This article has been accepted for publication in a future issue of this journal, but has not been

fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Date of publication xxxx 00, 0000, date of current version xxxx 00, 0000.
Digital Object Identifier

A Flexible SDN-based Architecture for

Identifying and Mitigating Low-Rate
DDoS Attacks using Machine Learning
JESÚS ARTURO PÉREZ- DÍAZ1 , ISMAEL AMEZCUA VALDOVINOS2 , KIM-KWANG
RAYMOND CHOO3 , AND DAKAI ZHU4
1
Tecnologico de Monterrey, Escuela de Ingeniería y Ciencias, México. PO 76130 (e-mail: [email protected])
2
Facultad de Telemática, Universidad de Colima, México. PO 28040 (e-mail: [email protected])
3
Department of Information Systems and Cyber Security and Department of Computer Science, University of Texas at San Antonio, San Antonio, TX 78249,
USA (e-mail: [email protected])
4
Department of Computer Science, University of Texas at San Antonio, San Antonio, TX 78249, USA (e-mail: [email protected])
Corresponding author: Ismael Amezcua Valdovinos (e-mail: [email protected]).
This research was supported by a Joint Seed Funding Award from The University of Texas at San Antonio and Tecnologico de Monterrey,
and also partially supported by the project ”Red temática CYTED 519RT0580” funded by the Ibero-American Science and Technology
Program CYTED.

ABSTRACT While there have been extensive studies of denial of service (DoS) attacks and DDoS attack
mitigation, such attacks remain challenging to mitigate. For example, Low-Rate DDoS (LR-DDoS) attacks
are known to be difficult to detect, particularly in a software-defined network (SDN). Hence, in this paper
we present a flexible modular architecture that allows the identification and mitigation of LR-DDoS attacks
in SDN settings. Specifically, we train the intrusion detection system (IDS) in our architecture using six
machine learning (ML) models (i.e., J48, Random Tree, REP Tree, Random Forest, Multi-Layer Perceptron
(MLP), and Support Vector Machines (SVM)) and evaluate their performance using the Canadian Institute of
Cybersecurity (CIC) DoS dataset. The findings from the evaluation demonstrate that our approach achieves
a detection rate of 95%, despite the difficulty in detecting LR-DoS attacks. We also remark that in our
deployment, we use the open network operating system (ONOS) controller running on Mininet virtual
machine in order for our simulated environment to be as close to real-world production networks as possible.
In our testing topology, the intrusion prevention detection system mitigates all attacks previously detected
by the IDS system. This demonstrates the utility of our architecture in identifying and mitigating LR-DDoS
attacks.

INDEX TERMS DDoS attack mitigation, Low-rate DDoS (LR-DDoS) attacks, Machine learning,
Software-defined network (SDN).

I. INTRODUCTION [5], [6]. The former uses the identified patterns or strings
OW-RATE denial of service (LR-DDoS) attacks is one from protocol header fields as signatures to match incom-
L of the more challenging denial of service (DoS) attack
types to detect, and these attacks are designed to exhaust
ing traffic and determine if the flow is malicious (or not).
In anomaly-based approaches, a model of normal network
computing resources on servers. Unlike high-rate distributed traffic is developed and compared with incoming traffic.
DoS (DDoS) attacks, an LR-DDoS attack does not flood This allows the classification of normal and malicious (or
the network with high traffic loads. Instead, it carefully anomalous) traffic. No system or approach is foolproof. For
triggers specific protocol mechanisms such as TCP’s timeout example, an attacker can fool detection systems to gradually
retransmission [1], [2], congestion control [3] mechanisms, accept malicious traffic as normal [7]. We also observe that
and HTTP’s keep alive mechanism [4], to deplete the target’s most anomaly-based approaches for LR-DDoS detection are
computing resources. based on thresholds [8], and one challenge associated with
such an approach is the computation of an optimal value for
DDoS attack detection approaches can be broadly cate- such parameters.
gorized into signature-based and anomaly-based approaches

VOLUME 4, 2016 1

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

It is also challenging to deploy effective LR-DDoS attack without affecting the rest of the architecture. In addition,
mitigation solutions, in practice [8]. For example, existing computationally demanding modules such as the IDS can
solutions may require updating of the router’s firmware, be located outside the controller. Moreover, the IDS com-
which may not be practical in a number of situations. Given municates with the controller through an Identification API,
the increasing popularity of software-defined network (SDN) which is platform-independent. In other words, system im-
[9], there have been reported LR-DDoS attacks targeting plementers can use any programming language and libraries
such networks [10], [11]. SDN is a relatively new net- as needed. Another feature is that our IDS is capable of
working paradigm, designed to facilitate the decoupling of distinguishing between anomalous and normal traffic flows
control and forwarding planes from network devices (e.g., and determining the type of LR-DDoS attack being carried
routers and switches) and provide a logically centralized out.
control and management entity. However, SDN can also be The rest of the paper is organized as follows. Sections
leveraged to facilitate the detection and mitigation of LR- II and III respectively describe LR-DDoS attacks and sum-
DDoS attacks. For example, SDN provides a programmable marize current LR-DDoS attack detection and mitigation
feature, in which network operators can develop and deploy approaches. Section IV describes our proposed architecture.
network applications that run on top of the controller to Section V and VI describe the evaluation setup and findings.
provide network functionality. Such features can potentially Specifically, we evaluate the effectiveness of our proposed
be used to facilitate the deployment of detection and mit- approach in detecting and mitigating the following LR-DDoS
igation mechanisms for LR-DDoS attacks. Moreover, the attacks: DDoSSim, GoldenEye, H.U.L.K., R.U.D.Y., Slow
controller provides an environment in which a vast number Body, Slow Headers, Slowloris, and Slow Read; using six
of programming libraries can be used to develop networking ML techniques (i.e., J48, Random Trees, REP Tree, Random
applications. In other words, one can utilize state-of-the-art Forest, Multi-Layer Perceptron (MLP), and Support Vector
technologies such as machine and deep learning algorithms Machines (SVM)). Finally, the last section concludes this
to enhance the detection and mitigation of LR-DDoS attacks. paper.
In this paper, we introduce a new versatile architecture
for LR-DDoS attack detection and mitigation in SDN en- II. PRELIMINARIES
vironments using machine learning techniques. Specifically, This section briefly describes LR-DDoS attacks, prior to
this architecture comprises an intrusion prevention system introducing LR-DDoS detection and mitigation techniques in
(IPS), which will forward the flows to the intrusion detection the next section.
system (IDS) API. This will allow us to determine whether
the flow is malicious (or not). The IDS API will identify A. LOW-RATE DOS ATTACKS
the flow using one of several previously trained machine Kuzmanovic and Knightly [1], [15] introduced shrew attacks,
learning (ML) models. This API is programming language which are a low-rate attacks targeting TCP’s retransmission
and framework independent, and hence we can use different time-out mechanism in order to deny bandwidth to legitimate
programming languages and frameworks to implement and TCP flows. Shrew attacks consist of carefully chosen short
train the AI models. Once the IDS API returns the result, the malicious bursts that repeat at a fixed slow-timescale fre-
IPS module running on the controller will process the flow quency. The authors explained that the effectiveness of low-
accordingly to the mitigation strategy of the architecture if rate attacks depends on the ability to create correlated packet
the flow is determined to be an attack. In summary, in this losses, forcing TCP to enter into retransmission timeouts.
paper: While LR-DDoS attacks are still an ongoing concern to
highly centralized services such as cloud computing and big
• We present a flexible security SDN-based architecture data service platforms, they are less studied and reported in
aimed at LR-DDoS attack detection and mitigation comparison to DDoS attacks. This is, perhaps, as explained
through the use of multiple machine learning and deep by Wu, et al. [16]:
learning techniques.
• An attacker must achieve accurate traffic synchroniza-
• We implement and demonstrate the potential of the
tion in their implementations. This complicates the im-
proposed approach in detecting and mitigating several
plementation of LR-DDoS attacks, in practice.
LR-DDoS attacks, namely: DDoSSim [12], GoldenEye
• LR-DDoS attacks are ‘integrated’ with legitimate traf-
[13], H.U.L.K. [14], R.U.D.Y., Slow Body, Slow Head-
fic. Thus, network operators may attribute low perfor-
ers, Slowloris, and Slow Read.
mance to system equipment or line failures. In other
• We evaluate the performance of six machine and deep
words, LR-DDoS attacks are not detected and hence,
learning techniques for LR-DDoS attacks (i.e., J48,
under-reported.
Random Trees, REP Tree, Random Forest, Multi-
• It is difficult to extract and analyze characteristics of
Layer Perceptron (MLP), and Support Vector Machines
LR-DDoS attacks. To avoid panic among users, network
(SVM)) in LR-DDoS attack detection and mitigation.
operators are not reporting such attacks since there is
Our modular architecture will allow system implementers insufficient evidence to classify performance issues as
to easily replace or enhance a module, API, or ML model attacks.
2 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

LR-DDoS attacks are hard to detect since they have the guages in applications instead of low-level, vendor-
same characteristics as legitimate traffic and are hidden in specific commands;
background traffic. Attacks are launched through a single 2) application development is straightforward since the
attack source and its average rate is low enough, so the controller provides useful network abstractions, such
number of packets sent is very small and challenging to as global network views, and consequently one
detect. Thus, common DDoS attack detection mechanisms achieves more efficient and sophisticated control; and
are not effective in detecting LR-DDoS attacks. 3) switching devices become multi-purpose devices be-
A number of researchers have also demonstrated how the cause they follow flow rules provided by the control
effectiveness of LR-DDoS attacks can be improved. Li, et layer.
al. [17], for example, proposed a multiplexing technique to Figure II-B provides an architectural view of SDN.
fill the idle time between requests in order to enhance LR- The fundamental principles of the SDN architecture are as
DDoS attacks and degrade the target system’s performance. follows:
Zhang, et al. [18] introduced a LR-DDoS attack aimed at 1) the decoupling of physical and logical layer in net-
border routers, specifically exploiting the transport layer working devices, allowing each layer to evolve in-
vulnerabilities of BGP. Thus, it is important to address and dependently, enables innovation, acceleration of new
provide extensible solutions to the detection and mitigation features and services, manageability, among others;
of LR-DDoS attacks in real-world networks. 2) devices and users should not be able to differentiate
A LR-DDoS can be broadly characterized by four param- between conventional networks and SDN; and
eters [19], [20], namely: Ta is the attack period (frequency 3) automation and runtime deployment by logically
for sending malicious packets), Tb is the burst width (time centralizing the control plane and introducing pro-
duration of the attacking pulse), Rb is the attack burst rate grammable entities.
(amount of traffic), and s is the starting time of the attack.
The above fundamental principles can be achieved in the
This also implies that such an attack can be identified using
three-layer architecture presented by the Open Networking
the source IP and port, destination IP and port, and the
Foundation (ONF), which is also described below:
protocol used in the attack. Figure 1 shows a LR-DDoS attack
with a single source. 1) The application plane includes a variety of services
Generally, LR-DDoS are facilitated using multiple and applications such as Deep Packet Inspector (DPI),
sources, say F1 , F2 , · · · , Fn for each flow. If Ta , Tb , and Rb Intrusion Detection Systems (IDS), Intrusion Preven-
are equal for each flow Fi , the attack is defined as a group tion Systems (IPS), and monitoring. They can inform
flow (a set of attacks with the same target and characteristics). decision-making in a range of applications such as
Combination of group flows (different parameters for each traffic engineering, quality of service (QoS) differen-
attack) enables more disruptive attacks. Zhang, et al. [19] tiation, monitoring, and routing.
provided a classification for LR-DDoS attacks: 2) The control plane is responsible for the management of
the underlying forwarding devices by using global net-
• Attack Frequency Intensification (AFI). The distributed work knowledge and information for decision making.
attack has the same parameters but different starting It also interacts with the application plane to provide
times (s). Thus, the attack has a higher frequency. useful information for applications.
• Attack burst Width Intensification (AWI). An attack 3) The data plane includes a variety of forwarding devices
burst is immediately followed by another attack burst. such as routers and switches. They forward packets
Therefore, the total attack burst is intensified n times. based on flow tables populated by the control plane. It
• Attack burst Rate Intensification (ARI). If two or more is also responsible for collecting network information
flows start at the same time, the burst rate (Rb ) for each and statistics to be later shared with the controller.
flow is aggregated.
In our work, we use a SDN-based architecture, where a
• Mixed Intensification (MI). Complex combinations of
solution can be developed through an application that can
previous attack type categories.
be installed in the controller for the detection and mitigation
of LR-DDoS attacks. This, in turn, makes use of the pro-
B. SOFTWARE-DEFINED NETWORKING
grammable nature of the network by using new technologies
SDN is a relatively new networking paradigm, which can such as machine and deep learning techniques to provide
help mitigate the limitations of current switching networking robust mechanisms for detecting and mitigating LR-DDoS
by decoupling control and data planes, formerly implemented attacks.
inside switches and routers, and enabling more flexible and
manageable environments [21]. In SDN, the control plane III. RELATED WORK
is located in a logically centralized controller, which simpli- Xiang et al. [7] proposed a detection mechanism based on
fies policy enforcement and network configuration evolution Shannon’s entropy of information theory as well as a trace-
[22]. There are several benefits of using SDN, such as: back mechanism to detect attackers in a local area network. A
1) network policies are defined using high-level lan- generalized entropy metric is used as a mechanism to detect
VOLUME 4, 2016 3

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

Rate Tb

Rb
s Ta Time

FIGURE 1. LR-DDoS attack model. Burst traffic (Tb ) is sent to the target every Ta seconds at a Rb B/s rate, starting at s seconds.

App 1 App 2 ... App N

Northbound API
Control plane

Network Abstractions

SDN Controller

Southbound API
Data plane

Switch 1 Switch 2 ... Switch N

Network Infrastructure

FIGURE 2. SDN Architectural View.

anomalous traffic. The authors assumed that malicious traffic example, AADS network devices need to be placed inside
follows a Poisson distribution and normal traffic follows a several networks and network traffic models must be known
Gaussian normal distribution, as they argued that the entropy beforehand to properly calculate entropy values.
value on Gaussian distributions is higher than that of the Kumawat and Meena [24] proposed a framework for the
Poisson distribution. This entropy value, an indicator of the detection and mitigation of low-rate DoS attacks based on in-
randomness of a variable, is then used to classify malicious formation entropy analysis. The framework has three phases,
traffic from normal traffic. Also, the probabilities for the namely: (1) the characterization phase calculates the entropy
computation of the entropy have to be defined beforehand. of each flow and compares them with a set of predefined
Experimental results showed that the generalized entropy thresholds; (2) the detection phase classifies the flow as high-
metric achieves better performance than Shannon’s entropy. rate DoS attack if its entropy is higher than the threshold
However, such mechanisms for low-rate attack detection for that flow, and as low-rate DoS attack if it is lower than
are difficult to implement since several values have to be the threshold; and (3) the mitigation phase stops the attack
computed beforehand and, since each network dynamics and near the source. The framework was evaluated using NS-
topology are different, such values have to be tuned for 2 (a network simulator), and achieved good results in the
optimal performance. mitigation phase. However, there are several drawbacks with
Baskar et al. [23] argued that entropy is only one of the this approach. First, there is no clear way to determine the
few feasible parameters to detect low-rate DoS attacks due thresholds for each flow as it requires an statistical study of
to its low computing requirements and effectiveness on the each flow. Moreover, the behavior in entropy of each flow can
study of flow randomness. They then proposed a framework be determined by the type of generated traffic, the communi-
an adaptive IP traceback mechanism for detecting low-rate cation protocol used, the communication technology, among
attacks. In their architecture, an AADS device is placed on others. In addition, normal flows can be classified as low-rate
each LAN and is responsible for detecting the attacks. When attacks because not all traffic is constant for the reasons stated
an AADS detects a change in entropy, it communicates with earlier.
the routers to obtain information about the attacker. The Bhuyan et al. [25] provided a comparative evaluation of
architecture was evaluated through simulation experiments. several information metrics for low-rate DoS attack detection
However, there are several limitations in this approach. For approaches. The authors compared Hartley entropy, Shannon
4 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

entropy, Renyi’s entropy, and Generalized entropy in terms than 5, 000 packets in less than 2 seconds, then the system
of their ability in detecting low-rate attacks. Two datasets is deemed to be experiencing a multi-scale low-rate DDoS
were used to evaluate such metrics, namely: the MIT Lincoln attack. Experiments were carried using the MIT Lincoln
Laboratory for normal traffic and the CAIDA DDoS 2007 Laboratory (attack-free) dataset and the CAIDA DDoS 2007
for attack traffic datasets. Results showed that for low-rate dataset for attack traffic. Results showed that this approach
attacks, increasing the order of generalized entropy pro- has a 98.57% attack detection. However, a careful selection
vides better results by Padjusting the value of order for α in of the threshold δ is essential to achieving good performance.
1 n
Hα (x) = 1−α log2 ( i=1 pα i ). However, entropy-based so- SDN architecture has a programmable feature, in which
lutions require large amounts of data before they can provide network operators can develop and deploy applications that
good decisions. run on top of the controller to provide network functionality.
Bhuyam et al. [26] proposed a mechanism based on cor- This makes the detection and mitigation of several DDoS
relation coefficients to detect low-rate and high-rate DDoS attacks easier to implement and evaluate on real network
attacks. Correlation is important in finding linear relationship deployments. Hong et al. [32] introduced the Slow HTTP
between two variables. Specifically, partial rank correlation is DDoS Defense Application (SHDA) that runs on top of an
used to detect low-rate attacks. The detection mechanism is SDN controller. On the detection of an incomplete HTTP
based on the idea that malicious instances (attackers) have transaction and the number of open connections on the web
correlation coefficients close to one. The mechanism uses a server exceeding a certain threshold, the SHDA processes
correction based on two thresholds to justify whether packets the packets coming from the attacker and determines based
are malicious or not. Results showed that correlation between on timeouts if the particular traffic is malicious or not. The
two malicious traffic instances is strong. It is, however, not SHDA installs a new flow rule that blocks the attacker’s flow
clear if the proposed solution works when just one malicious at the switch. This approach provides a basic scheme for
traffic instance is attacking the network. This limits its poten- SDN-based mitigation techniques for low-rate DoS attacks.
tial. However, attackers may dynamically vary the sampling pe-
Hoque et al. [27] introduced a statistical measure for multi- riod of HTTP requests, making it difficult to mitigate low-rate
variate data analysis to classify DDoS attack traffic from nor- attacks based solely on timeouts.
mal traffic. Three features are selected, namely: the entropy Wu et al. [33] stated that low-rate DoS attacks cannot
of source IPs, their variation, and the packet size of malicious pose a threat in SDN environments since the controller is a
traffic flows. Normal traffic is used to determine the traffic’s powerful machine. However, SDN devices (e.g, OpenFlow
normal profile. The captured traffic is then compared against switches) have limited capabilities and can become a target
the profiled traffic to classify traffic as either malicious or for such attacks. In fact, some researchers have already car-
normal. However, it is not clear how the proposed metric is ried out successful attacks against the limited TCAM feature
used to detect low-rate attacks. of switches [34]. The TCAM is responsible for storing flow
Zhang et al. [28] proposed the Congestion Participation rules dictated by applications running on top of the controller
Rate (CPR) metric to detect and filter low-rate DoS attacks. in an SDN. Thus, the authors [33] studied four features,
CPR identifies attacking flows since low-rat attacks actively namely: the amount of time a flow rule is present in a switch,
induce network congestion. CPR is designed to distinguish the total number of packets matched by a flow rule, the rela-
between normal TCP flows and low-rate attack flows, and it tive dispersion of bytes between normal and attacking flows,
is based on the ratio of incoming packets in congestion to and the relative dispersion of packet intervals of arrival. A
the total incoming packets from certain flow. CPR can be Factorization Machine algorithm was used to obtain a lineal
implemented on the front of the Random Early Detection model of the system based on the input features described
(RED) [29] queue management mechanism of routers. Kieu earlier. Performance was evaluated using the NSL-KDD,
et al. [30] extended the CPR approach based on the argument DARPA98, and CAIDA datasets in a simulated environment.
that CPR sets a fixed threshold for low-rate attack detection, Container-based cloud services are rapidly growing due to
resulting in unfair treatment of new TCP flows that still are to its ease of deployment and complete control for customers. In
achieve high throughput. The authors also proposed a method traditional cloud environments, a web application is expected
to adapt this threshold according to whether the network is to run as an independent instance on a virtual machine. If a
under attack or not. component of the application experiences a DDoS attack, the
The authors in [31] used the Generalized Total Variation entire instance is at risk. Container-based cloud environments
metric for detecting low-rate DDoS attacks. This approach used alongside with microservice architectures are more
separates legitimate traffic based on sampling values of ar- effective and agile in resources usage, providing straight-
riving packets, where wider spacing values indicate low-rate forward techniques to scale. As discussed previously, SDN
attacks. A value of the generalized total variation metric allows the deployment of networks based on software. All
between two consecutive samples, will trigger an alarm if implementations of algorithms and protocols are available as
the value exceeds a threshold δ. Given two systems, if the software entities instead of firmware entities in closed-source
first system sends more than 500 packets in an interval of devices. Thus, SDN and container-based environments can
more than one second, and the second system sends less be used in conjunction as virtualized networking functions
VOLUME 4, 2016 5

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

(NFVs), in order to provide more robust and flexible ways of rate DDOS attacks. Moreover, our approach allows machine /
controlling resources for services. Li et al. [35] provided a deep learning techniques to fully utilize GPU for faster train-
model and mitigation technique to detect and block low-rate ing and classification, since such applications are standalone
attacks on container-based cloud services. They proposed processes.
the isolation into two parts of instances, where one part As shown in Figure 3, the framework comprises two in-
controls requests from a whitelist (legitimate traffic) and the dependent systems, namely: an Intrusion Prevention System
other serves unknown requests (both malicious and benign (IPS) and an Intrusion Detection System (IDS).
requests). The mitigation mechanism computes the mini- The IPS consists of three sub-modules:
mum resources and optimum number of containers for each
1) the Flow Management module is responsible for de-
trusted connection (users with access rights). Then, resources
tecting HTTP flows for further processing;
are isolated into containers to avoid resource competition.
2) the Suspicious Attackers Management manages a
However, unknown requests are a combination of malicious
blacklist of potential attackers; and
and normal traffic. The system then guarantees resources for
3) the Mitigation Management module generates flow
normal traffic in unknown requests while giving minimum
rules for malicious flow mitigation.
resources to malicious traffic. However, instantiating contain-
ers according to the amount of traffic required by users affects The IDS also consists of three sub-modules, which are
directly in processing power and memory consumption of the described below:
overall system. 1) the Identification API provides an interface for the
Zhang et al. [36] provided a low-rate attack detection using interaction between the IPS and IDS systems;
Power Spectral Density (PSD) entropy and Support Vector 2) the ML Model Selection consists of a set of trained ML
Machines (SVM). They argued that PSD-entropy has low- models used for flow identification, and
computation cost and improves detection and efficiency of 3) the Identification performs malicious flow classifica-
the system. To classify traffic, two thresholds are calculated tion.
by computing the mean of normal traffic and the mean of
We remark that the IPS is executed on top of the ONOS
attacking traffic. If the calculated entropy is lower than the
controller and the IDS is executed on a separate host (for
lowest entropy, it is classified as attacking traffic. SVM is
demonstration, we used Windows 10 in our experimental
used to learn traffic patterns and to select appropriate features
setup). In practice, the IDS can be deployed at any remote
for the detection algorithm.
host with any operating system and system libraries. How-
Liu et al. [8] explained that traffic volume analysis cannot
ever, for optimal performance its deployment should be close
detect current stealthy low-rate DoS attacks. They then pro-
to the IPS (that runs on the top of the controller) to avoid
posed a deep convolution neural network (DCNN) to extract
latency due to bandwidth limitations.
available features automatically, and a Q-Network method
(a reinforcement learning algorithm) to detect edge low-rate Figure 3 shows the steps of a typical scenario in which a
DoS attacks. Results showed that this approach can maintain potential threat is mitigated:
acceptable network performance in simulated environments. 1) The IPS is a network application running on top of the
Meti et al. [37] proposed using SVM and Neural Networks ONOS Controller. In this stage, the Flow Management
(NN) as classifiers for intrusion detection and DDoS attacks module is responsible for installing flow rules inside
in SDN. The approach showed promising results in detecting the SDN Device for HTTP header detection. The SDN
regular DDoS attacks for NN with 80% accuracy and 100% Device requires a flow rule installed in order to detect
precision. Similarly, Virupakshar et al. [38] evaluated the HTTP flows and to forward them to the controller and
performance of Decision Trees, K-nearest neighbor (KNN), subsequently to the Flow Management module.
Naive Bayes, and Deep Neural Network (DNN) in flooding 2) A flow incoming from a physical Port at the SDN
attack detection on an OpenStack-based private cloud. Their Device is matched against the flow table entry installed
findings showed that KNN, Naive Bayes and DNN achieve by the Flow Management module, seeking for HTTP
high accuracy, specially for DNN. headers. If a match exists, the SDN Device forwards
through a Secure Channel the flow to the SDN Con-
IV. ARCHITECTURAL DESIGN troller and later to the Flow Management module.
We will now present our proposed framework designed to 3) The Flow Management module creates a JSON object
mitigate Low-rate DDoS attacks in SDN. Specifically, the with the headers from the flow to be later forwarded to
framework decouples the detection and mitigation processes the Identification API for further inspection indicating
from the network application, thus reducing processing re- which ML model should be use.
quirements from the controller, while being programming 4) The Identification API selects the proper model from
language independent and technology-agnostic. Therefore, the ML Model Selection module and forwards the flow
any programming language and machine / deep learning headers to the Identification module for classification
framework can be used to implement and train different as an attack or normal flow. The IDS sends a proper
techniques and models to identify different types of Low- JSON response to the IPS on the controller.
6 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

Intrusion Prevention System JSON Request

Suspicious Attackers
Management JSON Response Identification API
Flow Management
3
Mitigation Management
1 ML Model Selection
5
4
ONOS Controller
Identification

ONOS Server

Service API
SDN Device Intrusion Detection System
Secure Channel
2

6
Packet Forward
Matching Action

Drop

Port Port

FIGURE 3. Our proposed framework.

5) The Suspicious Attackers Management module keeps a by the Identification API is extracted as signatures and is
blacklist of the attackers previously identified by the then compared against patterns or rules and complex regular
IDS. Further explanation of this module is provided expressions (RegEx). If no matches are found, the header
in Section IV-B. The Mitigation Management is con- information is then processed by the anomaly-based IDS
stantly looking for high values of probabilities(100%) that involves machine / deep learning techniques. The infor-
in the Suspicious Attackers list, in order to create the mation flows as a daisy chain process passing first through
proper flow rules for attack mitigation. the signature-based IDS approach and, if does not match,
6) Finally, the previously created rules are installed inside through the anomaly-based IDS. Such hybrid IDS remains
the SDN Device through the ONOS Controller and the a topic of ongoing research interest [40]–[43] and can further
Secure Channel to mitigate a host (ab)used to carry out be enhanced and tested by implementing modular architec-
the attack. tures such as our proposed framework.
The Identification API allows researchers and operators to
implement a wide range of machine / deep learning algo- A. IDS AND IDENTIFICATION API
rithms since different techniques are best suited for different The Identification API provides an interface for flow process-
scenarios. The logical separation of the IDS from the con- ing using trained machine / deep learning models. The inter-
troller allows one to use different hardware architectures for face defines a Classify object that performs the identification
faster machine / deep learning model training and processing. of a Flow attribute using a Classifier. The classifier
Moreover, the framework provides a reference model for is a string that represents the different trained ML models
future machine / deep learning-based techniques not only available in the IDS. The flow complex object gathers flow
for security, but also for other network operations such as statistics from SDN Devices for classification as an attack or
optimal path finding in large-scale networks. a legitimate flow. The attributes on this flow complex object
Currently, the proposed framework employs an anomaly- are based on flowtbag1 . Algorithm 1 shows the process per-
based IDS, where we use a defined model of normal network formed for the classification of flows inside the IDS module.
behavior (trained machine / deep learning models) in order to
As stated before, the framework allows the implementation
detect deviations from such a model [39]. We can, however,
of different ML models. We were able to implement the
employ a hybrid IDS based on both anomaly and signature
approaches in order to provide a more robust identification
system. In such a scenario, the header information received 1 https://github.com/DanielArndt/flowtbag/wiki/features

VOLUME 4, 2016 7

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

Algorithm 1: IDS classification process •R.U.D.Y, R U Dead yet DoS tool

input : JSON request with traffic flow parameters •SlowBody2
output: JSON response with flow classification • Slow Headers
• Slowloris
1 Receives a set of flow parameter inputs; • Slowread
2 Selects the ML model specified in the JSON request;
We used the CIC DoS Dataset (2017) [56] to train the
3 Classifies the input parameters with the selected
algorithms. The Identification API returns a JSON object
model;
with 0 if the flow is classified as legitimate, and numbers
4 if flow is classified as anomalous then
[1 − 8] for each of the attack types listed earlier.
5 Detects the type of attack;
6 Creates a JSON response with the attack type as
B. IPS AND MITIGATION STRATEGY
data;
As we have already explained, an IDS API was initially
7 Sends the JSON response to the IPS;
developed to request flows regularly and analyze them by
8 else
invoking a previously AI trained model. The flows are sent
9 Creates a JSON response with attack type as 0;
by the Flow Management module, which also received the
10 Sends the JSON response to the IPS;
reply of the IDS API. In this first version of the IPS of our
11 end
architecture, we decided to implement an efficient and not
overwhelming method that makes it easier for scalability.
Algorithm 2 shows the process of extracting features from
following algorithms to evaluate their accuracy in detecting incoming flows.
LR-DDoS attacks:
• J48 provided by Weka, an open source, machine learn- Algorithm 2: IPS flow management
ing library written in Java. J48 implements C4.5 deci- input : Traffic flows
sion trees [44] for classification; output: JSON request with traffic flow parameters
• Random Tree provided by Weka. It considers K ran- 1 Extracts flow and header features from incoming
domly chosen attributes at each node for classification; traffic;
• REPTree provided by Weka. It builds a deci- 2 Creates a JSON request with flow and header features;
sion/regression tree using information gain/variance 3 Sends the JSON request to the Identification API;
with reduced-error pruning;
• Random Forests. Tree predictors for classification [45].
• Multi-Layer Perceptron (MLP) provided by TensorFlow The IDS API will return a 0 if it is a normal flow, otherwise
2.0 and Scikit-Learn 0.23. MLP has been proven to it will return a number that correspond to the one specific
provide good accuracy in detecting DDoS attacks [46]; LR-DDoS attack that was detected. Once the IDS returns an
and attack match for a tested flow indicating that the source of this
• Support Vector Machines (SVM) provided by Scikit- flow could potentially be an attacker, the Flow Management
Learn 0.23. SVM has proven to be an effective classifi- module forwards the information of the potential attacker to
cation technique for DoS attacks in SDN environments Suspicious Attacker Management module where the source
[47]. IP address is blacklisted in a blacklist (flow drop probability
table) of potential attackers and would be added with a
From our literature review, we observe that MLP is widely flow drop probability in the control plane of 10%. If the IP
used in several works [48]–[54] as a promising detection address is already in the blacklist when it is received by the
technique for traditional DDoS attack detection. Also, as far Suspicious Attacker Management module then the source IP
as we know MLP algorithm is ideal for tabular datasets or address will increase its flow drop probability in 5% and
presented data like those coming from our dataset. Studies so on. It means that the IPS will increment the flow drop
like Kim and Gofman [55] show that MLP yields better per- probability in 5% for every flow that match with an attack
formance compared to other Deep Neural Networks. There- by the IDS. Algorithm 3 illustrates the process of mitigating
fore, we chose MLP for the evaluation and validation of the an attacker.
proposed framework considering some other deep learning Before an attacker’s IP reaches the threshold of 30% in the
algorithms as future work. flow drop probability table, the flows of that IP will be for-
The above algorithms implemented in our architecture warded properly preventing the blocking of legitimate hosts
were adapted to effectively identify malicious flows in LR- that could have been identified mistakenly as an attacker.
DDoS attacks. As mentioned in Section I, the included at- After passing the 30% threshold, the flows of the possible
tacks in the Dataset which are later identified are listed below: attacker will be forwarded throughout a dropping function
• DDoSSim a layer 7 DDoS simulator that will drop approximately a number of flows according
• GoldenEye to the percentage that this IP has in the drop probability
• H.U.L.K the HTTP Unbreakable Load King table. It implies that this function for example will drop
8 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

Algorithm 3: IPS mitigation management Web servers, where LR-DDoS attacks were launched from
input : JSON response with flow classification other virtualized hosts. The SDN Devices (network switches)
output: Flow rule are controlled by an ONOS Controller. Figure 5 shows a
screenshot of the initial implementation of the architecture
1 Extracts classification data from JSON data; on the virtualized ONOS environment. We chose to use
2 if flow classification is anomalous then VirtualBox for virtualization because the ONOS Project con-
3 The source IP address is appended to a blacklist; veniently provides a dockerized ONOS environment that is
4 end straightforward to use and ready to start the development
5 if source IP address already on list then and deployment of projects such as the one described in
6 if source IP address probability ≥ 100 then this manuscript. In this initial testbed, we can see how the
7 The controller issues a drop rule with the IDS API is identifying the Slow Headers attack which is
accumulated probability of dropping the performed by two attacking clients while two other legitimate
flow; clients are sending normal traffic flows in the same network.
8 else The main goal of this first approach was to test the IDS
9 Increases in 5% the probability on a Flow and the basic functionality. The testbed implementation was
drop table; further improved, enabling the use of different administrative
10 end domains (different networks) as depicted in Figure 4. This
11 end figure shows a based topology used to implement several tests
including more hosts and devices. Moreover, implementing
the proposed architecture using virtualized environments and
approximately 6 of every 10 flows for an IP which has a flow ONOS as the controller, allows for straightforward deploy-
drop probability of 60%. ment into real network architectures, since ONOS has been
If a 100% flow drop probability is reached by a host, the used in production environments.
Suspicious Attacker Management module will forward its As shown in Figure 3, the IPS runs on top of the ONOS
information to the Mitigation Management module where Controller whilst the IDS runs on a separate host inside the
a blocking port flow rule will be immediately created and network. The controller and the IDS communicate through
sent to the proper switch, dropping all flows matching that IP the Identification API as explained in Section IV. The
address, and its Destination TCP/UDP port. After seven days SlowHTTPTest tool is used to launch LR-DDoS attacks from
with manual intervention by the administrator, the rule will the attackers to the virtualized Web server. The IPS then
expire and the host’s flow drop probability will be reset to detects such flows and passes the information to the IDS
0%, and finally, the traffic of this host will be analyzed again. for further processing. Figure 4 depicts the network topology
Due to its modular design, our framework allows to lo- employed for experimental purposes.
cate the IDS outside the controller in a separate hardware From Figure 4 we observe that the hosts on each of the
component. This design decision follows the idea that the switches belong to different networks. The Web Server on
controller should not perform complex tasks such as flow Switch 3 is the target of Attacking Host 1 and Attacking
classification. Thus, the controller only needs to focus on Host 2 belonging to Switch 1 and Switch 2 respectively. We
processing incoming flows and makes decisions about those assume that the attacking hosts are compromised and they
flows according to flow rules. For this reason, in our testbed could even be part of a botnet [57], where each attacking host
the controller stays stable without any significant changes can generate malicious traffic using the SlowHTTPTest tool.
while running simultaneously the IPS and IDS compared to Legitimate Host 1 and Legitimate Host 2 generate normal
running only the IDS. Also, it is important to mention that the flows with a pseudo random function using curl targeting
IPS does not demand a lot of resources since the algorithm is the Web Server. All switches in the topology are being
very efficient as shown in Algorithm 3. controlled by the ONOS Controller (management address).
It is worth noting that, we opted to target Web servers for
V. EXPERIMENTAL SETUP our experimental evaluation since they are one of the most
In order to evaluate the viability and the functionality of used and vulnerable services on the Internet. Moreover, some
our framework, we developed a diverse portfolio of machine of the LR-DDoS attack detection mechanisms target HTTP
and deep learning classifiers. In this section we describe the specifically and web servers normally have less resources
experimental setup and technologies used to evaluate the than the controller, so if the architecture is able to protect the
performance of different ML techniques and the viability of web servers it will be able to protect the controller as well.
the framework. Once the topology is setup, the Legitimate Host 1 and
Legitimate Host 2 start to send normal traffic. At the same
A. VIRTUAL ENVIRONMENT SETUP time, the Attacking Host 1 starts sending LR-DDoS attacks
The SDN environment is emulated using Mininet, a helpful while the Attacking Host 2 starts by sending legitimate traffic
tool that enables the creation of virtual network topologies. and after a while it becomes an attacker and starts attacking
Virtualized hosts were configured as legitimate hosts and as well with the Attacking Host 1 to create a LR-DDoS attack.
VOLUME 4, 2016 9

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

Legitimate Hosts generate HTTP traffic

using curl through a pseudo-random Intrusion Prevention
function every 5 seconds (configurable). System
Service API
Attacking Hosts generate HTTP traffic
using slowhttptest for any attack type ONOS Controller Intrusion Detection
available in the tool.
System
172.17.0.1

Switch 1 Switch 2 Switch 3

10.0.1.1 10.0.1.2 10.0.2.1 10.0.2.2 10.0.3.1

Legitimate Attacking Legitimate Attacking
Web Server
Host 1 Host 1 Host 2 Host 2

FIGURE 4. Experimental virtualized network topology.

During the attack we used different kind of attacks provided TABLE 1. Dataset number and percentage of flows by type
by SlowHTTPTest utiliy (such as Slowloris, Slow headers,
Type of traffic Number of flows Percentage
R.U.D.Y., etc.). Reactive Forwarding is enabled on the ONOS Legitimate 113, 438 85.68213%
Controller for packet forwarding between network switches. DDoSSim 2, 185 1.650375%
Furthermore we tested some other testbed settings by increas- GoldenEye 661 0.499268%
H.U.L.K. 2, 088 1.577111%
ing the number of hosts and devices in the architecture, where R.U.D.Y. 2, 070 1.563515%
the framework shows an stable and acceptable performance. Slowbody2 4, 391 3.316616%
Slowheaders 3, 185 2.405699%
B. DATASET Slowloris 2, 912 2.199496%
Slowread 1, 464 1.10579%
Traditional DoS/DDoS attacks are characterized by a high
volume of application-layer requests. On the other hand, low-
TABLE 2. Optimal training parameters.
volume or LR-DDoS attacks employ minimal traffic trans-
mitted strategically. While there are a small number of pub- Algorithm Training Parameters
licly available datasets, namely the NSL-KDD, CAIDA, and J48 Two instances per leaf, three folds for re-
CIC DoS 2019 datasets, only the 2017 CIC DoS dataset [56] duced error pruning, one as seed for random
data shuffling.
captures LR-DDoS attacks. The NSL-KDD dataset focuses Random Tree Twelve random attributes to investigate, 27
mainly on remote to local, user to root and general DDoS minimum instances per leaf, 0.0001 mini-
attacks, while CIC DoS 2019 dataset includes reflection and mum class variance proportion, one as seed
for random number generator, 23 maximum
exploitation DoS attacks. depth of the tree, five folds for backfitting,
We also need data to train the models, and therefore a and randomly break ties when several at-
compilation of data flows with both normal traffic and LR- tributes look equally good.
DDoS attacks are used. Specifically, we used the CIC DoS REP Tree 28 as maximum tree depth.
Random Forest Infinite depth, 50 trees maximum, seven
Dataset (2017) [56], which contains regular traffic (labeled random fields per tree.
as normal) and eight low rate attack variations. The features SVM RBF kernel classifier and
source IP, destination IP, ports, and protocol are removed C = 7.303885828086103,
γ = 0.08590489412933254.
from the original dataset since they do not add relevant infor- MLP 30 epochs, five layers (one input, three hid-
mation about the LR-DDoS attacks. Moreover, the original den, one output).
dataset consists of packets over a conventional network, and
flowtbag was used to convert the packet data as flow data,
to adapt the dataset to an SDN environment. Flowtbag takes search technique gathers samples from the search space and
as input a set of packets with 44 features, and outputs flows evaluates sets from a specified value-range with a uniform
with the same 44 features. Table 1 shows the distribution of probability distribution. It was also used to find the opti-
the different types of traffic available in the dataset. Readers mal values for parameters as activation functions, maximum
interested in the complete list and description are referred to number of iterations, and the size of hidden layers. The
[58]. gradient search technique uses an exhaustive search for every
possible value of every given combinations. The combination
C. HYPERPARAMETER OPTIMIZATION of random and grid searches are used to train the parameters
Two different approaches for hyperparameter optimization of each classifier, the general training parameters including
were used depending on the ML techniques. The random all the algorithms are shown in Table 2.
10 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

Attacking Client 1 HTTP Server

ONOS Controller Log

Attacking Client 2

FIGURE 5. Initial experimental implementation. The controller is detecting the SlowHeaders attack (highlighted in red) from attacking clients.

TABLE 3. SVM accuracy score. accuracy, precision, recall, and F1-measure with low false
alarm rate.
Kernel Score
Linear 85%
Accuracy is computed as follows:
Polynomial 86%
Radial Basis Function 87%
TP + TN
Accuracy = (1)
Sigmoid kernel 83% TP + TN + FN + FP
In the above equation, true positive (TP) denotes the
correctly classified malicious flow, true negative denotes the
Further optimizations on SVM include the training of
correctly classified normal flow, false negative (FN) is the
different kernels, including linear, polynomial, Radial Basis
incorrectly classified normal flow, and false positive (FP) is
Function (RBF), and Sigmoid kernel using a subset of the
the incorrectly classified attacking flow.
dataset. RBF kernel classifier is selected since it shows better
False alarm rate is calculated as follows:
accuracy score. Table 3 shows results for SVM accuracy
using different kernels. For MLP we found the best perfor- FP
False Alarm Rate = (2)
mance using 30 epochs, five layers (one input, three hidden, TN + FP
one output) Precision is computed as follows:
It is worth noting that we also implemented algorithms
such as a Simple 3-layer Neural Network and AdaBoostM1, TP
Precision = (3)
which did not achieve acceptable performance. Thus, such al- TP + FP
gorithms are not included in evaluation performance testing. Recall is calculated as follows:
TP
VI. FINDINGS Recall = (4)
TP + FN
We will now describe the findings from the evaluations
based on the setup described in Section V. Each algorithm Finally, the F1-measure is computed as follows:
is evaluated in terms of accuracy, false alarm rate, precision, Precision × Recall
recall, and F1-measure. An ideal IDS should achieve high F1-measure = 2 × (5)
Precision + Recall
VOLUME 4, 2016 11

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

The findings of the evaluation are depicted in Table 4 In the future, we intend to extend this work to include
and Figure 6. We can observe that in terms of LR-DDoS newer ML and deep learning techniques, with the aim of
attack detection, Random Forest achieves an accuracy rate improving the performance for example against other attacks.
of 94.41% and false alarm rate of 3.56%, SVM with 93.1% In order to provide a more robust evaluation of the frame-
accuracy and 1.6% false alarm rate, and MLP with 95.01% work, we plan to include more deep learning algorithms as
accuracy and 0.52% false alarm rate. they yield promising results on LR-DDoS attack detection.
In the evaluation, we also attempted the different attacks For example to improve the mitigation strategy, can we use
supported by the SlowHTTPTest tool (Slowloris, SlowHead- statistical filters such as Exponentially Weighted Moving
ers, R.U.D.Y., etc.), and the IPS successfully blocked attacks Average (EWMA) [59] and Kalman filters [60] to facilitate
previously identified by the IDS. Thus, the IPS effectively decision making in terms of flow rule installation. The goal
blocks attacks that previously have a 100% in the drop of such techniques is to avoid blocking legitimate users when
probability table as discussed in Section IV-B. the false positive rate increases. In terms of scalability, we
One can also observe that the IDS can effectively detect also plan to include a selective testing mechanism of flows
whether a flow is anomalous and support attack classification from the IPS to the IDS. Such an approach is likely to be
for generic (i.e., attacks outside the provided categories), interoperable with big network topologies and real-world
SlowBody, SlowRead, DDoSSim, SlowHeaders, GoldenEye, production networks in datacenters.
R.U.D.Y., H.U.L.K. and Slowloris.
In conventional DoS and DDoS attacks, ML algorithms ACKNOWLEDGMENT
generally seek for patterns to classify flows as malicious We thank José Abraham Torres, Abel Daniel Yañez,
or legitimate. Due to the nature of LR-DDoS attacks, DL Bernardo Laing and Leví Carbellido for their assistance in
algorithms such as MLP appear to perform better since their the testing and deployment of the architecture. We also thank
hidden layers allow for features (e.g., connection duration the reviewers for their invaluable feedback.
and memory footprint) to be used to inform classification.
REFERENCES
Moreover, our findings described in this section show that
[1] A. Kuzmanovic and E. W. Knightly, “Low-rate tcp-targeted denial of
the proposed framework is robust and flexible in LR-DDoS service attacks: The shrew vs. the mice and elephants,” in Proceedings
attack detection and mitigation. The IDS being the most of the 2003 Conference on Applications, Technologies, Architectures, and
processing-intensive module is located outside the SDN Con- Protocols for Computer Communications, SIGCOMM ’03, (New York,
NY, USA), p. 75–86, Association for Computing Machinery, 2003.
troller. In other words, the IDS is isolated from the controller, [2] A. Shevtekar, Karunakar Anantharam, and N. Ansari, “Low rate tcp
and therefore performing at rates close to an inline, hardware- denial-of-service attack detection at edge routers,” IEEE Communications
based IDS since such module can be executed as a virtualized Letters, vol. 9, no. 4, pp. 363–365, 2005.
[3] X. Luo and R. K. C. Chang, “On a new class of pulsing denial-of-service
component with NFV or as a hardware-based component. attacks and the defense,” in In Network and Distributed System Security
Symposium (NDSS), pp. 61–79, 2005.
[4] E. Adi, Z. Baig, C. P. Lam, and P. Hingston, “Low-rate denial-of-service
VII. CONCLUSION AND FUTURE WORK attacks against http/2 services,” in 2015 5th International Conference on
LR-DDoS attacks are likely to remain a threat to our systems, IT Convergence and Security (ICITCS), pp. 1–5, 2015.
[5] N. Agrawal and S. Tapaswi, “Defense mechanisms against ddos attacks in
particularly those that are centralized (e.g., cloud computing a cloud computing environment: State-of-the-art and research challenges,”
platforms). In this paper, we designed and implemented a IEEE Communications Surveys & Tutorials, vol. 21, no. 4, pp. 3769–3795,
modular and flexible security architecture to detect and miti- 2019.
[6] O. A. Osanaiye, K. R. Choo, and M. E. Dlodlo, “Distributed denial of
gate LR-DDoS attacks in SDN environments. The modularity
service (ddos) resilience in cloud: Review and conceptual cloud ddos
of the design allows one to easily replace any module without mitigation framework,” J. Netw. Comput. Appl., vol. 67, pp. 147–165,
affecting the other modules of the architecture. The IDS 2016.
module in our architecture is designed to detect flows using [7] Y. Xiang, K. Li, and W. Zhou, “Low-rate ddos attacks detection and
traceback by using new information metrics,” IEEE Transactions on In-
different previously trained ML models, which can be de- formation Forensics and Security, vol. 6, no. 2, pp. 426–437, 2011.
veloped using different programming languages and frame- [8] Z. Liu, X. Yin, and Y. Hu, “Cpss lr-ddos detection and defense in edge
works. Findings from the evaluations of the six different ML computing utilizing dcnn q-learning,” IEEE Access, vol. 8, pp. 42120–
42130, 2020.
algorithms using the CIC DoS dataset reported an accuracy [9] M. S. Bonfim, K. L. Dias, and S. F. Fernandes, “Integrated nfv/sdn
rate of 95%. We also deployed our architecture using a architectures: A systematic literature review,” ACM Computing Surveys
real virtualized environment using Mininet virtual machine (CSUR), vol. 51, no. 6, pp. 1–39, 2019.
[10] J. Cao, Q. Li, R. Xie, K. Sun, G. Gu, M. Xu, and Y. Yang, “The crosspath
over VirtualBox and the ONOS controller. We also used the attack: Disrupting the {SDN} control channel via shared links,” in 28th
(complex) ONOS controller since this controller is widely {USENIX} Security Symposium ({USENIX} Security 19), pp. 19–36,
used in production environments and specially in datacenters, 2019.
[11] D. Tang, R. Dai, L. Tang, and X. Li, “Low-rate dos attack detection based
in our evaluations so that the results can easily migrate to on two-step cluster analysis and utr analysis,” Human-centric Computing
a real-world production environment. In our deployment, and Information Sciences, vol. 10, no. 1, p. 6, 2020.
we used two different topologies and demonstrated that all [12] T. Apostolovic, N. Stankovic, K. Milenkovic, and Z. Stanisavljevic,
“Ddossim - system for visual representation of the selected distributed
attacks previously identified by the IDS were successfully denial of service attacks,” in 2018 Zooming Innovation in Consumer
mitigated. Technologies Conference (ZINC), pp. 118–122, 2018.

