0% found this document useful (0 votes)
42 views6 pages

To Detect The Distributed Denial-of-Service Attacks in SDN Using Machine Learning Algorithms

This document discusses using machine learning algorithms to detect distributed denial-of-service (DDoS) attacks in software-defined networks (SDNs). SDNs separate the control plane from the data plane, making the network programmable but vulnerable to DDoS attacks. The paper proposes an intrusion detection system that uses machine learning like naive Bayes, K-nearest neighbors, k-means clustering, and linear regression to analyze traffic patterns in real-time and detect attackers. Detecting DDoS attacks early in SDNs is important to prevent compromising the network controller and bringing down the entire infrastructure.

Uploaded by

Usman Ahmed
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
42 views6 pages

To Detect The Distributed Denial-of-Service Attacks in SDN Using Machine Learning Algorithms

This document discusses using machine learning algorithms to detect distributed denial-of-service (DDoS) attacks in software-defined networks (SDNs). SDNs separate the control plane from the data plane, making the network programmable but vulnerable to DDoS attacks. The paper proposes an intrusion detection system that uses machine learning like naive Bayes, K-nearest neighbors, k-means clustering, and linear regression to analyze traffic patterns in real-time and detect attackers. Detecting DDoS attacks early in SDNs is important to prevent compromising the network controller and bringing down the entire infrastructure.

Uploaded by

Usman Ahmed
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 6

2021 International

2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)

To Detect the Distributed Denial-of-Service Attacks


in SDN using Machine Learning Algorithms
2021 International Conference on Computing, Communication, and Intelligent Systems (ICCCIS) | 978-1-7281-8529-3/20/$31.00 ©2021 IEEE | DOI: 10.1109/ICCCIS51004.2021.9397068

Shruti Banerjee Partha Sarathi Chakraborty


M. Tech. CSE, Dept. of CSE, Assistant Professor, Dept. of CSE,
SRM Institute of Science and Technology, NCR Campus, SRM Institute of Science and Technology, NCR Campus,
Ghaziabad, India Ghaziabad, India
[email protected] [email protected]

Abstract The reason for Software Defined Network (SDN) no match is found such as drop the packet. The controller is
to gain importance in both the academics and industry as a new the centralized entity and also the operating system of the
emerging way of network management, is its architecture which
decouples the data plane (forwarding devices) and the control has its drawbacks of being vulnerable to various cyber-attacks.
plane (controller) making it possible to upgrade and update into
The most vicious amongst them is the Distributed Denial-
d of-Service attack [3]. In this case, the attacker compromises
scenarios in terms of network virtualization, flexibility, enhanced multiple numbers of hosts and commonly the ones which carry
growth control, dynamic network policy, reduced operational heavy traffic, by sending flood traffic. It is unnecessary so as
cost. Despite, these advantages; it is also one of main reasons for to exhaust the network resources such as bandwidth and other
cyber threats. Amongst them the most vulnerable is the DDoS network resources that make the targeted server unresponsive
attacks. DDoS attack in SDN is quite a threat to the security in and unavailable to its legitimate users. If on successful
SDN network. It attacks at the network layer or application layer infiltration of the intruder in the controller of SDN, it could
of the infrastructure. It can cause problems as simple as inability compromise the entire network infrastructure making the SDN
to refresh a particular page to as severe as failure of an entire
server. In this paper, DDoS is taken into consideration with SDN and access patterns help determine the presence of an attack.
and proposed a IDS which studied for detection of the attackers
in the real time incoming traffic. Machine Learning algorithms For a successful attack on SDN, on the initial steps the
such as Naïve Bayes, KNN, K-Means clustering, and Linear attacker will compromise one of the hosts that are being
Regression are used to form the module 1 of the IDS (the frequently used or pass heavy traffic. To infiltrate the node,
Signature IDS) and Module 2 form for uses three way handshake intruder uses spoofed IP, so as to minimize the chances of
to identify the exact host which is an intruder. On finding the being detected. On successful infiltration of that particular
intruder it is being placed in the Access Control List (ACL). Also, node, the attacker then installs all the malicious software
analysis of efficiency of different machine learning algorithm is required to plant a strong attack on the controller of SDN.
performed to understand the effectiveness. Thus, naming the compromised node as ZOMBIE/BOT. The
node which controls all the bots is called BOTNET. It works
Keywords SDN; DDoS Attacks; Machine Learning
as the Master-Slave model. The attacker can perform the
I. INTRODUCTION attack like TCP syn attack, UDP flood attack, ICMP flood
attack. These types of attack target mainly the network layer
Software Defined Network (SDN) is the new trend in and the application layer. If the intruder is successful to fulfill
network evolution [1]. The decoupling of the forwarding the attack, it will compromise the entire SDN infrastructure
hardware from the control unit, simplifies the network including all the data, firewalls and other network resources.
management that enabling innovation and evolution to new This causes a severe catastrophic failure, to prevent which
trends. The network intelligence is centralized in a separate requires IDS in addition to its firewall.
component (the controller) that takes decisions for the entire
network. So, the benefits of SDN ranges from centralized In this paper, the proposed IDS detect the presence of
control, eliminating middle boxes - intruder in the incoming packets so as to prevent the attack
device does the from taking place. The IDS consists of two modules: first is
work of simple packet forwarding which is programmed using the Signature IDS uses Machine Learning algorithms to
an open interface (called data plane). On arrival of the new classify the incoming traffic according to the trained model.
packet to the SDN, the packet is sent to switch. If the Second module uses open connections and three-way
incoming packet matches with the entries in the flow table it is handshake to determine exactly which packet is the intruder in
processed as per the rules for that flow entry. In case, it does the incoming traffic. The structure of our paper as follows:
not match with any of the flow entries, the actions that switch section II reflects the discussion on preliminary things and
will take for that particular unmatched packet depends on the section III presents review of literature. Section IV presents
[2] -case our proposed methodology. Section V shows the results and

ISBN: XX-X-XX-XX-X/19/$31.00
ISBN: ©2021
978-1-7281-8529-3/21/$31.00 IEEE
©2021 IEEE 966
1

Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.
2021 International
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)

its analysis on findings. Finally, the section VI presents the its data firewall security mechanisms, datacenters and other
conclusion and future work. resources through the controller of SDN as it has centralized
control over the entire network infrastructure.
II. PRELIMINARY
C. Machine Learning Algorithms
A. Software Defined Network
ML gives the ability to study and learn analysing the data
The fundamental concept on which SDN is built is the provided so as to infer conclusions like: prediction, diagnosis,
decoupling of control plane from the data plane. The only remote control, recognition etc. ML algorithms that are used to
purpose of data plane is to forward packets and the control implement the Signature IDS (module 1) as follows:
plane is to possess centralized control over the entire entity.
The forwarding of packets is performed according to the Naïve Bayesian algorithm assumes that the presence of
control instructions given by the control units. The SDN a particular feature in a dataset is not dependent on the
network architecture if formed on four pillars [4] presence of any other feature in that same dataset.
Control planes and data planes are decoupled. The k-NN also known as Instance Based Learning is a
non-parametric ML algorithm that classifies all known
as well as new cases based on a similarity measure.
Control logic is separate entity also called NOS. K-means clustering algorithm divides the given
Network is programmable through API, running on top datasets into clusters, the upper limit and lower limit of
of the NOS. these clusters are customized.

