Detection and Mitigation of DDoS Attacks on SDN Controller in IoT Network using Gini Impurity

doi:10.21203/rs.3.rs-2991752/v1

Nowadays, Distributed denial-of-service (DDoS) attacks are a serious threat to businesses and individuals, and it is getting more prevalent. Moreover, the exponential growth of IoT devices and their interdependency makes the technology more vulnerable to DDoS attacks. Therefore, this paper presents an efficient Gini-Impurity based method for detection and mitigation of DDoS attacks. The proposed approach uses the Gini impurity technique as a metric on the Software Defined Network (SDN) controller in IoT network to measure the homogeneity of the network traffic. Gini impurity based method is efficient, fast, and requires less computing power. The approach also uses a classifier to filter the network traffic. We evaluated the effectiveness of the proposed approach using real-world network traffic datasets. The detection rate of the proposed approach varies between 98% and 100%. We compared the proposed approach with existing methods, and it detects DDoS attacks early with high accuracy and a low false-positive rate.

Distributed denial-of-service

Internet of Things

Software-defined networks

Gini index

Machine Learning

Distributed Denial of Service (DDoS) attack is a prevalent and persistent threat to modern networks, causing significant disruption and financial losses to businesses and organizations. In a DDoS attack, an attacker compromises a large number of devices known as botnets. These botnets rapidly reduce network capacity, resources, and bandwidth. The research community was aware of denial of service (DoS) attacks in the early 1980s, which were meant to prevent legitimate users from accessing a particular network resource [1]. Currently, DDoS attacks on the Internet may be carried out in two ways [7]. In the first method, the attacker sends malicious packets to a certain protocol or application in order to confuse it. In the case of simple DoS, the targeted host or server rejects all requests from its users using all available bandwidth and leaving the service unreachable to new requests as a consequence of large data flooding in the communication channel. In the second method, the attacker purposefully overloads the server with bogus requests, causing actual requests to suffer and be deleted before completion. A DDoS attack is the outcome of such a breach in a distributed system, i.e., when data is sent between numerous network devices spread across the network without any control.

DDoS attacks are the most common and deadly threats that use various protocols from multiple OSI model levels. Despite the fact that transport layer DDoS attacks are among the most widely investigated threats, and it impair current network infrastructures in a variety of ways

According to a Kaspersky analysis, DDoS attacks increased by 23% in the first quarter of 2021 compared to the same time in 2020 [30]. The financial services sector remains the most targeted industry for DDoS attacks, accounting for 25% of all attacks in the first quarter of 2021 [30]. The average attack size increased by 31.8% between 2021 and 2022, from 3.3 Gbps to 4.3 Gbps, and it was 28.6% more multi-vector attacks (attacks that overwhelm the target with many vectors) [29]. The COVID-19 pandemic is most likely to responsible for a 542% increase in DDoS attacks against the healthcare industry in Q2 2020 compared to Q1 2020, as mentioned by Nexusguard research [29]. Neustar claimed that 32% of all DDoS attacks occurred in the second quarter of 2021, and IoT devices accounted for 15% of all DDoS attacks in 2020, up from 10% in 2019 [31]. According to Akamai Technologies, DDoS attacks against Internet of Things (IoT) devices increased by 62% in 2022 compared to 2021 [32].

Nowadays, the fast expansion of the Internet of Things (IoT) has resulted in a surge in the deployment of linked devices in a variety of fields, including healthcare, smart homes, and transportation. These devices may connect and coordinate with one another through Software-Defined Networking (SDN) technology, which enables centralized network traffic control and administration. However, since the SDN controller is centralized, it is subject to DDoS attacks where an attacker may flood the controller with a huge quantity of traffic and destroy its capacity to operate the network [2]. DDoS attacks on SDN controllers in IoT networks may have serious implications such as removing devices from the network, interrupting vital services, and decreasing overall network performance. As a result, it is necessary to develop effective approaches for identifying DDoS attacks against SDN controllers in IoT networks [3]. The figure 1 depicts the DDoS attacks on server using compromised IoT devices (attacker, legitimate user) where legitimate users indicate the normal flow from IoT devices and attacker indicate the a huge traffic flow from compromised IoT devices. SDN controller act as centralized unit where the control plane and data plane of a network are separated in the network architecture.

