DDoS Attack Identification and Defense Using SDN Based on Machine Learning Method

SDN (Software Defined Network) has attracted great interests as a new paradigm in the network. Thus, the security of SDN is important. Distributed Denial Service (DDoS) attack has been the plague of the Internet. Now, it is a threat in some SDN applied scenarios, such as the campus network. In order to alleviate the DDoS attack in the campus network, we propose an SDN framework to identify and defend DDoS attacks based on machine learning. This framework consists of 3 parts which are traffic collection module, DDoS attack identification module and flow table delivery module. Traffic collection module extracts traffic characteristics to prepare for traffic identification. Utilizing the flexible and multi-dimensional features of SDN network architecture in deploying DDoS attack detection system, the controller extracts the network traffic characteristics through statistical flow table information and uses the support vector machines (SVM) method to identify the attack traffic. Then the flow table delivery module dynamically adjusts the forwarding policy to resist DDoS attacks according to the traffic identification result. The experiment is conducted using KDD99 dataset. The experiment results show the effectiveness of the DDoS attack identification method.