SNORT based early DDoS detection system using Opendaylight and open networking operating system in software defined networking

• Published in: Cluster computing Vol. 24; no. 1; pp. 501 - 513
• Main Authors: Badotra, Sumit, Panda, Surya Narayan
• Format: Journal Article
• Language: English
• Published: New York Springer US 01.03.2021; Springer Nature B.V
• Subjects: Bandwidths; Computer Communication Networks; Computer Science; Controllers; Cybersecurity; Denial of service attacks; Floods; Hammers; Infrastructure; Intrusion detection systems; Network security; Operating Systems; Packet switching; Processor Architectures; Software-defined networking; Switches; Open network operating system; DDoS attacks; Security; Opendaylight; SDN controllers
• ISSN: 1386-7857; 1573-7543
• DOI: 10.1007/s10586-020-03133-y

Software-defined networking (SDN) is an approach in the network that provides many advantages with the help of separating the intelligence of the network (controller) with the underlying network infrastructure (data plane). But this isolation also gives birth to many security concerns; therefore, the need to protect the network from various attacks is becoming mandatory. Distributed Denial of Service (DDoS) in SDN is one such attack that is becoming a hurdle to its growth. Before the mitigation of DDoS attacks, the primary step is to detect them. In this paper, an early DDoS detection tool is created by using SNORT IDS (Intrusion Detection System). This tool is integrated with popularly used SDN controllers (Opendaylight and Open Networking Operating System). For the experimental setup, five different network scenarios are considered. In each scenario number of hosts, switches and data packets vary. For the creation of different hosts, switches the Mininet emulation tool is used whereas for generating the data packets four different penetration tools such as Hping3, Nping, Xerxes, Tor Hammer, LOIC are used. The generated data packets are ranging from (50,000 per second–2,50,000 per second) and the number of hosts/switches are ranging from (50–250) in every scenario respectively. The data traffic is bombarded towards the controllers and the evaluation of these packets is achieved by making use of Wireshark. The analysis of our DDoS detection system is performed on the basis of various parameters such as time to detect the DDoS attack, Round Trip Time (RTT), percentage of packet loss and type of DDoS attack. It is found that ODL takes minimum time to detect the successful DDoS attack and more time to go down than ONOS. Our tool ensures the timely detection of fast DDoS attacks which delivers the better performance of the SDN controller and not compromising the overall functionality of the entire network.