Graduate School and Research Center in Digital Sciences

A DDoS attack detection and defense scheme using time-series analysis for SDN

Fouladi, Ramin Fadaei; Ermis, Orhan; Anarim, Emin

Journal of Information Security and Applications, Volume 54, October 2020


Software defined networking (SDN) has emerged as the integral part of cloud services since it provides flexible management capabilities to monitor and to analyze the network traffic with the help of programmable entities. Although, such functionalities play a significant role in terms of protecting the availability of cloud services against the security threats, SDN still has some vulnerabilities such as the distributed denial of service (DDoS) attacks. The DDoS attackers use spurious packets similar to normal ones and endanger the service continuity of SDN. Although conventional packet-based intrusion detection systems have broad databases to detect DDoS attacks, they are impotent of detection when the attack traffic is sheltered by the normal network traffic. The idea is therefore, to come up with a new countermeasure by observing and distinguishing the instant changes in network. In this work, we propose a DDoS attack detection and defense scheme using time-series analysis for SDN. The proposed scheme employs a model based on the upcoming traffic feature forecasting and the chaos theory together with the exponential filter and the dynamic threshold method to detect instant changes in the network. The experimental result shows that our algorithm has high detection rate and low false alarm.  

Document Doi Bibtex

Title:A DDoS attack detection and defense scheme using time-series analysis for SDN
Keywords:Distributed denial of service (DDoS); Software defined network (SDN); ARIMA; Chaos theory; Exponential smoothing
Type:Journal
Language:English
City:
Date:
Department:Digital Security
Eurecom ref:6313
Copyright: © Elsevier. Personal use of this material is permitted. The definitive version of this paper was published in Journal of Information Security and Applications, Volume 54, October 2020
 and is available at : https://doi.org/10.1016/j.jisa.2020.102587
Bibtex: @article{EURECOM+6313, doi = {https://doi.org/10.1016/j.jisa.2020.102587}, year = {2020}, month = {08}, title = {{A} {DD}o{S} attack detection and defense scheme using time-series analysis for {SDN}}, author = {{F}ouladi, {R}amin {F}adaei and {E}rmis, {O}rhan and {A}narim, {E}min}, journal = {{J}ournal of {I}nformation {S}ecurity and {A}pplications, {V}olume 54, {O}ctober 2020\&\#13;\&\#10;}, url = {http://www.eurecom.fr/publication/6313} }
See also: