Supervised Machine Learning-Based DDoS Defense System for Software-Defined Network

Abstract

Software-Defined Network (SDN) is a network architecture that decouples the network control logic from data forwarding logic. SDN allows networking devices to be monitored and controlled by a centralized controller. Unfortunately, this opens up avenues for adversaries to launch distributed denial of service attack (DDoS) on SDN infrastructure. The DDoS attack in the SDN domain will exhaust the CPU cycles of the controller, TCAM memory in the data plane, and also implicitly degrade the bandwidth of the control-data plane. Therefore, we develop a framework to detect DDoS attacks with high accuracy, high detection, and low false positives as early as possible. We proposed a framework that periodically monitors and evaluates the behavior of all hosts within a network using a set of 30 features. The proposed framework handles the system’s false alarm to minimize the impact of the system’s response toward benign connection(s) using a scoring scheme. The system’s response will prevent an attacker from using any resources, and also frees any allocated resources. The experiment results show that our proposed system accurately detects the attacks. Also, experiment results indicate the success of the system scoring scheme in handling the false-positive cases.