## 5 Vulnerabilities of SDN to LDDoS Attacks
### Classification-Based LDDoS Detection
Accordingly, the Q-Learning agent is instructed to train the detection engine and perform cross-validation tests. In [17], the authors implemented their scenario with one ONOS controller [110], three OpenFlow switches, five hosts, and one web server as a victim. The scenario implies that the attacker 1 hosts have been infiltrated and are now part of the botnet, with each attacking computer capable of generating malicious traffic using the SlowHTPTest tool [111]. Legitimate hosts generate regular traffic with a pseudo-random function using curl targeting the webserver. The authors used the CIC DoS dataset, including regular traffic and eight low rate attack variations. They used the Flowtbag function to convert the packet data as traffic to adapt the dataset for SDN environments. It takes 44 features as input set and 44 features as output flows. In [78], the experiment is conducted in a heterogeneous IoT network deployed on a Mininet simulator. The network topology consists of one physical switch, three OpenFlow virtual switches, and forty virtual nodes. All switches are connected to the Floodlight controller, and the nodes are connected to the switches; 10 nodes are normal nodes, and 30 nodes are attacking nodes. The link bandwidth between the nodes and the switches is 100 Mb/s. The dataset is generated in real-time during the experimental simulation collected on the Floodlight controller and the OpenFlow switches. The classifier was trained with 80% of the combined dataset of regular and attacking traffic, and classification accuracy was tested with a test set from the remaining dataset. The regular traffic includes HTTPS, HTTP, MQTT, ping messages, etc., while the attacking traffic includes a large number of TCP-syn and TCP-retransmission messages in addition to those included in the regular traffic. In [77], the authors simulated the SDN environment to develop the detection model running on the Ryu controller and network topology with two OpenFlow switches and a web server used as a website. The KDD99 [112] dataset was used in the experiment. The dataset is divided into five key categories, regular, attack, Probe, U2R, and R2L, and utilizes 41 features to describe a connection. The authors' primary focus is on HTTP flood attacks. As a result, data are represented using attack and regular traffic. As a data collection, TCP network connections are employed. The raw dataset is divided into a training dataset and a test dataset. Then the training dataset is used to build the attack detection model. Moreover, the best parameters are determined by repeated testing. The decision function is used to decide how to forward packets. If the output of the process is -1, it is an attack packet. Otherwise, it is a regular packet. In [79], the authors used Mininet-Wifi to verify DIAMOND (the logic of the program) and evaluate its performance by implementing it on the Ryu controller. Mininet-Wifi is used to simulate an SDN-enabled IoT network consisting of eighty IoT endpoints, eight access points, and eight links. They simulated the background traffic of the IoT network, which includes 10% HTTP, 40% HTTPS, 10% TCP, 5% DNS, 10% SSDP, and 5% NTP. Attack traffic consists of traffic generated by 20 IoT endpoints to launch LDDoS attacks against IoT servers and accounts for 20% of regular traffic. In [83], the authors set up the experimental topology on the Mininet simulator and built a topology with one Ryu controller connected to two OpenFlow switches (OpenVSwitch) and six hosts. The authors create a 10 Mbps bottleneck link between switch S1 and S2. For comparison, the bandwidth of the rest of the links is 100 Mbps with a delay of 20 ms. They used a Python socket to create five long TCP connections for a regular user group and used the Iperf tool to measure the bandwidth of the bottleneck link created by a short connection. They used two hosts as attackers and a UDP background generator. They considered LDoS attacks initiated by both TCP and UDP as a dataset.