SDN is defined by three fundamental abstractions: III. LITERATURE SURVEY


Forwarding: Allows forwarding functionalities by The disadvantage of SDN is due to its specific feature in
network applications, hiding the underlying details. its architecture which makes the network infrastructure
vulnerable to cyber-attacks like DDoS attack. This has quite
Distribution: Covers SDN applications from the adverse effects on the network, its data and resources due to
various distributed state, making the distributed control which research is focused on this particular threat over SDN.
problem a logically centralized. One of the way to mitigate this threat could be achieved by
analysing the behaviour and studying its features to
Specification: Allows a network application to express monitoring them as a way to identify DDoS threats. In [6]
the desired network behaviour without actually Dayal et. al. studies on this particular idea of analysing the
implementing it. behavioural features of DDoS attack to identify its presence
The two popular SDN architectures are: ForCES [5] and and monitor the network. To serve this purpose a simulation of
OpenFlow [2]. Though both are based on same SDN principle the attack is modelled. The tools used for the simulation are:
but are still different based on design, architecture, models and (1) Mininet (simulator), (2) Floodlight (controller), (3) sFlow-
protocol interface. rt (monitor network statistics), and (4) Hyenae 0.36
(performance attack). It then is analysed to get two concrete
B. Distributed Denial-of-Service Attack conclusions. Three parameters are always constant for DDoS
To define a DoS attack, it is a type of cyber-attack in attack measurement of randomness. They are entropy of
which the intruder on successful infiltration to the desired source IP address, destination IP address and type of protocol.
network, server or data center, etc that makes it completely In case of volumetric attacks, affects on data plane is adverse,
unavailable to its legitimate users. DDoS is a type of DoS but when control plane is attacked the overall affect is more
attack in which the victim is attacked from multiple sources. compared to volumetric attacks.
This makes it even more difficult to detect as well as stop as
In [7] Haq et. al. conducted a survey to study the
t help in
implementation of Machine Learning techniques in IDS within
preventing the attack from taking place.
the time period of 2009 to 2014 using single, hybrid and
The working of DDoS is explained as DDoS attack in ensemble classifiers. This paper is broadly divided into three
SDN is conducted by sending useless traffic to the vulnerable parts of studies that is Techniques used for developing the
nodes of the network, so as to completely exhaust the IDS, Overview of the articles over the given time line and the
bandwidth and other network resources which results in datasets, used for study. Finally, issues referencing the study
unavailability of the network and its resources for its for future research purposes. The machine learning techniques
legitimate users. Once it is successfully able to gain complete used are supervised learning (in which instances are labeled),
control over these vulnerable nodes of the network (also called unsupervised learning (in which instances are unlabeled), and
bots) the attacker then installs all the malicious software reinforced learning (in which interaction with the computer is
required to attack the controller of the SDN. These bots are studied). The analysis observed states that use of different
controlled by the botmaster and form a network called the classifiers to develop the IDS is an efficient and effective way
botnet. They use spoofed IP to attack from the incoming that serves the desired purpose to good measure.
traffic. If the intruder is successful in infiltrating the network
To mitigate the threat of DDoS attack in SDN controller,
without being detected by its security mechanism and
[8][9] studies the use of centralized controller in detecting this
firewalls; it could easily gain control over the entire network,

2
967

Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.
2021 International
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)

