Exploring LDoS Attack Detection in SDNs using Machine Learning Techniques
Received: 27 October 2024 | Revised: 19 November 2024 | Accepted: 27 November 2024 | Online: 5 December 2024
Corresponding author: Ali Osman Mohammed Salih
Abstract
This study investigates the application of machine learning algorithms for detecting Low-Rate Denial-of-Service (LDoS) attacks within Software-Defined Networks (SDNs). LDoS attacks are challenging to detect due to their similarity to normal network behavior. This study evaluates the performance of algorithms such as Logistic Regression (LR), K-Nearest Neighbors (KNN), and BIRCH clustering in this challenge. The results show that the LR and BIRCH algorithms outperformed other approaches, achieving a detection accuracy of 99.96% with minimal false positive and negative rates. The models demonstrated a fast detection time of 0.03 seconds, highlighting the potential of machine learning to improve SDN security. The study recommends future work to validate these findings in real-world environments to strengthen security systems.
Keywords:
LDoS attacks, DoS detection, SDN, logistic regression, BIRCH algorithm, k-nearest neighborsDownloads
References
J. Gao, S. Chai, B. Zhang, and Y. Xia, "Research about DoS Attack against ICPS," Sensors, vol. 19, no. 7, Jan. 2019, Art. no. 1542.
M. P. De Almeida, R. T. De Sousa Júnior, L. J. García Villalba, and T. H. Kim, "New DoS Defense Method Based on Strong Designated Verifier Signatures," Sensors, vol. 18, no. 9, Sep. 2018, Art. no. 2813.
J. David and C. Thomas, "Efficient DDoS flood attack detection using dynamic thresholding on flow-based network traffic," Computers & Security, vol. 82, pp. 284–295, May 2019.
D. Tang, X. Wang, X. Li, P. Vijayakumar, and N. Kumar, "AKN-FGD: Adaptive Kohonen Network Based Fine-Grained Detection of LDoS Attacks," IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 1, pp. 273–287, Jan. 2023.
D. Tang, C. Gao, X. Li, W. Liang, S. Xiao, and Q. Yang, "A Detection and Mitigation Scheme of LDoS Attacks via SDN Based on the FSS-RSR Algorithm," IEEE Transactions on Network Science and Engineering, vol. 10, no. 4, pp. 1952–1963, Jul. 2023.
D. Tang, S. Wang, B. Liu, W. Jin, and J. Zhang, "GASF-IPP: Detection and Mitigation of LDoS Attack in SDN," IEEE Transactions on Services Computing, vol. 16, no. 5, pp. 3373–3384, Sep. 2023.
G. Somani, M. S. Gaur, D. Sanghi, M. Conti, and R. Buyya, "DDoS attacks in cloud computing: Issues, taxonomy, and future directions," Computer Communications, vol. 107, pp. 30–48, Jul. 2017.
S. Yoo et al., "Highly Repeatable Rope Winch Design With Multiple Windings and Differential Gear Mechanism," IEEE Access, vol. 8, pp. 87291–87308, 2020.
V. de M. Rios, P. R. M. Inácio, D. Magoni, and M. M. Freire, "Detection of reduction-of-quality DDoS attacks using Fuzzy Logic and machine learning algorithms," Computer Networks, vol. 186, Feb. 2021, Art. no. 107792.
D. Tang, L. Tang, R. Dai, J. Chen, X. Li, and J. J. P. C. Rodrigues, "MF-Adaboost: LDoS attack detection based on multi-features and improved Adaboost," Future Generation Computer Systems, vol. 106, pp. 347–359, May 2020.
D. Tang, R. Dai, L. Tang, and X. Li, "Low-rate DoS attack detection based on two-step cluster analysis and UTR analysis," Human-centric Computing and Information Sciences, vol. 10, no. 1, Feb. 2020, Art. no. 6.
L. Liu, H. Wang, Z. Wu, and M. Yue, "The detection method of low-rate DoS attack based on multi-feature fusion," Digital Communications and Networks, vol. 6, no. 4, pp. 504–513, Nov. 2020.
D. Tang, L. Tang, W. Shi, S. Zhan, and Q. Yang, "MF-CNN: a New Approach for LDoS Attack Detection Based on Multi-feature Fusion and CNN," Mobile Networks and Applications, vol. 26, no. 4, pp. 1705–1722, Aug. 2021.
W. Zhijun, L. Wenjing, L. Liang, and Y. Meng, "Low-Rate DoS Attacks, Detection, Defense, and Challenges: A Survey," IEEE Access, vol. 8, pp. 43920–43943, 2020.
M. Waqas, S. Tu, Z. Halim, S. U. Rehman, G. Abbas, and Z. H. Abbas, "The role of artificial intelligence and machine learning in wireless networks security: principle, practice and challenges," Artificial Intelligence Review, vol. 55, no. 7, pp. 5215–5261, Oct. 2022.
S. Zhan, D. Tang, J. Man, R. Dai, and X. Wang, "Low-Rate DoS Attacks Detection Based on MAF-ADM," Sensors, vol. 20, no. 1, Jan. 2020, Art. no. 189.
Y. Yan, D. Tang, S. Zhan, R. Dai, J. Chen, and N. Zhu, "Low-Rate DoS Attack Detection Based on Improved Logistic Regression," in 2019 IEEE 21st International Conference on High Performance Computing and Communications; IEEE 17th International Conference on Smart City; IEEE 5th International Conference on Data Science and Systems (HPCC/SmartCity/DSS), Zhangjiajie, China, Aug. 2019, pp. 468–476.
"Mininet: An Instant Virtual Network on Your Laptop (or Other PC) - Mininet." http://mininet.org/.
"Birch," scikit-learn. https://scikit-learn/stable/modules/generated/sklearn.cluster.Birch.html.
"LogisticRegression," scikit-learn. https://scikit-learn/stable/modules/generated/sklearn.linear_model.LogisticRegression.html.
W. Ismaiel, A. Alhalangy, A. O. Y. Mohamed, and A. I. A. Musa, "Deep Learning, Ensemble and Supervised Machine Learning for Arabic Speech Emotion Recognition," Engineering, Technology & Applied Science Research, vol. 14, no. 2, pp. 13757–13764, Apr. 2024.
"Confusion_matrix," scikit-learn. https://scikit-learn/stable/modules/generated/sklearn.metrics.confusion_matrix.html.
"GridSearchCV," scikit-learn. https://scikit-learn/stable/modules/generated/sklearn.model_selection.GridSearchCV.html.
"KNeighborsClassifier," scikit-learn. https://scikit-learn/stable/modules/generated/sklearn.neighbors.KNeighborsClassifier.html.
D. Y. Yousef, "Evaluating the performance of machine learning techniques in detecting LDoS attacks in SDNs.," Journal of Engineering Sciences & Information Technology, vol. 6, no. 6, 2022.
Downloads
How to Cite
License
Copyright (c) 2024 Ali Osman Mohammed Salih
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
