3D-PM: A ML-powered Probabilistic Detection of DDoS Attacks in P4 Switches
Ferhat Mecerhed, Amel Benabdallah, Khaled Zeraoulia, Chafika Benzaïd · 2023
The Software-Defined Networking (SDN) technology has revolutionized network management and automation, enabling more efficient and centralized controls. However, network security and availability are threatened by DDoS attacks in SDN environments. During these attacks, the network can become overwhelmed with traffic, making the controller overloaded and unresponsive. Consequently, SDN networks require effective DDoS detection and mitigation solutions. In this paper, we propose a novel approach that leverages the potential of programmable data planes and machine learning to empower intelligent DDoS detection at line-rate. Our proposal involves securing SDN networks using machine learning and programmable switches. We call this solution "Data-Plane DDoS Attack Detection Based on P4 Switches and Machine Learning" or 3D-PM. To detect flooding attacks, we considered multiple machine learning models that are trained and tested on unique datasets gathered from realistic traffic. These datasets are then balanced using a variable sampling method to ensure unbiased and robust model training. Our evaluation revealed that the Random Forest model performed exceptionally well with an accuracy of 98.95%, highlighting its effectiveness as a resource-efficient solution. 3D-PM aim to detect attacks directly at the data plane using the P4 language, relieving controller overload and allowing direct detection at the data plane.