Source-linked AI summary
DDoSNet: A Deep-Learning Model for Detecting Network Attacks
Mahmoud Said Elsayed, Nhien-An Le-Khac, Soumyabrata Dev, Anca Delia Jurcut
TL;DR
DDoS detection in SDN is challenged by resource-exhausting attacks, limitations of classical ML, and outdated, insufficiently diverse datasets. The paper proposes DDoSNet, an RNN-autoencoder system evaluated on CICDDoS2019, and reports the highest evaluation metrics against classical ML techniques. Its conclusion is that deep learning can support SDN DDoS detection, although the supplied passages do not state a specific limitation of the proposed method.
Problem
Existing SDN DDoS detectors rely on classical ML and datasets that may have limited feature-learning capacity, outdated attack traffic, and insufficient attack diversity.
Method
DDoSNet combines an RNN with an autoencoder to learn compressed traffic representations and classify SDN traffic using supervised fine-tuning.
Results
DDoSNet achieves the highest recall, precision, F-score, and accuracy compared with established classical ML techniques on CICDDoS2019.
Takeaways & Limitations
The results support the potential of deep learning and automatic feature extraction for SDN DDoS anomaly detection.
Abstract
from arXiv · showhide
Software-Defined Networking (SDN) is an emerging paradigm, which evolved in recent years to address the weaknesses in traditional networks. The significant feature of the SDN, which is achieved by disassociating the control plane from the data plane, facilitates network management and allows the network to be efficiently programmable. However, the new architecture can be susceptible to several attacks that lead to resource exhaustion and prevent the SDN controller from supporting legitimate users. One of these attacks, which nowadays is growing significantly, is the Distributed Denial of Service (DDoS) attack. DDoS attack has a high impact on crashing the network resources, making the target servers unable to support the valid users. The current methods deploy Machine Learning (ML) for intrusion detection against DDoS attacks in the SDN network using the standard datasets. However, these methods suffer several drawbacks, and the used datasets do not contain the most recent attack patterns - hence, lacking in attack diversity. In this paper, we propose DDoSNet, an intrusion detection system against DDoS attacks in SDN environments. Our method is based on Deep Learning (DL) technique, combining the Recurrent Neural Network (RNN) with autoencoder. We evaluate our model using the newly released dataset CICDDoS2019, which contains a comprehensive variety of DDoS attacks and addresses the gaps of the existing current datasets. We obtain a significant improvement in attack detection, as compared to other benchmarking methods. Hence, our model provides great confidence in securing these networks.
I. INTRODUCTION
SDN improves network management and programmability but introduces vulnerabilities, while DDoS attacks can exhaust resources and disrupt legitimate access. DDoSNet addresses limitations in existing ML approaches and datasets using an RNN-autoencoder evaluated on CICDDoS2019.
- Motivation: SDN separates the control and data planes to centralize network management, but attacks can affect the entire multi-vendor system.Traditional attacks may affect only part of a single-vendor network, whereas SDN attacks can impact the whole system.
- Motivation: DDoS attacks rapidly consume network resources and can overwhelm SDN controller channels, causing simultaneous failure across the network.The controller's single point of failure makes the architecture especially exposed when it is overwhelmed.
- Research gap: Existing ML-based detectors struggle with growing traffic volumes, unknown malicious activity, and high false-alarm rates.Classical ML has limited feature-learning ability and is better at recognizing known attacks than discovering outliers.
- Proposed contribution: DDoSNet combines deep learning, an RNN-autoencoder, and softmax regression to classify SDN traffic as malicious or normal.The RNN-autoencoder is used for detection, with softmax regression at the output layer.
- Evaluation: CICDDoS2019 provides a comprehensive variety of DDoS attacks intended to address gaps in existing datasets.The paper evaluates DDoSNet on this newly released dataset.
- Evaluation: DDoSNet achieves the best reported performance against benchmark ML techniques across precision, recall, F1-score, and accuracy.The evaluation compares the proposed method with state-of-the-art ML models using these four metrics.
II. RELATED WORK
Prior SDN DDoS detectors use simulated traffic, classical ML, or older datasets, often covering few attack types. These limitations reduce coverage of application-layer attacks and the validity of evaluations.
- Existing approaches: Prior studies applied methods including SVM, signature-based Snort, and DNN to detect DDoS attacks in SDN networks.Reported datasets and scenarios included Mininet simulations, flood traffic, and KDDCUP99 features.
- Dataset limitations: Many simulated SDN datasets cover only a small number of malicious activities, commonly limited to IP or TCP protocols.Application-layer DDoS attacks are often omitted.
- Dataset limitations: Application-layer DDoS attacks are difficult to detect because their traffic resembles benign behavior and offers few defining features.Consequently, many detection systems are unsuitable for identifying them.
- Dataset limitations: Traffic generated with tools such as Scapy and Hping3 is small and may not represent complete traffic for accurate evaluation.The paper identifies this as a limitation of simulated datasets.
- Dataset limitations: Public datasets are often outdated and contain too few attack types to represent current Internet attack trends comprehensively.The paper therefore emphasizes the importance of comprehensive, valid datasets for evaluating detection techniques.
III. PROPOSED MODEL
DDoSNet combines an autoencoder with an RNN to learn compressed sequential traffic representations for SDN attack detection. It uses unsupervised pre-training followed by supervised fine-tuning and softmax classification.
- Architecture: DDoSNet is an architecture based on an autoencoder and recurrent neural network for SDN intrusion detection.The model is designed specifically to detect attacks in SDN networks.
- Architecture: The autoencoder compresses input features through encoder layers and reconstructs them through decoder layers.The reconstructed output is approximately equal to the original input, while encoded features have lower dimensionality.
- Architecture: RNN cyclic connections model input sequences, complementing the autoencoder in the DDoS detection model.The paper contrasts this sequence modeling ability with feed-forward neural networks.
- Training pipeline: The model first performs unsupervised RNN-autoencoder pre-training to learn compressed features from unlabeled data.Each autoencoder layer is implemented as an RNN layer.
- Training pipeline: Supervised fine-tuning then trains the final softmax layer on labeled samples to classify traffic as normal or attack.The softmax output has two channels, with class probabilities summing to one.
- Architecture: Figure 1 presents the proposed architecture for detecting attacks in an SDN network.The surrounding description identifies the architecture as a two-stage pre-training and fine-tuning model.
A. Dataset
The paper uses CICDDoS2019 to address dataset limitations in DDoS intrusion detection, preparing its flow features for direct model training. The dataset includes diverse attack types and exhibits a highly nonlinear feature space.
- Dataset scope: CICDDoS2019 addresses dataset gaps by providing a large variety of DDoS attacks, including application-layer attacks over TCP and UDP.Its attacks are categorized as exploitation-based or reflection-based.
- Dataset scope: The dataset separates training and testing captures across January 12th and March 11th, 2019, respectively.The training set contains 12 attack types, while the testing set contains 7.
- Dataset scope: The testing set includes PortScan, which is absent from training for intrinsic evaluation of detection.The dataset contains more than 80 flow features extracted using CICFlowMeter.
- Preprocessing: The authors remove socket features, missing and infinite values, and normalize remaining features before training.Removing socket features leaves 77 input features; normalization maps feature values from zero to one.
- Preprocessing: Labels are encoded for binary classification, with normal traffic mapped to 0 and attack traffic mapped to 1.All DDoS classes are grouped into the attack category.
- Feature space: An Andrews curve is used to inspect the multidimensional distribution, which shows a high degree of non-linearity in the feature space.The dataset is flow-based and contains more than 80 extracted features before preprocessing.
C. Experimental Setup
The experimental setup divides the data into training, validation, and testing subsets and evaluates the model with a train-test split. Validation tunes architecture parameters, while testing estimates performance.
- Data partitioning: The data are divided into training, validation, and testing subsets for model construction and evaluation.Training adjusts neural-network weights, validation fine-tunes architecture parameters, and testing estimates accuracy or performance.
