Identification of attacks on Software defined network Using machine learning approach

Abstract

SDN is a communication technology defined by a software program that manages network traffic routing and configuration. In contrast, the current network architecture controls traffic by configuring the various network elements remotely. The SDN architecture is centralized in nature such that data plane and control plane within a networking device are segregated. The control plane can be thought of as the mind of the network whereas the data plane is adhering to the controller’s decisions. Examples of SDN controllers include FloodLight, Ryu, Pox, Open- DayLight, Nox, etc. which are open source and incorporate a set of APIs for building network applications. Many researchers have worked on the detection of attacks and the categorizing of network traffic into benign and malicious categories. Existing DDOS attack detection research is based on threshold-based detection on the count of incomplete connections made, the number of queries made per user, traffic rate, and the total time of flow duration. Other techniques include computing the feature tensors for the construction of benign and malicious vectors and comparing these vectors to a threshold parameter for attack detection. Other techniques include the use of a Markov model on a network graph, a tensor-based technique for calculating the entropy of TCP layer attributes, randomness in different traffic features (such as Destination IP address, Source IP address, Protocol type, TCP flags, Destination Port, Source Port, and Packet size) and Machine learning (ML) based approaches. The techniques discussed above detect attacks by comparing a specific value as in threshold-based approach, which is impractical in a large network. Some of them trained the deep learning model on a traditional dataset which are not created in SDN environment. The detection method employed is computationally time-consuming, and the experimental setup is not adequately described.