on SDN

Distributed Denial of Service (DDoS) attack remains one of the major issues that compromises the resources and services of the components in Software Defined Networks (SDN) environments. The implementation of intrusion prevention system (IPS) in OpenFlow-based SDN architecture has emerged to strengthen the security mechanisms by exploiting the concepts of SDN and OpenFlow protocols. This article provides the anomaly detection of the live traffic flow with Backpropagation Neural Network (BNN) for the online detection and mitigation of DDoS attacks. The dataset from the testbed is used to emulate the efficiency of the proposed method. The results achieve more than 90% detection accuracy with less than 6% false alarm rate. CUP utilization on the centralized controller is also measured by means of SYN and UDP flooding to calculate the effect of malicious traffic on the resources of the system.

ShChain_3D-ResNet: Sharding Blockchain with 3D-Residual Network (3D-ResNet) Deep Learning Model for Classifying DDoS Attack in Software Defined Network

The distributed denial of service (DDoS) vulnerabilities have rapidly extended and have been given different possibilities for even more advanced assaults on specific targets in recent times, thanks to the growth of innovative technology such as the Internet of Things (IoT) and Software-Defined Networking (SDN). The attack patterns route comprises unprotected and susceptible IoT systems that are internet-connected, as well as denial of service weaknesses in the SDN controllers, such as southbound connection exhaustion. (1) Background: The review does not go into detail about the symmetry blockchain approaches used to mitigate DDoS attacks, nor does it classify them in IoT; (2) To overcome the privacy issues, a novel deep learning-based privacy preservation method was proposed named ShChain_3D-ResNet. This novel method combines Sharding, blockchain and Residual Network for securing the SDN. Under this network, the proposed efficient attention module jointly learns attention to enforce the symmetry on weights for various channels in spatial dimension as well as attention weights of multiple frames in temporal dimension assistance of pre-training, updating, and dense convolution process; (3) Results: the proposed ShChain_3D-ResNet achieves 95.6% of accuracy, 97.3% of precision, 95.2% of recall, 94.4% of F1-score, 32.5 ms of encryption time and 35.2 ms of decryption time for dataset-1. Further, it achieves 97.3% accuracy, 95.3% precision, 96.1% recall, 98.2% F1-score, 32.1 ms of encryption time, and 36.2 ms of decryption time for dataset-2; (4) Conclusions: The Sharding strategy can increase ShChain performance while simultaneously utilizing Multi User (MU) resources for SDN.

A flexible SDN-based framework for slow-rate DDoS attack mitigation by using deep reinforcement learning

Distributed Denial-of-Service (DDoS) attacks are difficult to mitigate with existing defense tools. Fortunately, it has been demonstrated that Software-Defined Networking (SDN) with machine learning (ML) and deep learning (DL) techniques has a high potential to handle these threats effectively. However, although there are many SDN-based solutions for detecting DDoS attacks, only a few contain mitigation strategies. Additionally, most previous studies have focused on solving high-rate DDoS attacks. For the time being, recent slow-rate DDoS threats are hard to detect and mitigate. In this work, we propose a modular, flexible, and scalable SDN-based framework that integrates a DL-based intrusion detection system (IDS) and a deep reinforcement learning (DRL)-based intrusion prevention system (IPS) to address slow-rate DDoS threats. We incorporated scalability features into this framework, such as data-plane-based traffic monitoring and traffic flow sampling. Moreover, we have designed a lightweight DRL-based IPS to provide rapid mitigation responses. Furthermore, to evaluate the framework, we deployed a data center network using Mininet, Open Network Operating System (ONOS) controller, and Apache Web server. Next, we performed extensive experiments varying the number of attackers and the rate of attack connections. The proposed IDS achieved an average detection rate of 98%, with a flow sampling rate of 30%. In addition, IPS timely mitigated slow-rate DDoS with 100% of success for a few attackers. Taken together, these results show that the proposed framework provides effective responses to malicious and legitimate connections.