A hybrid method of entropy and SSAE-SVM based DDoS detection and mitigation mechanism in SDN. Issue 115 (April 2022)

• Record Type: Journal Article
• Authors: Long, Zhang; Jinsong, Wang
• Is Part Of: Computers & security. Issue 115(2022)
• Publication Date: 2022-04
• Subjects: Software defined networks -- Distributed denial of service -- Machine learning -- Entropy -- Hybrid mechanism; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.102604
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Software-defined networking (SDN) is a new network architecture that offers considerable management convenience and efficiency relative to conventional networks. However, the centralized control employed in SDN incurs a high risk of single point failure that is susceptible to distributed denial of service (DDoS) attacks. The present work addresses this issue by proposing a hybrid approach for detecting DDoS attacks using an initial detection module based on information entropy to quickly identify anomalous traffic and a second detection module based on machine learning with a stacked sparse autoencoder (SSAE)–support vector machine (SVM) architecture to confirm the suspected anomalous traffic. If DDoS traffic is detected, a defense module is implemented to restore normal network communication in a timely manner via an issued flow table. The effectiveness and efficiency of the proposed approach for DDoS detection is experimentally evaluated using both real-time and benchmark datasets in comparison with state-of-the-art methods. The results demonstrate that the proposed approach provides superior detection performance and identifies greater than 98% of existing DDoS traffic with greatly reduced training time and computational burden.