Automated DDOS attack detection in software defined networking. (1st August 2021)

• Record Type: Journal Article
• Authors: Ahuja, Nisha; Singal, Gaurav; Mukhopadhyay, Debajyoti; Kumar, Neeraj
• Is Part Of: Journal of network and computer applications. Volume 187(2021)
• Publication Date: 2021-08-01
• Subjects: Machine learning -- Software-defined-networking -- DDOS Attack detection -- Traffic protocol -- SDN Traffic classification -- Mininet; 00–01 -- 99-00; Microcomputers -- Periodicals; Computer networks -- Periodicals; Application software -- Periodicals; Micro-ordinateurs -- Périodiques; Réseaux d'ordinateurs -- Périodiques; Logiciels d'application -- Périodiques; Application software; Computer networks; Microcomputers; Periodicals; 004.05; 004
• DOI: 10.1016/j.jnca.2021.103108
• Languages: English
• ISSNs: 1084-8045

Abstract

Abstract: Software-Defined Networking (SDN) is a networking paradigm that has redefined the term network by making the network devices programmable. SDN helps network engineers to monitor the network expeditely, control the network from a central point, identify malicious traffic and link failure in easy and efficient manner. Besides such flexibility provided by SDN, it is also vulnerable to attacks such as DDoS which can halt the complete network. To mitigate this attack, the paper proposes to classify the benign traffic from DDoS attack traffic by using machine learning technique. The major contribution of this paper is identification of novel features for DDoS attack detections. Novel features are logged into CSV file to create the dataset and machine learning algorithms are trained on the created SDN dataset. Various work which has already been done for DDoS attack detection either used a non-SDN dataset or the research data is not made public. A novel hybrid machine learning model is utilized to perform the classification. Results show that the hybrid model of Support Vector classifier with Random Forest (SVC-RF) classifies the traffic with the highest testing accuracy of 98.8% with a very low false alarm rate.