Attack detection analysis in software-defined networks using various machine learning method

doi:10.1016/j.compeleceng.2023.108655

Attack detection analysis in software-defined networks using various machine learning method

2023-05-01

12

PRE

AI

Y

Yonghong Wang

M

Mazeyanti Mohd Ariffin

M

Masoumeh Abolfathi

A

Abdulmajeed Alqhatani

L

Laila Almutairi

DOI：10.1016/j.compeleceng.2023.108655

Original

Original request for help

Save

Abstract

En 中文

The Software-Defined Network (SDN) provides a more flexible and effectively managed network design for next-generation networking. Network managers can easily manage and regulate the entire network using its programmable central controller architecture. This central controller serves as the focal point for numerous attack vectors due to its centralized structure. However, Distributed Denial of Service (DDoS) attacks against the SDN is the most prominent. The goal of this project is to use a machine learning method to categorize SDN traffic as either attack or normal traffic. Next, the Feature Selection method, such as the Filter-based Fisher score method, Wrapper-based method, and analysis of variables (ANOVA) f-test, is used for finely-granulated detection. Then, a rule-based detection method using the Renyi joint entropy algorithm is employed to detect DDoS attacks on SDN controllers. We manage a public DDoS attack SDN Dataset with 23 attributes overall. The dataset includes normal and attack traffic for the Internet Control Message Protocol (ICMP), User Datagram Protocol (UDP), and Transmission Control Protocol (TCP). Except for attributes that specify the target and source machines, the dataset, which contains more than 100,000 recordings, has statistical features such as byte count, duration sec, packet rate, and packet per flow. In the classification process, many classifiers such as Artificial Neural Network (ANN), XGBoost (XGB), Support Vector Machine (SVM), and k-Nearest Neighbor (k-NN) were used. The test results demonstrated the efficacy and efficiency of the suggested strategy using the analysis of variables (ANOVA), which performed better than competing methods across a range of evaluation parameters.

Keywords:

Software denied networking

Renyi joint entropy algorithm

Attack detection

DDoS

Machine learning

Deep learning

Feature selection

Attack detection analysis in software-defined networks using various machine learning method

Abstract

Journal

Organization