Machine-Learning-Enabled DDoS Attacks Detection in P4 Programmable Networks

Abstract Distributed Denial of Service (DDoS) attacks represent a major concern in modern Software Defined Networking (SDN), as SDN controllers are sensitive points of failures in the whole SDN architecture. Recently, research on DDoS attacks detection in SDN has focused on investigation of how to leverage data plane programmability, enabled by P4 language, to detect attacks directly in network switches, with marginal involvement of SDN controllers. In order to effectively address cybersecurity management in SDN architectures, we investigate the potential of Artificial Intelligence and Machine Learning (ML) algorithms to perform automated DDoS Attacks Detection (DAD), specifically focusing on Transmission Control Protocol SYN flood attacks. We compare two different DAD architectures, called Standalone and Correlated DAD, where traffic features collection and attack detection are performed locally at network switches or in a single entity (e.g., in SDN controller), respectively. We combine the capability of ML and P4-enabled data planes to implement real-time DAD. Illustrative numerical results show that, for all tested ML algorithms, accuracy, precision, recall and F1-score are above 98% in most cases, and classification time is in the order of few hundreds of $$\upmu \text {s}$$ μ s in the worst case. Considering real-time DAD implementation, significant latency reduction is obtained when features are extracted at the data plane by using P4 language. Graphic Abstract

Download Full-text

Real-Time DDoS Attack Detection System Using Big Data Approach

Sustainability ◽

10.3390/su131910743 ◽

2021 ◽

Vol 13 (19) ◽

pp. 10743

Author(s):

Mazhar Javed Awan ◽

Umar Farooq ◽

Hafiz Muhammad Aqeel Babar ◽

Awais Yasin ◽

Haitham Nobanee ◽

...

Keyword(s):

Machine Learning ◽

Big Data ◽

Real Time ◽

Denial Of Service ◽

Attack Detection ◽

Testing Time ◽

Ddos Attacks ◽

Dos Attacks ◽

Ddos Attack ◽

Data Framework

Currently, the Distributed Denial of Service (DDoS) attack has become rampant, and shows up in various shapes and patterns, therefore it is not easy to detect and solve with previous solutions. Classification algorithms have been used in many studies and have aimed to detect and solve the DDoS attack. DDoS attacks are performed easily by using the weaknesses of networks and by generating requests for services for software. Real-time detection of DDoS attacks is difficult to detect and mitigate, but this solution holds significant value as these attacks can cause big issues. This paper addresses the prediction of application layer DDoS attacks in real-time with different machine learning models. We applied the two machine learning approaches Random Forest (RF) and Multi-Layer Perceptron (MLP) through the Scikit ML library and big data framework Spark ML library for the detection of Denial of Service (DoS) attacks. In addition to the detection of DoS attacks, we optimized the performance of the models by minimizing the prediction time as compared with other existing approaches using big data framework (Spark ML). We achieved a mean accuracy of 99.5% of the models both with and without big data approaches. However, in training and testing time, the big data approach outperforms the non-big data approach due to that the Spark computations in memory are in a distributed manner. The minimum average training and testing time in minutes was 14.08 and 0.04, respectively. Using a big data tool (Apache Spark), the maximum intermediate training and testing time in minutes was 34.11 and 0.46, respectively, using a non-big data approach. We also achieved these results using the big data approach. We can detect an attack in real-time in few milliseconds.

Download Full-text

ADAPTIVE ENTROPY-BASED DETECTION AND MITIGATION OF DDOS ATTACKS IN SOFTWARE DEFINED NETWORKS

International Journal of Computing ◽

10.47839/ijc.19.3.1889 ◽

2020 ◽

pp. 399-410

Author(s):

Jawad Dalou' ◽

Basheer Al-Duwairi ◽

Mohammad Al-Jarrah

Keyword(s):

