###### Abstract  
The design of existing machine-learning-based DoS detection systems in software-defined networking (SDN) suffers from two major problems. First, the proper time window for conducting network traffic analysis is unknown and has proven challenging to determine. Second, it is unable to detect unknown types of DoS saturation attacks. An unknown saturation attack is an attack that is not represented in the training data. In this paper, we evaluate three supervised classifiers for detecting a family of DDoS flooding attacks (UDP, TCP-SYN, IP-Spoofing, TCP-SARFU, and ICMP) and their combinations using different time windows. This work represents an extension of the runner-up best-paper award entitled 'Detecting Saturation Attacks in SDN via Machine Learning' published in the 2019 4 th International Conference on Computing, Communications and Security (ICCCS). The results in this paper show that the trained supervised models fail in detecting unknown saturation attacks, and their overall detection performance decreases when the time window of the network traffic increases. Moreover, we investigate the performance of four semi-supervised classifiers in detecting unknown flooding attacks. The results indicate that semi-supervised classifiers outperform the supervised classifiers in the detection of unknown flooding attacks. Furthermore, to further increase the possibility of detecting the known and unknown flooding attacks, we propose an enhanced hybrid approach that combines two supervised and semi-supervised classifiers. The results demonstrate that the hybrid approach has outperformed individually supervised or semi-supervised classifiers in detecting the known and unknown flooding DoS attacks in SDN. machine learning; software-defined networking; OpenFlow; DoS saturation attacks +
Footnote †: journal:  
0000-0001-999-4000-0000-0000-0000-0000-0000-0000-0000-0000-00000-  
The DoS attack is one of the most widely used malicious cyberattacks, and its detection is at the forefront of cybersecurity researchers' interest. Finding new ways to protect the SDNs against DoS attacks is a hot topic of research since many large technology companies are attracted to the benefits of SDN technology. Recently, different research works presented different methods focused on detecting TCP-SYN flooding such as SLICOTS [3], AVANT-GUARD [4], and LineSwitch [5]. FloodGuard [6] and FloodDefender [7] use Packet-In rates to detect flooding attacks. However, this may lead to increasing the false positives since a high volume of new normal traffic may increase the rate of Packet-In messages that may exceed a pre-defined threshold [2]. FDAM [8] utilizes the support vector machine (SVM) to detect DoS flooding attacks and the white-list technique to mitigate the flooding attacks. SA-Detector [2] studies the similarity between the normal and attack OpenFlow traffic to detect several types of saturation attacks. Our recent works [9; 10; 11] demonstrated that supervised classifiers are useful for detecting the occurrences of these types of attacks. One way to provide the protection against DoS attacks in SDN is the adoption of machine learning approaches [12; 13; 14]. A successful ML-based way to detect DoS attacks in SDN should (1) address the detection of known as well as the unknown saturation attacks, (2) have high classification rate of the attack traffic, (3) have a high accuracy rate, and (4) be able to detect a family of saturation attacks rather than a single attack traffic. However, from a review of the literature of machine learning DoS flooding detection methods, two main shortcomings can be noted. The first is related to the time window for collecting and analyzing the SDN network traffic, and the second is related to the detection of saturation attacks that are yet unknown [8]. When the time window set for collecting and analyzing the SDN network traffic is long, the detection time becomes relatively long and sufficient for the attacker to flood the network.