SD-CRF: A DoS Attack Detection Method for SDN
Gang Zheng, Xinzhong Xu, Juwei Yan · 2020
The most common and effective attack against SDN is DOS/DDoS attacks from data plane. It takes advantage of the characteristics of communication mechanism between the SDN controllers and switches. This paper analyzes the principle and characteristics of the attacks, and proposes a detection method based on conditional random field (CRF). We firstly select several traffic statistical attributes as classification features, which have strong representativeness to the DoS attacks against SDN. Then on the basis of the CRF theory, we establish a traffic classification model. The classification model can be used for anomaly inference of real-time collected and unlabeled traffic, so as to infer whether there has DoS attack traffic. The experimental results confirm the method's ability to detect DoS attacks against SDN.