As shown in the figure 2, SDN is a separate architecture composed of three independent levels: data, control, and application plane. The data plane is made up of switches and routers used to transfer network traffic, while the control plane is made up of the network’s intelligent part. The control plane is separated from the data plane in the SDN architecture. This allows for programmatic network setup and operation using software, allowing for centralized network management and control. The data plane forwards the packets and is implemented using networking equipment like switches and routers.

SDN architecture can be implemented in a number of ways, but the two most common are API-based and OpenFlow-based [40]. The proposed work uses OpenFlow protocol which links the control plane and the data plane. OpenFlow is used to communicate between an SDN controller and a switch, in contrast to the API-based strategy which uses APIs to facilitate communication between the controller and the supporting infrastructure.

This work proposes a novel approach for detecting DDoS attacks in SDN controllers of IoT networks based on the concept of Gini impurity. The proposed technique utilizes Gini impurity as a metric to quantify network traffic homogeneity and classification models to decide whether network traffic is normal or abnormal. Following are the major contributions of our research work:

Proposed approach uses Gini impurity-based DDoS attack detection method which is faster than entropy and it consumes less processing power.
We combined the benefits of machine learning (ML) intelligence with SDN flexibility to get high detection accuracy.
The proposed approach developed an automatic notification system to warn the SDN controller whenever a DDoS is detected in the network.
The proposed method also mitigates the DDoS Attacks over the IoT network.

The remainder of this article is structured as follows. Section 2 presents the related works to detect or handle DDoS attacks in different environments, specially focused on SDN networks. Section 3 describes the proposed method for detecting and mitigating the DDoS attack on the SDN network. Furthermore, Section 4 presents the experimental setup and results. Finally, Section 5 comprises the conclusion and future work.

This section summarizes the existing works in the field of detecting DDoS attacks in SDN and different networks. Conti et al. [8] propose two simple and effective defenses against DDoS attacks using route spoofing and resource exhaustion in SDN networks. The first method is “periodic monitoring” which uses traffic analysis data to identify enemy nodes and second is “selective blocking” which stops opponents from purposely accessing other users’ active communication channels. The results of these tests demonstrate that there is a considerable rise in packet transmission rate and a sufficient reduction in bandwidth utilization and processing delay for new inquiries.

A detection approach by Zheng et al. [10] suggested the use of adaptive correlation analysis in the development of a real-time DDoS defense strategy. This method has the ability to protect networks against well-known DDoS attacks such as SYN flooding, UDP-based amplification and crossfire amplification.

Koay et al. [11] proposed a revolutionary multi classifier system to increase the flexibility and accuracy of recognizing low-intensity and high-intensity attacks. Approach uses entropy-based features to detect DDoS attacks with high reliability. The approach is able to acquire higher accuracy and recall statistics when comparing the suggested strategy to cutting-edge methods. Meti et al. [12] used SVM and neural networks (NN) to categorize different connections in the SDN. Barki et al. [13] proposed ML-based clustering techniques to detect DDoS attacks in SDN. They used a number of ML algorithms to detect anomalies in the traffic, including K-means, I Bayes, and K-nearest neighbor. The authors of [14] investigated a variety of ML techniques, including SVM, fuzzy logic, decision trees, neural networks, and Bayesian networks, to detect DDoS attacks in the network. However, their ideas lacked a DDoS mitigation method. Galeano-Brajones et al. [15], proposes an entropy-based solution for detecting and mitigating DoS and DDoS attacks in IoT scenarios. The results demonstrate that technique is effective against actual IoT data traffic. SDN is a promising paradigm that can assist in detecting and mitigating DoS and DDoS attacks.