threat based on entropy variation in destination IP address, In paper [12][13], a comprehensive study of DoS attacks in
applicable for first 500 packets of incoming traffic. Main aim SDN along with an effective DDoS mitigation method
is to detect the threat at early stages i.e. the ability to tolerance namely, Multi-layer Fair queuing (MLFQ). There are two
of device and traffic properties should not get exhausted. Thus modes in which rules can be installed in the switches -
requires a fast and effective method which also should be proactive and reactive. DoS threats in SDN is carried out by
lightweighted. The measure of entropy fits this requirement. breaking down the reactive rule installed in multiple stages
Entropy is the measure of randomness in the incoming packet, showing how the bottleneck problem can be utilized for
helps in detecting attacks in early stages. Two essential placing DoS attack. The solution to this problem is
components are used- window size and threshold. With implementing MLFQ queue management system which solves
mininet as the network emulator, packet generation done by the limitations of SLFQ.
Scapy (tool) threshold chosen is based on the proposed
detection mechanisms. With one of the advantages of SDN i.e. In [14] Ambrosin et. al. studies a very thorough analysis of
flexibility, makes it easier to change the parameter according CPSA is performed and studied closely that shows on intimate
to the need of the controller. Thus, providing the detection knowledge about long forwarding paths (i.e. a path with
mechanism system within the controller that is compatible maximum number of hops) even with limited resources a
within its centralized nature and also require limited powerful CPSA attack can be mounted. The study of
processing power. eness of CPSA through extensive testing using
OpenFlow, the most widely adopted control data plane
In [10] Huang et. al. studies on the solutions to the communication protocol for SDN. Results show that on
problem of DDoS attack in SDN controller by the method of increasing the forwarding paths by 5 times, decrease 55% in
predicting the amount of the new requests using Taylor series, attack rate is required to incapacitate the network. The impact
i.e. requests are directed to security gateway when prediction is evaluated by measuring
value crosses a given threshold decreasing the entropy, will be
filtered out. Rules in the security gateway are installed Amount of PktIn when under attack.
according to the algorithms which will send request to the Ratio of Rt between number of PktIn received by the
control unit. From the incoming traffic packets which match controller and number of corresponding FlowAdd send
the rules are treated accordingly. In case of new, unmatched by the controller in response.
packets controller, sends new forwarding rules to the data
plane for each of these packets. On receiving unmatched CPU usage.
packets, security gateway applies filter algorithm to minimize As the control plane is the OS of the SDN, as a result of
the number of unmatched packets thus reducing the entropy. which security is mostly assigned and dedicated to the control
On implementing the defense mechanism, the observed plane but data plane [15] can also be vulnerable for SDN to
analysis stands as: change in entropy for source IP address is DoS attacks. The two metrics used to analyze are detection
due to different IP address used for DDoS attack (i.e. it rate and adaptability. By localizing the fixed header fields of
changes the source each time making new source for the the attacking flow, the presence of attack can be detected. The
attack). But with this defense scheme the attack is defended impact this procedure on the network is negligible.
effectively.
SDN provides better network management but also is
In [11] Alharbi et. al. studies about the content of ARP prone to number of threats i.e. security attacks such as Secure
spoofing in SDN. The proposed mechanism is SDN based Shell (SSH) Brute Force attack. Even on identification of the
ARP spoofing mitigation and can be adapted to NDP for both potential attack and the attacker, need for specific security
NS and NA. The basic drawback of ARP is a stateless rules to be implemented in controller of SDN is imminent. The
protocol and it does not have any mechanism to authenticate algorithms used are C4.5, Bayes Net, Naive Bayes, Decision
the sender of ARP request or reply or the ability to check the tree for predicting the attack host and comparing the
integrity and validity of the provided information. Thus, performance in terms of accuracy. Historical data [16][17]
making it a relatively easy target. Due to the stateless nature trains model, which then is used for predicting the potential
and lack of authentication SRP and NDP are vulnerable to attacks from the real time traffic data. This process works on
spoofing attacks enabling DoS and MITM attacks. The Two two basic underlying principles. Use of historical data to train
basic approaches to handle the ARP in SDN are Regular ARP the Machine Learning algorithms so as to obtain the accurate
and handle ARP using proxy ARP, which is well suited in the classifiers from incoming traffic based on how it was trained
SDN. by the historical data thus, identifying potential attackers from
The main idea of the prevention mechanism is to prevent real time traffic. Once the model is trained, it identifies
the potentially spoofed information in the SHA/SPA fields potential hosts that can be intruders. If the attacker actually
thus preventing the poisoning of ARP cache. This works for attacked and it was predicted correctly by the trained model
the case of Regular ARP. The main goal is to implement a which means the algorithm works accurate. The dataset being
controller component which secures the existing ARP [18] an open source project by Marist
mechanism. It is based on the concept of Network Address college. The best average prediction accuracy of 91.68 was
Translation (NAT). The study and experiments of the above achieved with Bayesian Network.
discussed problem states SARP NAT is a novel way of
mitigating against ARP spoofing attacks that occur in SDN.

3
968

Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.
2021 International
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)

IV. THE PROPOSED METHODOLOGY The method of implementation is summarized in the


The SDN architectural model (i.e. control unit and data following steps:
unit separation) resolves the limitations of traditional network Training the Machine Learning algorithms using
which forms the basis for advancement towards historical data / training data.
programmed networks SDN architecture also has its Trained Model to identify potential intrusive hosts and
limitations that make it vulnerable to major cyber threats like define the security rules for the SDN controller.
DDoS attack. The centralized control over the entire network For every packet-in request check that incoming
and its resources by the controller makes SDN vulnerable to packets with the flow table entries. If the incoming
DDoS as the attacker can compromise the path of packet matches with the flow table entries the set of
communication between these two units, or can change the instruction field decide what is to be done with that
firewall by fraud rule insertion or modification and on incoming packet.
successful infiltration when it gains control over controller of
SDN it would compromise the entire network along with all If the match is not found, the packet is send for further
its data and resources. processing in the controller, which matches the packet-
in with the entries in the access control list (ACL).
The IDS proposed has two modules: Module 1 is the
Signature IDS which uses Machine Learning algorithms like If matches then it is put in the blocked list and else it is
Naïve Bayes, KNN, K Means clustering to classify the allowed to access the server.
incoming packet into normal or anomalous thus predicting
beforehand all the possible intruders in the incoming traffic. The block diagram showing the working of the IDS in
These algorithms are analysed based on the detection rate and figure 2.
accuracy [17], and the one giving best possible outcome is
implemented in the Signature IDS. Though Naïve Bayes has
the probability of 93.3%, the existing system has the following
drawbacks:
It works best only for attributes that are independent of
each other in other cases it fails to determine.
It takes more time to get trained in case the data set is
big enough, thus increasing the training and processing
time. This results in controller taking more time to
start.
The algorithm also gives an anomaly of false positive
in case of true positive.
To resolve the above drawback we use different algorithm
that yields better results and overcomes all the limitations
mentioned above. The IDS is based on the basic principle
a) Use training dataset to train the machine learning
algorithm.
b) Use trained models to identify the potential intruders.
The block diagram is shown in figure 1 reflects the above
principle.

