A multi-layered intrusion detection system for software defined networking. (July 2022)

• Record Type: Journal Article
• Authors: Bour, Hamideh; Abolhasan, Mehran; Jafarizadeh, Saber; Lipman, Justin; Makhdoom, Imran
• Is Part Of: Computers & electrical engineering. Volume 101(2022)
• Publication Date: 2022-07
• Subjects: DDoS attack detection and mitigation -- Software-defined networking -- Extreme learning machine-based feed-forward networks -- Case-based information entropy -- Hidden Markov model; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2022.108042
• Languages: English
• ISSNs: 0045-7906

Abstract

Highlights: Multi-layered DDoS attack detection: flow-based and packet-based. Mitigation: Avoiding the attacked switches in the optimal data forwarding path. Mitigation: Dropping the attack flow based on the flow features in both switch and controller. Classifying switches as normal, suspicious, and attacked for detecting and mitigating flow table overloading attack. Abstract: The majority of existing DDoS defense mechanisms in SDN impose a significant computational burden on the controller and employ limited flow statistics and packet features. Tackling these issues, this paper presents a multi-layer defense mechanism that detects and mitigates three distinct types of flooding DDoS attacks. In the proposed framework, the detection process consists of flow-based and packet-based attack detection mechanisms employing Extreme Learning Machine-based Single-hidden Layer Feedforward Networks (ELM-SLFNs) and Case-based Information Entropy (C-IE), respectively. Moreover, the affected switches are avoided in the optimal path determined by the Floyd-Warshall algorithm, where the switches are classified based on the Hidden Markov Model (HMM) using the extracted packet features. Our simulation demonstrates the improved performance of our framework compared to similar schemes proposed in the literature in terms of different metrics, including attack detection rate, detection accuracy, false-positive rate, switch failure ratio, packet loss rate, response time, and CPU utilization. Graphical abstract: Image, graphical abstract