12 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

TABLE 4. Performance metrics by algorithm

Algorithm Accuracy False Alarm Rate Precision Recall F1-measure

J48 0.9068 0.0397 0.6522 0.528 0.5836
Random Tree 0.9176 0.03 0.7283 0.5565 0.6309
REP Tree 0.9037 0.0398 0.6417 0.5044 0.5648
Random Forest 0.9441 0.0359 0.7833 0.8186 0.8005
SVM 0.931 0.016 0.92 0.93 0.93
MLP 0.9501 0.0052 0.9546 0.9451 0.9498

0.96 4

0.95 3.5

0.94 3

0.93 2.5

0.92 2

0.91 1.5

0.9 1

0.89 0.5

0.88 0
J48 Random Tree REP Tree Random Forest SVM MLP J48 Random Tree REP Tree Random Forest SVM MLP

Accuracy Accuracy False Alarm Rate Precision

Recall F1-measure
(a) (b)

FIGURE 6. (a) Accuracy estimation results by algorithm. (b) Evaluation metric results.

[13] J. Seidl, “Goldeneye layer 7 (keepalive+nocache) dos test tool.” https:// for low-rate ddos attack detection: A comparative evaluation,” in 2014
github.com/jseidl/GoldenEye, 2013. Seventh International Conference on Contemporary Computing (IC3),
[14] Dominus, “Hulk ddos attack script created using python libs pp. 80–84, 2014.
https://deep3.org.” https://github.com/Mr4FX/Hulk-ddos-attack, 2018. [26] M. H. Bhuyan, A. Kalwar, A. Goswami, D. K. Bhattacharyya, and J. K.
[15] A. Kuzmanovic and E. W. Knightly, “Low-rate tcp-targeted denial of Kalita, “Low-rate and high-rate distributed dos attack detection using
service attacks and counter strategies,” IEEE/ACM Transactions on Net- partial rank correlation,” in 2015 Fifth International Conference on Com-
working, vol. 14, no. 4, pp. 683–696, 2006. munication Systems and Network Technologies, pp. 706–710, 2015.
[16] Z. Wu, W. Li, L. Liu, and M. Yue, “Low-rate dos attacks, detection, [27] N. Hoque, D. K. Bhattacharyya, and J. K. Kalita, “A novel measure for
defense, and challenges: A survey,” IEEE Access, vol. 8, pp. 43920– low-rate and high-rate ddos attack detection using multivariate data analy-
43943, 2020. sis,” in 2016 8th International Conference on Communication Systems and
[17] H. Li, J. Zhu, Q. Wang, T. Zhou, H. Qiu, and H. Li, “Laaem: A method Networks (COMSNETS), pp. 1–2, 2016.
to enhance ldos attack,” IEEE Communications Letters, vol. 20, no. 4, [28] C. Zhang, Z. Cai, W. Chen, X. Luo, and J. Yin, “Flow level detection and
pp. 708–711, 2016. filtering of low-rate ddos,” Comput. Netw., vol. 56, p. 3417–3431, Oct.
[18] Y. Zhang, Z. Morley Mao, and J. Wang, “Low-rate tcp-targeted dos attack 2012.
disrupts internet routing,” in 2007 14th Annual Network & Distributed [29] S. Floyd and V. Jacobson, “Random early detection gateways for conges-
System Security Symposium (NDSS), pp. 1–15, 2007. tion avoidance,” IEEE/ACM Transactions on Networking, vol. 1, no. 4,
[19] C. Zhang, Z. Cai, W. Chen, X. Luo, and J. Yin, “Flow level detection and pp. 397–413, 1993.
filtering of low-rate DDoS,” Computer Networks, vol. 56, pp. 3417–3431, [30] M. V. Kieu, D. T. Nguyen, and T. T. Nguyen, “Using cpr metric to
Oct. 2012. detect and filter low-rate ddos flows,” in Proceedings of the Eighth In-
[20] Y. Tarasov, E. Pakulova, and O. Basov, “Modeling of low-rate DDoS- ternational Symposium on Information and Communication Technology,
attacks,” in Proceedings of the 12th International Conference on Security SoICT 2017, (New York, NY, USA), p. 325–332, Association for Com-
of Information and Networks - SIN '19, ACM Press, 2019. puting Machinery, 2017.
[21] D. Kreutz, F. M. V. Ramos, P. E. Veríssimo, C. E. Rothenberg, S. Azodol- [31] M. H. Bhuyan and E. Elmroth, “Multi-scale low-rate ddos attack detection
molky, and S. Uhlig, “Software-defined networking: A comprehensive using the generalized total variation metric,” in 2018 17th IEEE Inter-
survey,” Proceedings of the IEEE, vol. 103, pp. 14–76, Jan 2015. national Conference on Machine Learning and Applications (ICMLA),
[22] H. Kim and N. Feamster, “Improving network management with software pp. 1040–1047, 2018.
defined networking,” IEEE Communications Magazine, vol. 51, pp. 114– [32] K. Hong, Y. Kim, H. Choi, and J. Park, “Sdn-assisted slow http ddos attack
119, February 2013. defense method,” IEEE Communications Letters, vol. 22, pp. 688–691,
[23] M. Baskar, T. Gnanasekaran, and S. Saravanan, “Adaptive ip traceback April 2018.
mechanism for detecting low rate ddos attacks,” in 2013 IEEE Interna- [33] Z. Wu, X. Qing, J. Wang, M. Yue, and L. Liu, “Low-rate ddos attack
tional Conference ON Emerging Trends in Computing, Communication detection based on factorization machine in software defined network,”
and Nanotechnology (ICECCN), pp. 373–377, 2013. IEEE Access, vol. 8, pp. 17404–17418, 2020.
[24] H. Kumawat and G. Meena, “Characterization, detection and mitigation [34] T. A. Pascoal, Y. G. Dantas, I. E. Fonseca, and V. Nigam, “Slow tcam
of low-rate dos attack,” in Proceedings of the 2014 International Con- exhaustion ddos attack,” in ICT Systems Security and Privacy Protection
ference on Information and Communication Technology for Competitive (S. De Capitani di Vimercati and F. Martinelli, eds.), (Cham), pp. 17–31,
Strategies, ICTCS ’14, (New York, NY, USA), Association for Computing Springer International Publishing, 2017.
Machinery, 2014. [35] Z. Li, H. Jin, D. Zou, and B. Yuan, “Exploring new opportunities to
[25] M. H. Bhuyan, D. K. Bhattacharyya, and J. K. Kalita, “Information metrics defeat low-rate ddos attack in container-based cloud environment,” IEEE