Yang et al. [16] proposed a new anomaly network traffic detection approach for the cloud computing environment that uses SVM to normalize the values of network variables and to identify abnormal network behaviors. Technique employed six distinct network traffic characteristics, as well as a composite information entropy and SVM model.

Ravi et al. [17] explains how to defend IoT servers against DDoS attacks activated by fraudulent wireless IoT devices. Using a semi supervised ML algorithm, a novel mechanism dubbed learning-driven detection mitigation (LEDEM) was proposed to detect DDoS and mitigate it. It obtained a detection accuracy rate of 96.28% for DDoS attacks. And Wang et al. [18] the datasets utilized in both the training and testing stages of the evaluation of detection of DDoS attacks in cloud computing and SDN networks include a number of models with features. The DDoS attack detection model is the most accurate for SDN networks, with an accuracy rate of 89.30%.

A hybrid strategy for incremental learning-based DDoS attack detection is developed by Hosseini et al. [19]. It utilizes I Bayes, random forest, decision tree, multilayer perceptron (MLP), and k-nearest neighbors (K-NN), decision tree and multilayer perceptron to provide better results. The findings show that the random forest beats other algorithms in terms of performance. Houda et al.[20] proposed Co-IoT, a blockchain-based framework for collaborative DDoS mitigation that employs smart contracts (e.g., Ethereum's smart contracts) to facilitate collaboration between SDN-based domains and the decentralized transmission of attack information. The experimental results demonstrate that Co-IoT is flexible, efficient, secure, and cost-effective, making it a promising strategy for mitigating large-scale DDoS attacks.

Liang et al. [21] employed statistical tools combined with machine learning methods to detect DDoS attacks. In addition to distance measuring methods, preset distributions are often used in the statistical approach to normal and aberrant traffic behavior. In the machine learning stage, classifiers such as K-Means, SVM, decision trees, I Bayes, and AI are utilized. Balamurugan and Saravanan [22] created a detection method based on two algorithms: packet inspection and a hybrid approach combining recurrent NN with modeling clustering (NK-RNN).

Yang et al. [35] presented the ADAM (Adaptive DDoS Attack Mitigation) solution to combat DDoS attacks using information entropy and unsupervised anomaly detection techniques. During very severe DDoS attacks, the ADAM method achieves an average detection accuracy of 99.13% and considerably decreases the false positive rate by 35–59%.

Mahmoud et al. [36] used two common feature selection techniques: Information Gain (IG) and Random Forest (RF) to evaluate the complete aspects of DDoS attacks in SDN networks. They have used a Deep Learning (DL) solution that makes use of Long Short Term Memory (LSTM) and an auto encoder. According to the findings of their research, the DL technique is capable of successfully identifying DDoS attacks while having no influence on the controller’s performance. However, this technique has an over fitting problem.

Syed et al. [44] discussed a new way to find intrusions on the Internet of Things (IoT). It uses a modern IoT dataset and a feed-forward neural networks model with embedding layers to store high-dimensional category features for multi-class classification. Then, transfer learning is used to code high-dimensional category features so that a second feed-forward neural networks model can be used to build a binary classifier. The results show that both binary and multi-class classifiers are very good. But it not adaptable for high volume of traffic.

The proposed approach utilizes a combination of Gini-Impurity based technique and classification algorithm to identify DDoS attacks in an IoT network. Classification algorithms classify network flows into two classes namely normal flows and attacks using a two-class classification technique. A POX controller introduced for collecting flows and determining Gini-Impurity value. The proposed method comprises of detection (Gini-Impurity and classification sections) and Mitigation which work together to identify and mitigate DDoS attacks on the POX controller.

