Detection and Mitigation of DDoS Attack UsingHybrid Machine Learning Approach in SDN
S Manisankar, Hariharan M N J, Ashwin M, N Gowthami · 2024
Software Defined Networking (SDN) is a transformative approach that revolutionizes traditional networking by enabling programmable control over network devices. By decoupling network control from physical infrastructure, SDN enhances flexibility and efficiency in network management. However, this decoupling also introduces a vulnerability to DDoS attacks as a significant disadvantage, primarily because the control plane, responsible for managing the entire network, becomes a potential target when isolated from the data plane. To detect the DDoS attack we are using Random Forest and Gradient Boosting as hybrid Machine Learning Algorithm. The dataset is accurately constructed via the utilization of the CICFlowMeter tool. The process begins with creating a dataset that includes both legitimate and abnormal requests using the CICFlowMeter. Afterwards feature selection is carried out using the Chi-Square and f_classif methods. These methods guarantee the inclusion of meaningful attributes while reducing noise. In the detection phase, a binary classifier approach is introduced, leveraging the strengths of Random forest. The output of the Random Forest then serves as input for the classification stage to classify the traffic pattern either as TCP/ UDP/HTTP using Gradient Boosting algorithm. After the classification stage, mitigation steps are taken by blocking a request from a host. The accuracy of this hybrid approach is calculated at 97% based on True Positives, True Negatives, False Positives, and False Negatives.