Denial Of Service ◽

Attack Detection ◽

Point Of View ◽

Software Defined Networks ◽

Distributed Denial Of Service ◽

Ddos Attacks ◽

Control Plane ◽

Data Plane ◽

And Control ◽

Sdn Controller

Software Defined Networking (SDN) has emerged as a new networking paradigm that is based on the decoupling between data plane and control plane providing several benefits that include flexible, manageable, and centrally controlled networks. From a security point of view, SDNs suffer from several vulnerabilities that are associated with the nature of communication between control plane and data plane. In this context, software defined networks are vulnerable to distributed denial of service attacks. In particular, the centralization of the SDN controller makes it an attractive target for these attacks because overloading the controller with huge packet volume would result in bringing the whole network down or degrade its performance. Moreover, DDoS attacks may have the objective of flooding a network segment with huge traffic volume targeting single or multiple end systems. In this paper, we propose an entropy-based mechanism for Distributed Denial of Service (DDoS) attack detection and mitigation in SDN networks. The proposed mechanism is based on the entropy values of source and destination IP addresses of flows observed by the SDN controller which are compared to a preset entropy threshold values that change in adaptive manner based on network dynamics. The proposed mechanism has been evaluated through extensive simulation experiments.

Download Full-text

A Machine Learning Approach for DDoS (Distributed Denial of Service) Attack Detection Using Multiple Linear Regression

Proceedings ◽

10.3390/proceedings2020063051 ◽

2020 ◽

Vol 63 (1) ◽

pp. 51

Author(s):

Swathi Sambangi ◽

Lakshmeeswari Gondi

Keyword(s):

Machine Learning ◽

Denial Of Service ◽

Classification Problem ◽

Attack Detection ◽

Distributed Denial Of Service ◽

Ddos Attacks ◽

Dos Attacks ◽

Multiple Sources ◽

Denial Of Service Attack ◽

Network Bandwidth

The problem of identifying Distributed Denial of Service (DDos) attacks is fundamentally a classification problem in machine learning. In relevance to Cloud Computing, the task of identification of DDoS attacks is a significantly challenging problem because of computational complexity that has to be addressed. Fundamentally, a Denial of Service (DoS) attack is an intentional attack attempted by attackers from single source which has an implicit intention of making an application unavailable to the target stakeholder. For this to be achieved, attackers usually stagger the network bandwidth, halting system resources, thus causing denial of access for legitimate users. Contrary to DoS attacks, in DDoS attacks, the attacker makes use of multiple sources to initiate an attack. DDoS attacks are most common at network, transportation, presentation and application layers of a seven-layer OSI model. In this paper, the research objective is to study the problem of DDoS attack detection in a Cloud environment by considering the most popular CICIDS 2017 benchmark dataset and applying multiple regression analysis for building a machine learning model to predict DDoS and Bot attacks through considering a Friday afternoon traffic logfile.

Download Full-text

DDoS Attack Detection and Classification using Machine Learning Models with Real-Time Dataset Created

International Journal of Recent Technology and Engineering - 2 ◽

10.35940/ijrte.e5217.019521 ◽

2021 ◽

Vol 9 (5) ◽

pp. 145-153

Author(s):

Harrsheeta Sasikumar

Keyword(s):

Machine Learning ◽

Real Time ◽

Denial Of Service ◽

Attack Detection ◽

Machine Learning Algorithms ◽

Detection Accuracy ◽

Ddos Attack ◽

Real Time Traffic ◽

Server Breakdown ◽

Networked Devices

Distributed Denial of Service (DDoS) attack is one of the common attack that is predominant in the cyber world. DDoS attack poses a serious threat to the internet users and affects the availability of services to legitimate users. DDOS attack is characterized by the blocking a particular service by paralyzing the victim’s resources so that they cannot be used to legitimate purpose leading to server breakdown. DDoS uses networked devices into remotely controlled bots and generates attack. The proposed system detects the DDoS attack and malware with high detection accuracy using machine learning algorithms. The real time traffic is generated using virtual instances running in a private cloud. The DDoS attack is detected by considering the various SNMP parameters and classifying using machine learning technique like bagging, boosting and ensemble models. Also, the various types of malware on the networked devices are prevent from being used as a bot for DDOS attack generation.

Download Full-text

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

Security and Communication Networks ◽

10.1155/2018/9649643 ◽

2018 ◽

Vol 2018 ◽

pp. 1-15 ◽

Cited By ~ 15

Author(s):

Biao Han ◽

Xiangrui Yang ◽

Zhigang Sun ◽

Jinfeng Huang ◽

Jinshu Su

Keyword(s):

Denial Of Service ◽

Attack Detection ◽

Coarse Grained ◽

Communication Overhead ◽

Ddos Attacks ◽

Control Plane ◽

Flow Monitoring ◽

Ddos Attack ◽

Data Plane ◽

Collaborative Intelligence

Distributed Denial of Service (DDoS) attacks are one of the biggest concerns for security professionals. Traditional middle-box based DDoS attack defense is lack of network-wide monitoring flexibility. With the development of software-defined networking (SDN), it becomes prevalent to exploit centralized controllers to defend against DDoS attacks. However, current solutions suffer with serious southbound communication overhead and detection delay. In this paper, we propose a cross-plane DDoS attack defense framework in SDN, called OverWatch, which exploits collaborative intelligence between data plane and control plane with high defense efficiency. Attack detection and reaction are two key procedures of the proposed framework. We develop a collaborative DDoS attack detection mechanism, which consists of a coarse-grained flow monitoring algorithm on the data plane and a fine-grained machine learning based attack classification algorithm on the control plane. We propose a novel defense strategy offloading mechanism to dynamically deploy defense applications across the controller and switches, by which rapid attack reaction and accurate botnet location can be achieved. We conduct extensive experiments on a real-world SDN network. Experimental results validate the efficiency of our proposed OverWatch framework with high detection accuracy and real-time DDoS attack reaction, as well as reduced communication overhead on SDN southbound interface.

Download Full-text

Machine Learning-Based Distributed Denial of Service Attack Detection on Intrusion Detection System Regarding to Feature Selection

International Journal of Artificial Intelligence Research ◽

10.29099/ijair.v4i1.156 ◽

2020 ◽

Vol 4 (1) ◽

Author(s):

Ahmad Azhari ◽

Arif Wirawan Muhammad ◽

Cik Feresa Mohd Foozy

Keyword(s):

Machine Learning ◽

Intrusion Detection ◽

Intrusion Detection System ◽

Policy Development ◽

Detection System ◽

Denial Of Service ◽

Attack Detection ◽

Machine Learning Techniques ◽

Ddos Attacks ◽

Detection Techniques

Distributed Service Denial (DDoS) is a type of network attack, which each year increases in volume and intensity. DDoS attacks also form part of the major types of cyber security threats so far. Early detection plays a key role in avoiding the catastrophic effects on server infrastructure from DDoS attacks. Detection techniques in the traditional Intrusion Detection System (IDS) are far from perfect compared to a number of modern techniques and tools used by attackers, because the traditional IDS only uses signature-based detection or anomaly-based detection models and causes a lot of false positive flags, since the flow of computer network data packets has complex properties in terms of both size and source. Based on the deficiency in the ordinary IDS, this study aims to detect DDoS attacks by using machine learning techniques to enhance IDS policy development. According to the experiment the selection of features plays an important role in the precision of the detection results and in the performance of machine learning in classification problems. The combination of seven key selected dataset features used as an input neural network classifier in this study provides the highest accuracy value at 97.76%.

Download Full-text

Detecting DDoS Attacks in Software-Defined Networks Through Feature Selection Methods and Machine Learning Models

Sustainability ◽

10.3390/su12031035 ◽

2020 ◽

Vol 12 (3) ◽

pp. 1035 ◽

Cited By ~ 9

Author(s):

Huseyin Polat ◽

Onur Polat ◽

Aydin Cetin

Keyword(s):