Figure 3 presents the system architecture of proposed work. The system architecture is divided into the following sections: data plane, control plane, and application plane. In the data plan section, IoT devices are connected with topological configurations. The control plane is made up of the network’s intelligent part. The OpenFlow protocol, which links the control plane and the data plane, is used to communicate between an SDN controller and physical devices. Application layer handles all business and security applications. This layer manages critical software services such as metering, routing, load balancing, IDS systems, and firewall deployment. The data capturing collects IP flows and other features from the tables’ flows of the network’s switches in every second. After this, data is processed and categorical features are cast in numerical features. Then, the machine learning module analyses network data and is utilized for detection of DDoS attacks. The mitigation takes countermeasures to reduce the damage if a DDoS attack is identified.

The application plane section is divided into two phases namely DDoS detection and DDoS mitigation. The detailed flowchart of DDoS detection and DDoS mitigation phases is shown in Fig. 4. Algorithm 1 presents the proposed DDoS detection and mitigation method. The detection phase is divided into four modules for the detection of DDoS in the controller of SDN. The proposed work introduces a dynamic time quantum method. It means the detection module checks DDoS attacks after a dynamic time quantum value. The Time Period (Tp) variable has an initial value of 5 ms. The time (t) starts at 1 ms. If condition (Tp = = t) is false then a linear increment in t values; otherwise, flow goes for the next phase. In this phase, the system calculates Gini impurity using algorithm 2, and if Gini values are less than threshold values D^th i.e true condition, it means there is no possibility of DDoS attacks, so flow goes for the slow start phase with updated Tp values using exponential increment. If conditions fail it means there is a DDoS attack. For ensuring DDoS attack, the proposed model uses an ML algorithm. The system captures data in the control plane of SDN and extracts features from the generated dataset. Moreover, if DDoS is detected using the ML classification algorithm, flow goes for the mitigation module; otherwise, flow goes for the slow start phase using the updated Tp value. In the mitigation module, a DDoS attack message is sent to the controller and blocks the socket (port + IP address) from which a frequently requested request is coming. There is a chance that a legitimate user may block; therefore, waiting time algorithm 3 is used for unblocking the socket. The following subsection elaborates the detection and mitigation module details.

Algorithm 1: DDoS Attack Detection and mitigation

Input: Data flow in network

Output: Detection and Mitigation of DDoS attacks

Step 1: Start data flow in network

Step 2: Start timer and use exponential time (slow start)

Step 3: if time (t) is equal to period time(Tp)

jump to step 4

else

Increase the time (t + 1) and jump to step − 2

Calculate gini impurity using algorithm 2

Step 4: if Gini value < threshold

Set period time (Tp) with exponential function and jump to step-2

else

go to step 5

Step 5: Extract the features

Step 6: Test with ML model

Step 7: if “is DDoS”

I. Set period time (Tp) with additive function and jump to step-2

II. Alarm message and block the socket from where frequently request is coming and store in a queue

III. Using waiting time algorithm open the block socket for next chance

IV. if waiting time W=(2ⁿ-1)*t

jump to step 7-V

else

jump to step 7-III

V. Open the socket and jump to step 7-I

else

Set period time (Tp) with exponential function and jump to step 2

Step 8: Exit

3.1 DDoS Detection Phase

This section discusses the three major modules of DDoS Detection algorithm.

3.1.1 Module 1: Concept of timer

A timer is an essential part of DDoS detection systems. The control plane stores statistics about traffic flows and exchanges for a predetermined period of time [5]. Existing methods typically rely on a predetermined amount of time for analysis. Due to the variable duration and intensity of DDoS attacks, this strategy may not be practically applicable. Therefore, introducing a dynamic time quantum for detecting DDoS attacks is a more effective method. Depending on the characteristics of the traffic flow, a dynamic time quantum approach permits the analysis of network traffic over variable time intervals. The method can detect DDoS attacks that may occur over shorter or longer intervals with greater precision by dynamically adjusting the time quantum. Therefore, the approach becomes more adaptable to altering network conditions and attack patterns. The proposed model introduces a dynamic time quantum, i.e., the Time Period (Tp) variable, and its initial value is 5 ms. Time (t) starts at 1 ms, and the Tp value is updated according to Fig. 4 using the proposed model, which removes the static time period concept, i.e., after a certain period of time, the detection module is running.

