A Deep ConvNetBased Countermeasure to Mitigate Link Flooding Attacks Using SoftwareDefined Networks Recently, link flooding attacks (LFA) have been observed as a serious threat for cutting off the Internet connectivity through congesting critical links. A LFA typically utilizes legitimate and lowrate flows, which makes it extremely hard to be detected and, subsequently, to be mitigated. In this paper, we present LFShield, that is a deep convolutional neural network (ConvNet) based countermeasure to accurately detect and efficiently mitigate LFAs using softwaredefined network (SDN) paradigm. LFShield can identify malicious bots that launch LFA flows by extracting endhostsxe2x80x99 traffic features and afterwards, classifying the type of endhosts based on deep ConvNet. Then, LFShield mitigates LFAs without affecting legitimate endhosts through blocking the classified malicious bots and limiting the bandwidths of inactive or newlyaccessed endhosts. A LFShield prototype is implemented for evaluating its performance by several experiments. The experimental results demonstrate that LFShield can identify malicious bots with an accuracy of 96.4% and mitigate LFAs with the 93.1% reduction in link degradation ratio, with negligible impact on legitimate endhosts.

A Framework for Distributed Denial of Service Attack Detection and Reactive Countermeasure in Software Defined Network Software Defined Network is an evolving and promising architecture which allows greater control over network entities by centralising the control plane. Although on the surface SDN provides a simple framework for network programmability and monitoring, few has been said about security measures to make it more robust to hitherto security flaws. Among the identified security flaws, DDoS flooding attack continue to be one of the major security concerns as attack volumes are increasing year on year. In this paper, we developed and implement the feasibility of spoofing and flooding DDoS attack on data plane devices using Mininet emulator, floodlight and network performance testing tools. We further developed a mitigation mechanism to counter these attacks by pushing reactive flow through the controller to the attacking switch port. Our result shows that pushing flows through the controller mitigates the flooding attack with low performance overheads, and requires no change to the controllers mode of operation for deployment, which indicates a good performance of our model.