Machine learning algorithms to detect DDoS attacks in SDN. (14th June 2019)

• Record Type: Journal Article
• Authors: Santos, Reneilson; Souza, Danilo; Santo, Walter; Ribeiro, Admilson; Moreno, Edward
• Other Names: Wu Yulei guestEditor.; Yan Zheng guestEditor.; Zhao Zhiwei guestEditor.; Al‐Dubai Ahmed guestEditor.; Li Tonglin guestEditor.; Xie Bing guestEditor.; Zhang Boyu guestEditor.
• Is Part Of: Concurrency and computation. Volume 32:Number 16(2020)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2019-06-14
• Subjects: DDoS classification -- decision tree -- Mininet -- MLP -- random forest -- SDN environment -- SVM; Parallel processing (Electronic computers) -- Periodicals; Parallel computers -- Periodicals; 004.35
• DOI: 10.1002/cpe.5402
• Languages: English
• ISSNs: 1532-0626

Abstract

Summary: Summary Software‐Defined Networking (SDN) is an emerging network paradigm that has gained significant traction from many researchers to address the requirement of current data centers. Although central control is the major advantage of SDN, it is also a single point of failure if it is made unreachable by a Distributed Denial of Service (DDoS) attack. Despite the large number of traditional detection solutions that exist currently, DDoS attacks continue to grow in frequency, volume, and severity. This paper brings an analysis of the problem and suggests the implementation of four machine learning algorithms (SVM, MLP, Decision Tree, and Random Forest) with the purpose of classifying DDoS attacks in an SDN simulated environment (Mininet 2.2.2). With this goal, the DDoS attacks were simulated using the Scapy tool with a list of valid IPs, acquiring, as a result, the best accuracy with the Random Forest algorithm and the best processing time with the Decision Tree algorithm. Moreover, it is shown the most important features to classify DDoS attacks and some drawbacks in the implementation of a classifier to detect the three kinds of DDoS attacks discussed in this paper (controller attack, flow‐table attack, and bandwidth attack).