A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

• Published in: IEEE access Vol. 8; p. 1
• Main Authors: Perez-Diaz, Jesus Arturo, Valdovinos, Ismael Amezcua, Choo, Kim-Kwang Raymond, Zhu, Dakai
• Format: Journal Article
• Language: English
• Published: Piscataway IEEE 01.01.2020; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Architecture; Cybersecurity; DDoS attack mitigation; Decision trees; Denial of service attacks; Intrusion detection systems; Low-rate DDoS (LR-DDoS) attacks; Machine learning; Multilayers; Network operating systems; Performance evaluation; Security management; Software-defined network (SDN); Software-defined networking; Support vector machines; Topology; Virtual environments
• ISSN: 2169-3536; 2169-3536
• DOI: 10.1109/ACCESS.2020.3019330

While there have been extensive studies of denial of service (DoS) attacks and DDoS attack mitigation, such attacks remain challenging to mitigate. For example, Low-Rate DDoS (LR-DDoS) attacks are known to be difficult to detect, particularly in a software-defined network (SDN). Hence, in this paper we present a flexible modular architecture that allows the identification and mitigation of LR-DDoS attacks in SDN settings. Specifically, we train the intrusion detection system (IDS) in our architecture using six machine learning (ML) models (i.e., J48, Random Tree, REP Tree, Random Forest, Multi-Layer Perceptron (MLP), and Support Vector Machines (SVM)) and evaluate their performance using the Canadian Institute of Cybersecurity (CIC) DoS dataset. The findings from the evaluation demonstrate that our approach achieves a detection rate of 95%, despite the difficulty in detecting LR-DoS attacks. We also remark that in our deployment, we use the open network operating system (ONOS) controller running on Mininet virtual machine in order for our simulated environment to be as close to real-world production networks as possible. In our testing topology, the intrusion prevention detection system mitigates all attacks previously detected by the IDS system. This demonstrates the utility of our architecture in identifying and mitigating LR-DDoS attacks.