Fig. 1. Block Diagram for Machine Learning algorithms to define flow tables Fig. 2. Block Diagram for Implementation of IDS to detect DDoS attack.
on SDN controller.

4
969

Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.
2021 International
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)

V. RESULTS AND ANALYSIS D. The efficiencies of ML Algorithms


To evaluate the proposed algorithm for detection of DDoS Table I and Figure 5 provides the efficiency of three
attcks using ML algorithms, we implemented it in Java and different ML algorithm over seven different datasets, and it
use of MySQL database. We conduct our experiment on can be seen that highest average prediction efficiency is
desktop PC running Win 10 with 4GB memory and Intel Core attained with linear regression. Figure 6 showing the Average
i5 vPro processor. Machine learning algorithm Naïve Bayes, Performance Analysis of the ML algorithms in IDS.
KNN, and Linear Regression implemented in Java, and then
It is observed that the Naïve Bayes algorithm is 93.3%
three-way handshake results performed to detect intrusion in
effective in detecting the presence of intrusive packets
SDN.
amongst the incoming traffic. KNN has the detection rate
A. Dataset 96.65% and also resolves the drawback of Naïve Bayes i.e.
For training purpose, we used an open dataset available dependent instructions. The other two drawbacks are
from Kaggle. There are seven different datasets used. The successfully resolved by K-Means Clustering and Linear
dataset used is of the following format as shown in figure 3. Regression. K-Means solves the problem of studying large
dataset which consumes time and thus, delays the controller to
start quick.
Linear regression works on an entirely different theory, till
now we studied that the efficiency and accuracy is calculated
by studying the probability of intrusive data packets over the
entire dataset and the probability of legitimate data packets
Fig. 3. Dataset used for the Machine Learning Algorithms to obtain the
Trained Model.
Linear Regression is based compares the amount of heavy
B. Simplified view of working in SDN environment traffic over normal traffic thus resolving the anomaly and
giving a better efficiency than Naïve Bayes. Linear Regression
Figure 4 shows a simple working model of the SDN
has the efficiency of 1.865 (a positive value) which tells the
environment.
amount of normal traffic is 1.865 times that of intrusive
traffic. When the network functions normally, Linear
Regression always gives a positive value, but when the
network is under attack Linear Regression will give a negative
value.

TABLE I. ANALYSIS OF THE EFFICIENCY OF MACHINE LEARNING


ALGORITHMS APPLIED OVER DIFFERENT DATASETS
Efficiency of Efficiency Efficiency of
No. of
Datasets Naïve Bayes of KNN Linear Regression
Entries
Algorithm Algorithm Algorithm
1 1028 0.933000 0.965919 1.865999
2 1000 0.944844 2.142662 1.889680
3 2500 0.904586 2.972541 1.809172
4 3847 0.913676 1.874566 1.827351
5 3860 0.947913 1.912589 1.895828
6 20430 0.927057 5.104020 1.854051
7 24245 0.923677 4.732181 1.847350
Fig. 4. Simplified view for working of SDN environment.

