SDN DDoS Detection via Segmented Pre-Detection and Proxy Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SDN attack detection schemes face challenges with high resource consumption and low accuracy, particularly in detecting DDoS attacks that can cause network paralysis by overwhelming flow tables and controllers.
Innovation Solution
A method involving a pre-detection module to calculate entropy features, a proxy module to build and send feature messages for CART detection, and decision instructions for control operations, ensuring efficient and accurate detection by separating security and control functions and using recursive feature elimination and classification and regression tree algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning-based detection schemes are deployed on the SDN controller, then detection accuracy is improved, but computing resource consumption increases and controller performance deteriorates
Solution Approach 1:
The system divides the detection architecture into two segments: a lightweight pre-detection module deployed on switches that performs initial filtering using minimal resources, and a more comprehensive detection model on the controller that processes only suspicious flows. This segmentation allows accurate detection while reducing controller resource consumption by handling only critical cases.
Solution Approach 2:
The pre-detection module performs preliminary analysis of traffic flows using simple statistical features and entropy calculations before submitting suspicious flows to the controller-based detection model. This preliminary action filters out normal traffic early, reducing the computational burden on the controller while maintaining detection accuracy for actual attacks.
2Reliability
If DDoS attack traffic is allowed to reach the SDN controller, then complete traffic monitoring is maintained, but the controller becomes overwhelmed and network paralysis occurs
Solution Approach 1:
The pre-detection module on switches performs preliminary anti-action by identifying and marking suspicious traffic flows before they reach the controller. By calculating entropy features and comparing them against thresholds, the system proactively filters attack traffic, preventing controller overload while maintaining monitoring capability for legitimate traffic.
Solution Approach 2:
The pre-detection module acts as an intermediary between the data plane and the controller, filtering and preprocessing traffic flows before submission. This intermediary layer reduces the volume of traffic reaching the controller to only suspicious flows requiring detailed analysis, maintaining reliable monitoring while preserving controller productivity.
3Use of energy by moving object
If statistical analysis-based detection schemes are used, then computing resource consumption is reduced, but detection accuracy deteriorates
Solution Approach 1:
The pre-detection module performs preliminary statistical analysis using simple metrics such as packet rate, flow duration, and entropy calculations. This lightweight preliminary action consumes minimal computing resources while effectively identifying suspicious patterns that warrant further investigation by the more accurate but resource-intensive controller-based detection model.
Solution Approach 2:
The pre-detection module serves as an intermediary that performs initial statistical filtering, consuming minimal resources while identifying candidate suspicious flows. This intermediary then submits only these candidates to the controller for accurate detection, achieving both low resource consumption and high detection accuracy through the two-stage approach.
4Reliability
If flow table capacity is increased to handle more attack packets, then detection completeness is improved, but the time delay for detection and response increases
Solution Approach 1:
The pre-detection module on switches performs preliminary analysis of incoming traffic using entropy-based metrics and simple statistical features, identifying suspicious flows before they consume controller resources. This preliminary action enables rapid detection and response to DDoS attacks without requiring the controller to process every packet, thus reducing time delay while maintaining detection completeness.
Solution Approach 2:
The detection system is segmented into a fast pre-detection layer on switches that handles initial filtering with minimal time delay, and a deeper analysis layer on the controller that processes only suspicious flows. This segmentation allows the system to maintain detection completeness for all traffic while reducing overall response time by handling the majority of traffic locally at the switch level.
Data Source
AI summary
The disclosure provides a method for detecting and defending a Distributed Denial of Service attack in an SDN environment. The method includes: building data messages acquired as feature messages by a proxy module; sending the feature messages to a pre-built detection model to obtain a detection result; making a decision instruction based on the detection result; and performing control operations by the proxy module based on the decision instruction.