To Detect The Distributed Denial-of-Service Attacks in SDN Using Machine Learning Algorithms
To Detect The Distributed Denial-of-Service Attacks in SDN Using Machine Learning Algorithms
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)
Abstract The reason for Software Defined Network (SDN) no match is found such as drop the packet. The controller is
to gain importance in both the academics and industry as a new the centralized entity and also the operating system of the
emerging way of network management, is its architecture which
decouples the data plane (forwarding devices) and the control has its drawbacks of being vulnerable to various cyber-attacks.
plane (controller) making it possible to upgrade and update into
The most vicious amongst them is the Distributed Denial-
d of-Service attack [3]. In this case, the attacker compromises
scenarios in terms of network virtualization, flexibility, enhanced multiple numbers of hosts and commonly the ones which carry
growth control, dynamic network policy, reduced operational heavy traffic, by sending flood traffic. It is unnecessary so as
cost. Despite, these advantages; it is also one of main reasons for to exhaust the network resources such as bandwidth and other
cyber threats. Amongst them the most vulnerable is the DDoS network resources that make the targeted server unresponsive
attacks. DDoS attack in SDN is quite a threat to the security in and unavailable to its legitimate users. If on successful
SDN network. It attacks at the network layer or application layer infiltration of the intruder in the controller of SDN, it could
of the infrastructure. It can cause problems as simple as inability compromise the entire network infrastructure making the SDN
to refresh a particular page to as severe as failure of an entire
server. In this paper, DDoS is taken into consideration with SDN and access patterns help determine the presence of an attack.
and proposed a IDS which studied for detection of the attackers
in the real time incoming traffic. Machine Learning algorithms For a successful attack on SDN, on the initial steps the
such as Naïve Bayes, KNN, K-Means clustering, and Linear attacker will compromise one of the hosts that are being
Regression are used to form the module 1 of the IDS (the frequently used or pass heavy traffic. To infiltrate the node,
Signature IDS) and Module 2 form for uses three way handshake intruder uses spoofed IP, so as to minimize the chances of
to identify the exact host which is an intruder. On finding the being detected. On successful infiltration of that particular
intruder it is being placed in the Access Control List (ACL). Also, node, the attacker then installs all the malicious software
analysis of efficiency of different machine learning algorithm is required to plant a strong attack on the controller of SDN.
performed to understand the effectiveness. Thus, naming the compromised node as ZOMBIE/BOT. The
node which controls all the bots is called BOTNET. It works
Keywords SDN; DDoS Attacks; Machine Learning
as the Master-Slave model. The attacker can perform the
I. INTRODUCTION attack like TCP syn attack, UDP flood attack, ICMP flood
attack. These types of attack target mainly the network layer
Software Defined Network (SDN) is the new trend in and the application layer. If the intruder is successful to fulfill
network evolution [1]. The decoupling of the forwarding the attack, it will compromise the entire SDN infrastructure
hardware from the control unit, simplifies the network including all the data, firewalls and other network resources.
management that enabling innovation and evolution to new This causes a severe catastrophic failure, to prevent which
trends. The network intelligence is centralized in a separate requires IDS in addition to its firewall.
component (the controller) that takes decisions for the entire
network. So, the benefits of SDN ranges from centralized In this paper, the proposed IDS detect the presence of
control, eliminating middle boxes - intruder in the incoming packets so as to prevent the attack
device does the from taking place. The IDS consists of two modules: first is
work of simple packet forwarding which is programmed using the Signature IDS uses Machine Learning algorithms to
an open interface (called data plane). On arrival of the new classify the incoming traffic according to the trained model.
packet to the SDN, the packet is sent to switch. If the Second module uses open connections and three-way
incoming packet matches with the entries in the flow table it is handshake to determine exactly which packet is the intruder in
processed as per the rules for that flow entry. In case, it does the incoming traffic. The structure of our paper as follows:
not match with any of the flow entries, the actions that switch section II reflects the discussion on preliminary things and
will take for that particular unmatched packet depends on the section III presents review of literature. Section IV presents
[2] -case our proposed methodology. Section V shows the results and
ISBN: XX-X-XX-XX-X/19/$31.00
ISBN: ©2021
978-1-7281-8529-3/21/$31.00 IEEE
©2021 IEEE 966
1
Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.
2021 International
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)
its analysis on findings. Finally, the section VI presents the its data firewall security mechanisms, datacenters and other
conclusion and future work. resources through the controller of SDN as it has centralized
control over the entire network infrastructure.
II. PRELIMINARY
C. Machine Learning Algorithms
A. Software Defined Network
ML gives the ability to study and learn analysing the data
The fundamental concept on which SDN is built is the provided so as to infer conclusions like: prediction, diagnosis,
decoupling of control plane from the data plane. The only remote control, recognition etc. ML algorithms that are used to
purpose of data plane is to forward packets and the control implement the Signature IDS (module 1) as follows:
plane is to possess centralized control over the entire entity.
The forwarding of packets is performed according to the Naïve Bayesian algorithm assumes that the presence of
control instructions given by the control units. The SDN a particular feature in a dataset is not dependent on the
network architecture if formed on four pillars [4] presence of any other feature in that same dataset.
Control planes and data planes are decoupled. The k-NN also known as Instance Based Learning is a
non-parametric ML algorithm that classifies all known
as well as new cases based on a similarity measure.
Control logic is separate entity also called NOS. K-means clustering algorithm divides the given
Network is programmable through API, running on top datasets into clusters, the upper limit and lower limit of
of the NOS. these clusters are customized.
2
967
Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.
2021 International
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)
threat based on entropy variation in destination IP address, In paper [12][13], a comprehensive study of DoS attacks in
applicable for first 500 packets of incoming traffic. Main aim SDN along with an effective DDoS mitigation method
is to detect the threat at early stages i.e. the ability to tolerance namely, Multi-layer Fair queuing (MLFQ). There are two
of device and traffic properties should not get exhausted. Thus modes in which rules can be installed in the switches -
requires a fast and effective method which also should be proactive and reactive. DoS threats in SDN is carried out by
lightweighted. The measure of entropy fits this requirement. breaking down the reactive rule installed in multiple stages
Entropy is the measure of randomness in the incoming packet, showing how the bottleneck problem can be utilized for
helps in detecting attacks in early stages. Two essential placing DoS attack. The solution to this problem is
components are used- window size and threshold. With implementing MLFQ queue management system which solves
mininet as the network emulator, packet generation done by the limitations of SLFQ.
Scapy (tool) threshold chosen is based on the proposed
detection mechanisms. With one of the advantages of SDN i.e. In [14] Ambrosin et. al. studies a very thorough analysis of
flexibility, makes it easier to change the parameter according CPSA is performed and studied closely that shows on intimate
to the need of the controller. Thus, providing the detection knowledge about long forwarding paths (i.e. a path with
mechanism system within the controller that is compatible maximum number of hops) even with limited resources a
within its centralized nature and also require limited powerful CPSA attack can be mounted. The study of
processing power. eness of CPSA through extensive testing using
OpenFlow, the most widely adopted control data plane
In [10] Huang et. al. studies on the solutions to the communication protocol for SDN. Results show that on
problem of DDoS attack in SDN controller by the method of increasing the forwarding paths by 5 times, decrease 55% in
predicting the amount of the new requests using Taylor series, attack rate is required to incapacitate the network. The impact
i.e. requests are directed to security gateway when prediction is evaluated by measuring
value crosses a given threshold decreasing the entropy, will be
filtered out. Rules in the security gateway are installed Amount of PktIn when under attack.
according to the algorithms which will send request to the Ratio of Rt between number of PktIn received by the
control unit. From the incoming traffic packets which match controller and number of corresponding FlowAdd send
the rules are treated accordingly. In case of new, unmatched by the controller in response.
packets controller, sends new forwarding rules to the data
plane for each of these packets. On receiving unmatched CPU usage.
packets, security gateway applies filter algorithm to minimize As the control plane is the OS of the SDN, as a result of
the number of unmatched packets thus reducing the entropy. which security is mostly assigned and dedicated to the control
On implementing the defense mechanism, the observed plane but data plane [15] can also be vulnerable for SDN to
analysis stands as: change in entropy for source IP address is DoS attacks. The two metrics used to analyze are detection
due to different IP address used for DDoS attack (i.e. it rate and adaptability. By localizing the fixed header fields of
changes the source each time making new source for the the attacking flow, the presence of attack can be detected. The
attack). But with this defense scheme the attack is defended impact this procedure on the network is negligible.
effectively.
SDN provides better network management but also is
In [11] Alharbi et. al. studies about the content of ARP prone to number of threats i.e. security attacks such as Secure
spoofing in SDN. The proposed mechanism is SDN based Shell (SSH) Brute Force attack. Even on identification of the
ARP spoofing mitigation and can be adapted to NDP for both potential attack and the attacker, need for specific security
NS and NA. The basic drawback of ARP is a stateless rules to be implemented in controller of SDN is imminent. The
protocol and it does not have any mechanism to authenticate algorithms used are C4.5, Bayes Net, Naive Bayes, Decision
the sender of ARP request or reply or the ability to check the tree for predicting the attack host and comparing the
integrity and validity of the provided information. Thus, performance in terms of accuracy. Historical data [16][17]
making it a relatively easy target. Due to the stateless nature trains model, which then is used for predicting the potential
and lack of authentication SRP and NDP are vulnerable to attacks from the real time traffic data. This process works on
spoofing attacks enabling DoS and MITM attacks. The Two two basic underlying principles. Use of historical data to train
basic approaches to handle the ARP in SDN are Regular ARP the Machine Learning algorithms so as to obtain the accurate
and handle ARP using proxy ARP, which is well suited in the classifiers from incoming traffic based on how it was trained
SDN. by the historical data thus, identifying potential attackers from
The main idea of the prevention mechanism is to prevent real time traffic. Once the model is trained, it identifies
the potentially spoofed information in the SHA/SPA fields potential hosts that can be intruders. If the attacker actually
thus preventing the poisoning of ARP cache. This works for attacked and it was predicted correctly by the trained model
the case of Regular ARP. The main goal is to implement a which means the algorithm works accurate. The dataset being
controller component which secures the existing ARP [18] an open source project by Marist
mechanism. It is based on the concept of Network Address college. The best average prediction accuracy of 91.68 was
Translation (NAT). The study and experiments of the above achieved with Bayesian Network.
discussed problem states SARP NAT is a novel way of
mitigating against ARP spoofing attacks that occur in SDN.
3
968
Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.
2021 International
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)
Fig. 1. Block Diagram for Machine Learning algorithms to define flow tables Fig. 2. Block Diagram for Implementation of IDS to detect DDoS attack.
on SDN controller.
4
969
Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.
2021 International
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)
5
970
Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.
2021 International
2021 Conference
International onon
Conference Computing, Communication,
Computing, andand
Communication, Intelligent Systems
Intelligent (ICCCIS)
Systems (ICCCIS)
[4] S.
-Defined Networking : A
14 76, 2015.
[5] rwarding and
Fig. 6. Graph showing the Average Performance Analysis of the ML Research in Artificial Intelligence, vol. 4, no. 3, pp. 9 18, 2015.
algorithms in IDS [8]
Networks Controller Early Detection 0f DDoS Attacks in Software
VI. CONCLUSION AND FUTURE WORK Ottawa, Canada, 2014.
The main purpose for the existence of SDN is to overcome [9] S. M. Mousavi and M. St-
the limitations of traditional networks. The way it has evolved,
changed the future of programmable networks giving it the on Computing, Networking and Communications, ICNC 2015, Garden
Grove, CA, USA, 2015, pp. 77 81.
[10]
advantages, there are drawbacks too; i.e. the separation of the
two entities control plane and data plane makes the network France, 2017, pp. 1 6.
infrastructure vulnerable to cyber-attacks like DDoS. DDoS [11]
poses the biggest threat to SDN environment. It targets either - Conference on Local
network or application layer to place the attack. If the attacker Computer Networks, LCN, Dubai, United Arab Emirates, 2016, pp.
is successful, it would compromise the entire SDN network 523 526.
data and its resources. [12] of Service Attacks in
33,
To address this problem, an IDS is proposed in this paper 2016.
which uses Machine Learning algorithms (Signature IDS [13]
module 1) to detect the presence of intrusive traffic from the distributed denial of service attacks in software defined network using
machine learning algor
real time incoming network traffic. The second module Technology, vol. 7, no. 2.8, pp. 472 476, 2018, ISSN 2227-524X.
performs 3 way handshakes to identify the particular
[14]
anomalous IP which is then placed in ACL and all connections
to that particular host are terminated. Thus, securing SDN Conference on New Technologies, Mobility and Security (NTMS),
network from an attack. As the future work, we plan to use Larnaca, Cyprus, 2016, pp. 3 6.
other machine learning algorithms (including unsupervised [15]
algorithms or reinforced algorithms) that best fit, like the and mitigating denial of service attacks against the data plane in
hidden Markov model which would serve the purpose IEEE Conference on Network
Softwarization (NetSoft), Bologna, Italy, 2017, pp. 1 6.
efficiently.
[16] L. Barki, A. Shidling, N. Meti, D. G. Narayan, and M. M. Mulla,
REFERENCES 016 International Conference on Advances in
[1] Computing, Communications and Informatics (ICACCI), Jaipur, India,
Open Networking Summit 2011 - Premier Event for OpenFlow and 2016, pp. 2576 2581.
Software Defined Networking, Stanford, USA, oct 2011. [Online]. [17]
Available: https://www.youtube.com/watch?v=YHeyuD89n1Y network attack patterns in SDN using machine learning
[2] B. A. A. Nunes, M. Mendonca, X.-n. Nguyen, K. Obraczka, and 2016 IEEE Conference on Network Function Virtualization and
-Defined Networking : Past , Present, Software Defined Networks, NFV-SDN 2016, Palo Alto, CA, USA,
2017, pp. 167 172.
Surveys & Tutorials, vol. 16, no. 3, pp. 1617 1634, 2014. [18]
[3] under GPL V2, 2015.
[19] K. Benton, L. J.
International Conference on Intelligent Systems and Control, ISCO
2016, Coimbatore, India, 2016, pp. 1 6.
New York, NY, USA: ACM, 2013, pp. 151 152.
6
971
Authorized licensed use limited to: San Francisco State Univ. Downloaded on June 19,2021 at 11:05:39 UTC from IEEE Xplore. Restrictions apply.