Research on DDoS Attack Detection Based on Machine Learning in SDN Environment
Shurui Feng, Guiqin Yang, Wanying Man · 2023
The difference between Software-Defined Networking (SDN) and traditional networks is that SDN allows for flexible definition of network devices’ forwarding functions through software programming. It decouples the control plane from the forwarding plane, enabling centralized control of the entire network through a controller. This feature is both an advantage and a weakness of SDN, as the control plane is vulnerable to attacks that can result in the paralysis of the entire network, particularly when facing distributed denial-of-service attacks. Therefore, a combined KNN and SVM algorithm-based attack detection model is proposed. The model selects related five-dimensional features based on the characteristics and classification of DDoS attacks and packet header information, and then uses the SVM-KNN algorithm for feature training and classification. Simulation results show that the proposed detection algorithm has higher accuracy and lower false positive rate compared to the SVM and KNN algorithms, with relatively less detection time.