Source-linked AI summary
A Deep Learning Based DDoS Detection System in Software-Defined Networking (SDN)
Quamar Niyaz, Weiqing Sun, Ahmad Y Javaid
TL;DR
DDoS attacks threaten network-service availability, especially as attacks become more voluminous and multi-vector. The paper implements an SAE-based deep-learning detector as an SDN controller application, using packet-header-derived features and evaluating traffic from different environments. It reports 95.65% accuracy for individual attack classes and 99.82% accuracy for normal-versus-attack classification, with very low false-positive rates.
Problem
DDoS attacks increasingly threaten network-service availability through large, complex, and multi-vector traffic floods.
Method
The system uses stacked-autoencoder deep learning to reduce packet-header-derived features and classify traffic in an SDN controller application.
Results
95.65% accuracy was achieved for individual DDoS attack classes, while normal-versus-attack classification achieved 99.82% accuracy with very low false-positive rates.
Takeaways & Limitations
Identifying individual attack types and affected hosts can support blocking only the specific traffic causing an attack.
Takeaways & Limitations
Collecting every packet for feature extraction on the controller may limit controller performance in large networks.
Abstract
from arXiv · showhide
Distributed Denial of Service (DDoS) is one of the most prevalent attacks that an organizational network infrastructure comes across nowadays. We propose a deep learning based multi-vector DDoS detection system in a software-defined network (SDN) environment. SDN provides flexibility to program network devices for different objectives and eliminates the need for third-party vendor-specific hardware. We implement our system as a network application on top of an SDN controller. We use deep learning for feature reduction of a large set of features derived from network traffic headers. We evaluate our system based on different performance metrics by applying it on traffic traces collected from different scenarios. We observe high accuracy with a low false-positive for attack detection in our proposed system.
1 Introduction
The paper addresses increasingly prevalent and complex multi-vector DDoS attacks by combining SDN programmability with deep learning. It proposes and evaluates an SAE-based detection system for normal traffic and multiple DDoS attack types.
- 1 Introduction: DDoS attacks make network services unavailable by continuously flooding servers with undesirable traffic.The paper notes increases in attack volume, size, complexity, and multi-vector combinations.
- 1 Introduction: Multi-vector attacks combine distinct flooding techniques, including TCP SYN floods and DNS/NTP amplification.A cited study reported that 64% of attacks through mid-2016 were multi-vector.
- 1 Introduction: SDN offers centralized management, a global network view, and a programmable control plane for flexible network monitoring and security.These capabilities make network devices programmable for different applications.
- 1 Introduction: The proposed system uses stacked-autoencoder deep learning in an SDN environment to detect DDoS attacks.The system evaluates traffic containing normal Internet traffic and various DDoS attacks.
- 1 Introduction: The paper proceeds through related work, SDN and SAE background, system architecture, experimental evaluation, and conclusions with future work.The stated organization covers Sections 2 through 6.
2 Related Work
Prior work applies deep learning or lightweight statistical methods to intrusion and DDoS detection, but the paper targets multi-vector DDoS detection in SDN with SAE-based feature reduction.
- 2 Related Work: Related work spans deep-learning intrusion detection and DDoS detection specifically in SDN environments.The paper organizes its review around these two perspectives.
- 2 Related Work: Earlier deep-learning approaches used DBNs or discriminative RBMs for feature reduction or semi-supervised network anomaly detection.The cited systems were evaluated on NSL-KDD, KDD Cup-99, and real-world traffic traces.
- 2 Related Work: SDN DDoS systems used flow-table statistics, sFlow, or entropy thresholds to reduce overhead or detect attacks.The reviewed approaches included SOM, OpenFlow with sFlow, and entropy-based detection.
- 2 Related Work: The paper uses an SAE deep-learning model with many packet-header-derived features to detect multi-vector DDoS attacks in SDN.The system is applied to datasets collected in different environments and implemented on the SDN controller.
3 Background Overview
SDN separates network control from packet forwarding and lets centralized applications program switches. SAE learns compressed representations through stacked sparse autoencoders before classification.
- 3.1 Software-Defined Networking (SDN): SDN decouples control and data planes, making switches packet-forwarding elements managed by a centralized controller.Applications use controller APIs to program switches for functions such as firewalls and intrusion detection.
- 3.1 Software-Defined Networking (SDN): The controller communicates with switches through standard southbound APIs, including OpenFlow, while applications communicate with the controller.The controller may run on commodity hardware and may consist of logically centralized distributed servers.
- 3.1 Software-Defined Networking (SDN): OpenFlow messages support switch connection, network-status inquiry, and traffic-flow management through flow tables containing matches, counters, and actions.A flow is a group of packets sharing selected packet-header values.
- 3.1 Software-Defined Networking (SDN): In reactive SDN operation, a table miss sends packet headers to the controller, which can install flow rules for subsequent packets.Switches then perform actions such as forwarding, dropping, or modifying headers without forwarding every subsequent packet to the controller.
- 3.2 Stacked Autoencoder (SAE): SAE combines stacked sparse autoencoders for unsupervised feature learning with a soft-max classifier for classification.Each autoencoder learns an approximation of the identity function before layers are stacked and fine-tuned.
- 3.2 Stacked Autoencoder (SAE): A sparse autoencoder maps M input features through an N-node hidden layer and reconstructs the input using learned weights and biases.The paper uses a sigmoid activation function for the hidden and output nodes.
- 3.2 Stacked Autoencoder (SAE): The SAE cost function combines reconstruction error, weight decay, and a sparsity penalty based on Kullback-Leibler divergence.The sparsity constraint regulates average hidden-unit activation during learning.
- 3.2 Stacked Autoencoder (SAE): Multiple autoencoders are trained layer by layer, with each layer’s output feeding the next, and the full model is then fine-tuned with a classifier.Greedy-wise training obtains parameters for each layer before joint optimization.
4 Implementation of DDoS Detection System
The system combines controller-side traffic collection, flow installation, feature extraction, and traffic classification to detect data-plane and control-plane DDoS activity in SDN. It uses every packet for flow computation, extracts 68 header-derived features, and classifies traffic into normal or attack categories.
- System motivation: SDN attacks can target the data plane or overwhelm the control plane through flow-table misses that force repeated controller processing.Control-plane attackers send new flows after fingerprinting flow-installation rules, causing switches to miss flow entries.
- System architecture: The system has three modules: Traffic Collector and Flow installer, Feature Extractor, and Traffic Classifier.The modules operate together on the SDN controller, with feature extraction and classification triggered by timers.
- Traffic Collector and Flow Installer: The TCFI stores packet headers, identifies TCP, UDP, and ICMP flows, and installs rules while handling flow-table misses.It also tracks symmetric flows and can forward packets without installing duplicate rules when appropriate.
- Feature Extractor: The FE processes controller-collected headers at timed intervals and computes 68 features across TCP, UDP, and ICMP flows.It groups packets into flows, computes medians for selected byte and packet features, and computes entropy for specified features.
- Traffic Classifier: The TC uses an SAE-based model to classify traffic into eight classes: one normal class and seven DDoS attack classes.The attack classes represent TCP, UDP, or ICMP vectors launched separately or in combinations.
5 Experimental Set-up, Results, and Discussion
The system was evaluated on traffic collected from real and private-network environments using confusion-matrix metrics and ROC analysis. It achieved strong multi-class and binary DDoS detection while supporting host- and attack-specific mitigation, with controller processing identified as a scalability limitation.
- Experimental Set-up: Traffic was collected from a real network and a private SDN testbed for system evaluation.The testbed included a POX controller, Open vSwitch, and replayed normal and attack traces.
- Performance Metrics: Evaluation used accuracy, precision, recall, f-measure, ROC curves, and confusion matrices relating actual classes to predicted classes.In the confusion matrix, diagonal entries represent true positives, while off-diagonal row and column sums determine false positives and false negatives.
- 8-Class Results: The 8-class model achieved f-measure values above 90% for normal, TCP, UDP, and UDP-with-ICMP traffic.TCP-with-ICMP and TCP-with-UDP attacks had comparatively lower f-measure values because they were classified as other attack types.
- 2-Class Results: 99.82% detection accuracy was achieved for 2-class classification, with f-measure values of 99.85% for normal and 99.75% for attack traffic.All DDoS attacks were combined into one attack class for comparison with related work.
- Discussion: The system identifies individual attack types and affected hosts, allowing the controller to install switch flow rules for targeted blocking.This supports blocking the specific traffic type or host undergoing an attack rather than all traffic toward a victim.
- Discussion: Collecting every packet for feature extraction on the controller may limit performance in large networks.The authors suggest flow sampling, moving processing to another host, or distributed feature processing as alternatives.
6 Conclusion
The proposed SDN-based deep learning system detects multi-vector DDoS attacks with high accuracy at both individual attack-class and normal-versus-attack levels, while future work targets controller bottlenecks and broader feature extraction.
- 95.65% accuracy was achieved for identifying individual DDoS attack classes.
- 99.82% accuracy was achieved for classifying traffic as normal or attack, with very low false-positive compared to other works.
- Future work aims to reduce the controller’s bottleneck and extend detection to network attacks beyond DDoS.
- Future NIDS implementations plan to extract features from raw packet-header bytes instead of reducing derived features.