sesa 17(12): e2

Research Article

A Deep Learning Based DDoS Detection System in Software-Defined Networking (SDN)

Download392 downloads
  • @ARTICLE{10.4108/eai.28-12-2017.153515,
        author={Quamar Niyaz and Weiqing Sun and Ahmad Y. Javaid},
        title={A Deep Learning Based DDoS Detection System in Software-Defined Networking (SDN)},
        journal={EAI Endorsed Transactions on Security and Safety},
        volume={4},
        number={12},
        publisher={EAI},
        journal_a={SESA},
        year={2017},
        month={12},
        keywords={Network security, Deep Learning, Multi-vector DDoS detection, Software Defined Networking},
        doi={10.4108/eai.28-12-2017.153515}
    }
    
  • Quamar Niyaz
    Weiqing Sun
    Ahmad Y. Javaid
    Year: 2017
    A Deep Learning Based DDoS Detection System in Software-Defined Networking (SDN)
    SESA
    EAI
    DOI: 10.4108/eai.28-12-2017.153515
Quamar Niyaz1, Weiqing Sun1, Ahmad Y. Javaid1,*
  • 1: College of Engineering, The University of Toledo, 2801 W. Bancroft St., Toledo, Ohio-43607, USA
*Contact email: ahmad.javaid@utoledo.edu

Abstract

Distributed Denial of Service (DDoS) is one of the most prevalent attacks that an organizational network infrastructure comes across nowadays. Poor network management, low-priced Internet subscriptions, and readily available attack tools can be attributed to their rise. The recently emerged software-defined networking (SDN) and deep learning (DL) concepts promise to revolutionize their respective domains. SDN keeps the global view of the entire managed the network from a single point, i.e., the controller, thus making the network management easier. DL-based approaches improve feature extraction/reduction from a high-dimensional dataset such as network traffic headers. This work proposes a deep learning based multi-vector DDoS detection system in an SDN environment. The detection system is implemented as a network application on top of the SDN controller and can monitor the managed network traÿc. Performance evaluation is based on different metrics by applying the system on traÿc traces collected from different scenarios. A high accuracy with low false-positive rate is observed in attack detection for the proposed system.