- Evaluation protocol: The authors use train-test split rather than k-fold cross-validation because time-series serial correlation makes cross-validation less suitable.This choice follows the stated evaluation setting for the data.
- Data partitioning: Validation is used to select classifier architecture parameters rather than neural-network weights.The number of hidden layers is given as an example of a validation-tuned parameter.
- Model training: The softmax layer classifies decoder outputs as normal or attack traffic using categorical cross-entropy, Adam, and ReLU activations.Training uses 50 epochs and a batch size of 32; the model with the least validation loss is selected.
1) Training RNN-autoencoder:
The training procedure monitors training and validation loss across epochs and selects the model at the lowest validation loss. The accompanying figure presents these loss trends over training.
- Loss monitoring: Figure 4 tracks training and validation loss over the number of epochs.The figure is used to inspect loss behavior during model training.
2) Hyper-parameter Tuning:
Hyper-parameter tuning compares learning rates and architectural settings for the RNN-autoencoder. Smaller learning rates improve results but increase training time, with the best reported performance using four hidden layers.
- Learning-rate tuning: Learning rates of 0.1, 0.01, 0.001, and 0.0001 are evaluated for the RNN-autoencoder.The experiments also vary hidden layers, iterations, channels per layer, and activation functions.
- Learning-rate tuning: 99% overall accuracy is achieved when the learning rate is decreased to 0.0001.The passage reports better results with smaller learning rates.
- Learning-rate tuning: Smaller learning rates increase training time while improving the model’s reported results.The passage specifically notes longer training as the learning rate is reduced.
- Architecture tuning: The best performance is achieved with four hidden layers.The authors report varying the number of hidden layers during tuning.
- Data partitioning: Classifier performance depends partly on how training and testing data are partitioned.Prior work cited in the passage found the best performance when 70% of input data was used for training.
D. Evaluation
DDoSNet is evaluated with ROC, confusion-matrix, and standard classification metrics, and it outperforms the compared classical machine-learning algorithms. Its ROC analysis reports an AUC of 98.8, while the confusion matrix reports accuracy of 0.99.
- 98.8 AUC indicates that the proposed model separates 98.8% of positive and negative classes successfully.
- 0.99 accuracy is reported for detecting all attack and normal classes in the confusion-matrix evaluation.
- The evaluation uses precision, recall, F-score, and accuracy for systematic benchmarking against related approaches.
- DDoSNet performs better than the six compared classical algorithms: Decision Tree, NB, Booster, Random Forest, SVM, and Logistic Regression.The reported ordering places DDoSNet first, followed by Logistic Regression and SVM; NB performs poorly because it assumes attribute independence.
E. Discussions
The discussion presents DDoSNet as a deep-learning approach for anomaly detection that uses an RNN-autoencoder to classify SDN traffic as normal or malicious. It automatically extracts features and is reported to outperform shallow learners on several evaluation metrics.
- DDoSNet uses an RNN-autoencoder to classify input traffic into normal or malicious types.
- The model reduces data dimensionality by automatically extracting features from input data.
- DDoSNet achieves the best precision, recall, F1-score, and accuracy compared with shallow learners.
- The discussion identifies deep learning as promising for intrusion detection because it can handle complex nonlinear relationships.
- The model can be implemented at the SDN controller application layer, with malicious traffic blocked by null routing or redirected to a honeypot server.
V. CONCLUSION AND FUTURE WORK
The paper concludes that DDoSNet, trained and evaluated on CICDDoS2019, achieves the highest reported metrics among the compared classical machine-learning techniques. Future work will broaden evaluation, attack classification, and SDN traffic diversity.
- DDoSNet is a deep-learning model for detecting DDoS attacks against SDN networks.
- The model is trained and evaluated using CICDDoS2019, which contains comprehensive and recent DDoS attack types.
- DDoSNet achieves the highest recall, precision, F-score, and accuracy compared with established classical machine-learning techniques.
- Future work will test the model on other datasets and extend binary normal-versus-malicious classification to multiclass attack identification.
- The authors also plan heterogeneous SDN simulations and attack traffic to create a dataset that better represents current Internet traffic.