Machine Learning ◽

Feature Selection ◽

Denial Of Service ◽

Attack Detection ◽

Critical Threshold ◽

Support Vector ◽

Ddos Attacks ◽

Selection Methods ◽

Training Time ◽

Ddos Attack

Software Defined Networking (SDN) offers several advantages such as manageability, scaling, and improved performance. However, SDN involves specific security problems, especially if its controller is defenseless against Distributed Denial of Service (DDoS) attacks. The process and communication capacity of the controller is overloaded when DDoS attacks occur against the SDN controller. Consequently, as a result of the unnecessary flow produced by the controller for the attack packets, the capacity of the switch flow table becomes full, leading the network performance to decline to a critical threshold. In this study, DDoS attacks in SDN were detected using machine learning-based models. First, specific features were obtained from SDN for the dataset in normal conditions and under DDoS attack traffic. Then, a new dataset was created using feature selection methods on the existing dataset. Feature selection methods were preferred to simplify the models, facilitate their interpretation, and provide a shorter training time. Both datasets, created with and without feature selection methods, were trained and tested with Support Vector Machine (SVM), Naive Bayes (NB), Artificial Neural Network (ANN), and K-Nearest Neighbors (KNN) classification models. The test results showed that the use of the wrapper feature selection with a KNN classifier achieved the highest accuracy rate (98.3%) in DDoS attack detection. The results suggest that machine learning and feature selection algorithms can achieve better results in the detection of DDoS attacks in SDN with promising reductions in processing loads and times.

Download Full-text

Detection of DDoS Attacks in OpenStack-based Private Cloud Using Apache Spark

Journal of Telecommunications and Information Technology ◽

10.26636/jtit.2020.146120 ◽

2020 ◽

Vol 4 ◽

pp. 62-71

Author(s):

Shweta Gumaste ◽

Narayan D. G. ◽

Sumedha Shinde ◽

Amit K

Keyword(s):

Machine Learning ◽

Real Time ◽

Service Providers ◽

Distributed Processing ◽

Denial Of Service ◽

Machine Learning Algorithms ◽

Apache Spark ◽

Ddos Attacks ◽

Ddos Detection ◽

Real Time Detection

Security is a critical concern for cloud service providers. Distributed denial of service (DDoS) attacks are the most frequent of all cloud security threats, and the consequences of damage caused by DDoS are very serious. Thus, the design of an efficient DDoS detection system plays an important role in monitoring suspicious activity in the cloud. Real-time detection mechanisms operating in cloud environments and relying on machine learning algorithms and distributed processing are an important research issue. In this work, we propose a real-time detection of DDoS attacks using machine learning classifiers on a distributed processing platform. We evaluate the DDoS detection mechanism in an OpenStack-based cloud testbed using the Apache Spark framework. We compare the classification performance using benchmark and real-time cloud datasets. Results of the experiments reveal that the random forest method offers better classifier accuracy. Furthermore, we demonstrate the effectiveness of the proposed distributed approach in terms of training and detection time.

Download Full-text

DDoS Flood and Destination Service Changing Sensor

Sensors ◽

10.3390/s21061980 ◽

2021 ◽

Vol 21 (6) ◽

pp. 1980

Author(s):

Fu-Hau Hsu ◽

Chia-Hao Lee ◽

Chun-Yi Wang ◽

Rui-Yi Hung ◽

YungYu Zhuang

Keyword(s):

Operating System ◽

Network Architecture ◽

Transmission Control Protocol ◽

Low Cost ◽

Denial Of Service ◽

Attack Detection ◽

System Call ◽

Distributed Denial Of Service ◽

Ddos Attacks ◽

Detection Mechanism

In this paper, we aim to detect distributed denial of service (DDoS) attacks, and receive a notification of destination service, changing immediately, without the additional efforts of other modules. We designed a kernel-based mechanism to build a new Transmission Control Protocol/Internet Protocol (TCP/IP) connection smartly by the host while the users or clients not knowing the location of the next host. Moreover, we built a lightweight flooding attack detection mechanism in the user mode of an operating system. Given that reinstalling a modified operating system on each client is not realistic, we managed to replace the entry of the system call table with a customized sys_connect. An effective defense depends on fine detection and defensive procedures. In according with our experiments, this novel mechanism can detect flooding DDoS successfully, including SYN flood and ICMP flood. Furthermore, through cooperating with a specific low cost network architecture, the mechanism can help to defend DDoS attacks effectively.

Download Full-text