C. Algorithms to obtain the Signature IDS (Module 1)


Module 1. Algorithm to obtain the Signature IDS
STEP 1. Loading the dataset.
STEP 2. Preprocessing and removal of the duplicates
in the loaded dataset.
STEP 3. Trained model obtained using Naïve Bayes
algorithm.
STEP 4. Trained model obtained using KNN.
STEP 5. K-Means clusters the incoming traffic.
STEP 6. Linear Regression is used to classify the
incoming traffic.
Module 2. Uses three way handshakes to identify the Fig. 5. Graphical Representation of the Efficiency of Machine Learning
potential intruders in the real time incoming traffic. Algorithms applied over different Datasets

5
970

Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.
2021 International
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)
[4] S.
-Defined Networking : A

14 76, 2015.
[5] rwarding and

Engineering Task Force (IETF) Request for Comments: 5810, pp. 1


124, 2010.
[6]
identify DDoS detection fea
Conference on Communication Systems and Networks, COMSNETS
2017, Bangalore, India, 2017, pp. 274 281.
[7] N. F. Haq, A. R. Onik, M. A. K. Hridoy, M. Rafni, F. M. Shah, and D.
pproaches in Intrusion

Fig. 6. Graph showing the Average Performance Analysis of the ML Research in Artificial Intelligence, vol. 4, no. 3, pp. 9 18, 2015.
algorithms in IDS [8]
Networks Controller Early Detection 0f DDoS Attacks in Software
VI. CONCLUSION AND FUTURE WORK Ottawa, Canada, 2014.
The main purpose for the existence of SDN is to overcome [9] S. M. Mousavi and M. St-
the limitations of traditional networks. The way it has evolved,
changed the future of programmable networks giving it the on Computing, Networking and Communications, ICNC 2015, Garden
Grove, CA, USA, 2015, pp. 77 81.
[10]
advantages, there are drawbacks too; i.e. the separation of the
two entities control plane and data plane makes the network France, 2017, pp. 1 6.
infrastructure vulnerable to cyber-attacks like DDoS. DDoS [11]
poses the biggest threat to SDN environment. It targets either - Conference on Local
network or application layer to place the attack. If the attacker Computer Networks, LCN, Dubai, United Arab Emirates, 2016, pp.
is successful, it would compromise the entire SDN network 523 526.
data and its resources. [12] of Service Attacks in
33,
To address this problem, an IDS is proposed in this paper 2016.
which uses Machine Learning algorithms (Signature IDS [13]
module 1) to detect the presence of intrusive traffic from the distributed denial of service attacks in software defined network using
machine learning algor
real time incoming network traffic. The second module Technology, vol. 7, no. 2.8, pp. 472 476, 2018, ISSN 2227-524X.
performs 3 way handshakes to identify the particular
[14]
anomalous IP which is then placed in ACL and all connections
to that particular host are terminated. Thus, securing SDN Conference on New Technologies, Mobility and Security (NTMS),
network from an attack. As the future work, we plan to use Larnaca, Cyprus, 2016, pp. 3 6.
other machine learning algorithms (including unsupervised [15]
algorithms or reinforced algorithms) that best fit, like the and mitigating denial of service attacks against the data plane in
hidden Markov model which would serve the purpose IEEE Conference on Network
Softwarization (NetSoft), Bologna, Italy, 2017, pp. 1 6.
efficiently.
[16] L. Barki, A. Shidling, N. Meti, D. G. Narayan, and M. M. Mulla,
REFERENCES 016 International Conference on Advances in
[1] Computing, Communications and Informatics (ICACCI), Jaipur, India,
Open Networking Summit 2011 - Premier Event for OpenFlow and 2016, pp. 2576 2581.
Software Defined Networking, Stanford, USA, oct 2011. [Online]. [17]
Available: https://www.youtube.com/watch?v=YHeyuD89n1Y network attack patterns in SDN using machine learning
[2] B. A. A. Nunes, M. Mendonca, X.-n. Nguyen, K. Obraczka, and 2016 IEEE Conference on Network Function Virtualization and
-Defined Networking : Past , Present, Software Defined Networks, NFV-SDN 2016, Palo Alto, CA, USA,
2017, pp. 167 172.
Surveys & Tutorials, vol. 16, no. 3, pp. 1617 1634, 2014. [18]
[3] under GPL V2, 2015.
[19] K. Benton, L. J.
International Conference on Intelligent Systems and Control, ISCO
2016, Coimbatore, India, 2016, pp. 1 6.
New York, NY, USA: ACM, 2013, pp. 151 152.

6
971

Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.

You might also like