VOLUME 4, 2016 13

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

Transactions on Parallel and Distributed Systems, vol. 31, no. 3, pp. 695– [57] N. Hoque, D. K. Bhattacharyya, and J. K. Kalita, “Botnet in ddos attacks:
706, 2020. Trends and challenges,” IEEE Communications Surveys Tutorials, vol. 17,
[36] N. Zhang, F. Jaafar, and Y. Malik, “Low-rate dos attack detection using no. 4, pp. 2242–2270, 2015.
psd based entropy and machine learning,” in 2019 6th IEEE International [58] D. Arndt, “Flowtbag program to calculate flow statistics from a given cap-
Conference on Cyber Security and Cloud Computing (CSCloud)/ 2019 5th ture file..” https://github.com/DanielArndt/flowtbag/wiki/features, 2015.
IEEE International Conference on Edge Computing and Scalable Cloud [59] N. H. Oo and A. Htein Maw, “Effective detection and mitigation of
(EdgeCom), pp. 59–62, 2019. syn flooding attack in sdn,” in 2019 19th International Symposium on
[37] N. Meti, D. G. Narayan, and V. P. Baligar, “Detection of distributed denial Communications and Information Technologies (ISCIT), pp. 300–305,
of service attacks using machine learning algorithms in software defined 2019.
networks,” in 2017 International Conference on Advances in Computing, [60] R. E. Kalman, “A New Approach to Linear Filtering and Prediction
Communications and Informatics (ICACCI), pp. 1366–1371, 2017. Problems,” Journal of Basic Engineering, vol. 82, pp. 35–45, 03 1960.
[38] K. B. Virupakshar, M. Asundi, K. Channal, P. Shettar, S. Patil, and
D. Narayan, “Distributed denial of service (ddos) attacks detection system
for openstack-based private cloud,” Procedia Computer Science, vol. 167,
pp. 2297 – 2307, 2020. International Conference on Computational
Intelligence and Data Science.
[39] M. H. Bhuyan, D. K. Bhattacharyya, and J. K. Kalita, “Network anomaly
detection: Methods, systems and tools,” IEEE Communications Surveys
Tutorials, vol. 16, no. 1, pp. 303–336, 2014.
[40] F. Erlacher and F. Dressler, “Fixids: A high-speed signature-based flow
intrusion detection system,” in NOMS 2018 - 2018 IEEE/IFIP Network
Operations and Management Symposium, pp. 1–8, 2018.
[41] R. Kumar and D. Sharma, “Hyint: Signature-anomaly intrusion detection
system,” in 2018 9th International Conference on Computing, Communi-
cation and Networking Technologies (ICCCNT), pp. 1–7, 2018.
[42] A. Patel, M. Taghavi, K. Bakhtiyari, and J. Celestino Júnior, “An intrusion
detection and prevention system in cloud computing: A systematic review,”
Journal of Network and Computer Applications, vol. 36, no. 1, pp. 25 – 41,
2013. JESÚS ARTURO PÉREZ-DÍAZ obtained his
[43] K. Vieira, A. Schulter, C. Westphall, and C. Westphall, “Intrusion detection B.Sc. degree in computer science from the Au-
for grid and cloud computing,” IT Professional, vol. 12, no. 4, pp. 38–43, tonomous University of Aguascalientes in 1995,
2010. where he received the best student award. He
[44] S. L. Salzberg, “C4.5: Programs for machine learning by j. ross quinlan. received his PhD degree in New Advances in
morgan kaufmann publishers, inc., 1993,” Machine Learning, vol. 16, Computer Science Systems from the Universidad
pp. 235–240, Sept. 1994. de Oviedo in 2000. He became a full associate pro-
[45] L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, fessor at University of Oviedo from 2000 to 2002.
2001. He was recognized by the COIMBRA group as
[46] M. Wang, Y. Lu, and J. Qin, “A dynamic mlp-based ddos attack detection one of the best young Latin-American researchers
method using feature selection and feedback,” Computers & Security, in 2006 and received a research stay at Louvain le nouveau University in
vol. 88, p. 101645, 2020.
Belgium. He has been awarded by the CIGRE and by Intel for the devel-
[47] J. Ye, X. Cheng, J. Zhu, L. Feng, and L. Song, “A DDoS attack detection
opment of innovative systems. Currently he is a researcher and professor
method based on SVM in software defined network,” Security and Com-
munication Networks, vol. 2018, pp. 1–8, 2018. in the ITESM – Campus Querétaro, México and member of the Mexican
[48] A. Saied, R. E. Overill, and T. Radzik, “Detection of known and unknown Researchers National System, his research field focus in cyber security in
ddos attacks using artificial neural networks,” Neurocomputing, vol. 172, SDN and design of communications protocols where he has supervised
pp. 385 – 393, 2016. several master and PhD theses in the field.
[49] C. Hsieh and T. Chan, “Detection ddos attacks based on neural-network
using apache spark,” in 2016 International Conference on Applied System
Innovation (ICASI), pp. 1–4, 2016.
[50] T. Zhao, D. C. Lo, and K. Qian, “A neural-network based ddos detection
system using hadoop and hbase,” in 2015 IEEE 17th International Confer-
ence on High Performance Computing and Communications, 2015 IEEE
7th International Symposium on Cyberspace Safety and Security, and 2015
IEEE 12th International Conference on Embedded Software and Systems,
pp. 1326–1331, 2015.
[51] D. Peraković, M. Periša, I. Cvitić, and S. Husnjak, “Artificial neuron
network implementation in detection and classification of ddos traffic,” in
2016 24th Telecommunications Forum (TELFOR), pp. 1–4, 2016.
[52] R. M. A. Saad, M. Anbar, S. Manickam, and E. Alomari, “An intelligent
icmpv6 ddos flooding-attack detection framework (v6iids) using back-
propagation neural network,” IETE Technical Review, vol. 33, no. 3,
pp. 244–255, 2016.
[53] S.-Y. Ji, B.-K. Jeong, S. Choi, and D. H. Jeong, “A multi-level intrusion ISMAEL AMEZCUA VALDOVINOS obtained
detection method for abnormal network behaviors,” Journal of Network
his B.Sc. Degree in Computer Science from Uni-
and Computer Applications, vol. 62, pp. 9 – 17, 2016.
versidad de Colima in 2007 and earned his PhD
[54] G. S. Kushwah and S. T. Ali, “Detecting ddos attacks in cloud computing
using ann and black hole optimization,” in 2017 2nd International Confer-
from Tecnológico de Monterrey, Campus Cuer-
ence on Telecommunication and Networks (TEL-NET), pp. 1–5, 2017. navaca in 2013, where he worked on develop-
[55] D. E. Kim and M. Gofman, “Comparison of shallow and deep neural ing communication protocols for multi-homed de-
networks for network intrusion detection,” in 2018 IEEE 8th Annual Com- vices. Currently he is a professor at Facultad de
puting and Communication Workshop and Conference (CCWC), pp. 204– Telemática, Universidad de Colima, in México.
208, 2018. His research interests are Wireless Sensor Net-
[56] C. I. for Cybersecurity, “Cic dos dataset (2017).” https://www.unb.ca/cic/ works, Industrial Internet of Things (IIoT), and
datasets/dos-dataset.html. Accessed: June 2020. Software-Defined Networks (SDN).

14 VOLUME 4, 2016

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.
 This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI
10.1109/ACCESS.2020.3019330, IEEE Access

Pérez et al.: A Flexible SDN-based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks using Machine Learning

KIM-KWANG RAYMOND CHOO (Senior

Member, IEEE) received the Ph.D. in Information
Security in 2006 from Queensland University of
Technology, Australia. He currently holds the
Cloud Technology Endowed Professorship at The
University of Texas at San Antonio (UTSA). In
2015 he and his team won the Digital Forensics
Research Challenge organized by Germany’s Uni-
versity of Erlangen-Nuremberg. He is the recip-
ient of the 2019 IEEE Technical Committee on
Scalable Computing (TCSC) Award for Excellence in Scalable Computing
(Middle Career Researcher), 2018 UTSA College of Business Col. Jean
Piccione and Lt. Col. Philip Piccione Endowed Research Award for Tenured
Faculty, Outstanding Associate Editor of 2018 for IEEE Access, British
Computer Society’s 2019 Wilkes Award Runner-up, 2019 EURASIP JWCN
Best Paper Award, Korea Information Processing Society’s JIPS Survey
Paper Award (Gold) 2019, IEEE Blockchain 2019 Outstanding Paper Award,
Inscrypt 2019 Best Student Paper Award, IEEE TrustCom 2018 Best Paper
Award, ESORICS 2015 Best Research Paper Award, 2014 Highly Com-
mended Award by the Australia New Zealand Policing Advisory Agency,
Fulbright Scholarship in 2009, 2008 Australia Day Achievement Medallion,
and British Computer Society’s Wilkes Award in 2008.

DAKAI ZHU (Senior Member, IEEE) received

the Ph.D. degree in Computer Science from the
University of Pittsburgh, Pittsburgh, PA, USA, in
2004. He joined The University of Texas at San
Antonio in 2005 and is currently a Professor with
the Department of Computer Science. His cur-
rent research interests include real-time embedded
systems, low-power computing, fault-tolerant, and
cloud computing. Dr. Zhu was a recipient of the
U.S. National Science Foundation Faculty Early
Career Development Award in 2010.

VOLUME 4, 2016 15

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.