Ensemble-Based DDoS Attack Detection Model for Software-Defined Networks
摘要
In this modern era, networking has advanced rapidly. The need for businesses to incorporate numerous dynamic applications, services, physical objects, and machines is increasing. Consequently, networking infrastructure has be- come more complex in terms of devices and resource utilization. The traditional networking paradigm has proven ineffective and inefficient in handling these demands. As a result, Software Defined Networking (SDN) has garnered significant attention from researchers and practitioners. Unlike the traditional paradigm, SDN offers efficient resource utilization, simplified network management, improved performance, network virtualization, and programmability. However, it faces security challenges such as network tampering, unauthorized access, flow rule conflicts, poor controller deployment, and Distributed Denial of Service (DDoS) attacks. Among these, DDoS is one of the most threatening attacks on SDN. In response, several studies have been conducted to detect DDoS in SDN networks using statistical approaches, traditional machine learning (ML) techniques, and state-of-the-art methods like deep learning (DL). Traditional ML methods, though effective, are less efficient than advanced DL approaches, which, in turn, are computationally complex. To address this issue, we proposed an ensemble-based DDoS detection model for SDN using a flow-based dataset. The experiment was conducted with the InSDN dataset, which includes normal traffic, metasploitable-2 attacks targeting a server, and attacks targeting an Open Virtual Switch (OVS) machine. Since the dataset contains various attacks such as DoS, DDoS, web attacks, R2L, malware, probe, and U2R, it was necessary to isolate the DDoS data for our purposes. The dataset was split into 70% for training and 30% for testing. Results indicated that the adaptive boosting ensemble technique achieved the highest accuracy at 100%. However, in terms of latency, the gradient boosting algorithm performed best, with a latency of 60.6 ms, while the KNN_DT-based stacking algorithm had the highest latency at 119,431.5 ms.