DDoS attacks in software defined networks: detection and protection
Creators: name: WANG, Song
Publisher: name: RMIT University
Year: 2024
Subjects: classificationCode: 400604
subject: Network engineering
classificationCode: 400999
subject: Electronics, sensors and digital hardware not elsewhere classified

description: Our life today relies more on the Internet than ever before, the explosive growth of connected devices becomes a challenge in the network management. Apart from the cost in the network operation and maintenance, the requirement for network security is growing as well. Cyber security is a global problem, and network attacks have caused a huge loss across the world. To reduce the cost and increase the capability of management in the network, Software Defined Networks (SDN) is proposed as a candidate solution. SDN is considered as the next generation of network, it introduces a new architecture with decoupled control and data plane. The programmability of SDN enables customisation of network control, the administrators could adjust policies by themselves without worrying about the license issue. The main focus of SDN is the upper level control and management of networks, although the decoupled architecture of SDN adds flexibility to the traditional network, it still suffers from security threats, such as Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. The SDN controller works as the brain of network, strategies and policies are enforced dynamically to the network devices via the controller, this makes the controller a high-profit target in the network. SDN is proposed to be an opensourced platform, it supports vendor neutral equipment so that it can be deployed in various network use cases, such as Internet of Things (IoT). The combination of SDN and IoT leads to a promising approach that could alleviate the management issue. In the meanwhile, there is a need to make a security enhancement in the SDN-based IoT network to defend against attacks involving IoT devices.

Among various attacks, DoS/DDoS attack is always a popular network threat, it is easy to implement but hard to trace, which makes it more frequent and arbitrary in the network. Even though people have no data stolen by DDoS attacks, the interruption of service also induces loss of money. Hence, the detection of network attacks have been widely discussed in the traditional network. However, the impact of DDoS attacks on the SDN and the countermeasures are quite different, it is worth researching on the solutions under SDN context. Since machine learning (ML) is used in data analysis for some classification problems, it is feasible to run ML algorithms in SDN for DDoS attack detection. As SDN controller is able to collect network statistics, the dataset can be prepared automatically to train the ML models. After the model is trained by normal and DDoS attack samples, it is able to predict real-time traffic with the aid of controller, and the policy update to the network is generated and inserted to the network devices according to the decision made by the ML model. Thus, a ML model is much easier to be deployed in SDN than in the traditional network.

In this research, we delve into detection and mitigation of DoS and DDoS attacks in the SDN, and propose countermeasures, such as SDN sEcure COntrol and Data Plane (SECOD), which are deployed over the controller, and introduce triggers to detect and mitigate attacks against both the control and data planes. Validation of algorithms in the real testbed shows a significant performance in protecting the transmission of legitimate traffic when under attack. However, using threshold as the metric of alarm trigger becomes the bottleneck of early detection. Through the reviews of existing ML applications in the network anomaly detection, we propose a framework, which employs a ML model to analyse packets for DDoS attack detection in the SDN. This model is able to learn the behaviour of network traffic and generate detection metrics by itself via the history log.

The contribution of this research is that we showcase the impact of DoS and DDoS attacks in the SDN and SDN based IoT networks, and based on the impact we develop applications against attacks to prove that SDN is trustworthy with proper security deployment, even in the IoT network, SDN is able to provide secure mechanism to maintain the normal transmission on the aggregation and backbone layers. The introduction of ML in the SDN provides a novel solution in the detection phase, through the analysis of network behaviour during normal and attack scenarios, the proposed ML model is able to detect DDoS attacks with a satisfactory accuracy.