3.1.2 Module 2: Concept of Gini Impurity

Gini impurity is a measure of the impurity or randomness in a set of data. In the context of DDoS attacks, Gini impurity can be used to measure the randomness of the traffic that is being directed towards a target. Algorithm 2 presents the Gini impurity calculation for finding randomness in data. if DDoS is found using Gini then flow goes to the classification section for validating the DDoS attacks. Entropy and Gini impurity can be used equally in many situations. Following are the reasons to choose Gini impurity over entropy:

Entropy is a more mathematically reliable evaluation metric, while Gini Impurity is quicker to calculate and less sensitive to the presence of unusual classes.
The Gini Index has a range of [0, 0.5], while the Entropy has a range of [0, 1].
The Gini criteria is significantly quicker since it requires less computing effort.
The Gini Impurity only does binary splitting when working with categorical data variables and provides “success” or “failure”; in contrast, information gain assesses the entropy variations before and following splitting and displays impurity in class variables.
Numerous studies have examined the efficacy of the Gini index and entropy in decision trees. For example, Breiman et al. [33] found that the Gini indicator produced decision trees that were slightly more accurate than entropy. The most recent study by Saad et al. [34], the Gini index outperforms entropy in terms of accuracy, recall, precision, and across numerous datasets.
Calculating entropy requires figuring out logarithmic functions, which can be hard to do, especially with big datasets. On the other hand Gini impurity is easy to figure out because it only requires simple mathematics.
A data and splitting criterion experiment is required because the larger partitions are preferred by Gini Impurity and is straightforward to apply, while information gains favor smaller partitions (distributions) with a range of different values.

Algorithm 2: Algorithm for Gini Impurity

def gini_impurity(groups):

Step 1- Initialize a dictionary called “counts” to store the frequency of each group in L.

counts = {}

Step 2- for each group in L, check if it already exists in “counts”. If it does,

for group in groups:

if group in counts:

counts[group] + = 1

else:

counts[group] = 1

Step 3- increment its count. If it doesn’t, add it to “counts” with a count of 1.

Initialize a variable “impurity” to 1.0.

impurity = 1.0

Step 4- For each group in “counts”, calculate its frequency (i.e., count divided by the length of L) and square it.

For group in counts:

freq = counts[group] / len(groups)

Step 5- Subtract the square of the frequency from “impurity” for each group.

Impurity = Impurity –freq ^2

return impurity

3.1.3. Module 3: Classification section

Figure 6 depicts a machine learning based classification system for the proposed method. The flow collector, machine learning method, detection and mitigation, and flow manager are the five modules of the classification system. The CICFlowMeter software was used to develop the flow collector module [38, 39]. This module collects data packets from the network, then creates flows and sends them to the ML approach module. This module classifies the preprocessed input flows as suspicious or benign using a trained model as shown in Fig. 7. Then, using the mitigation module to modify the flow manager in order to prevent DDoS attacks, the detection module makes a determination based on the outcomes of the ML approach, and the flow manager module notifies the controller of any suspicious flows. We used the POX controller [40] and the network simulator Mininet [41] to test the proposed concept. In academia, Mininet is a well-liked SDN-based network simulator. The documentation advantage of Mininet is substantial. Additionally, we may utilise any open-source SDN controller with this emulator.

ML Approach

Machine learning (ML) approaches [37] are widely used to analyse patterns and identify anomalies in network traffic. Moreover, it offers robust, adaptive, and scalable DDoS detection capabilities. Based on the dataset, machine learning methods were used for classification.

Data Source

The first step in developing a machine learning (ML) classifier is gathering the data on which the algorithm will be trained and tested. The data should be modeling, which implies it should contain both input and output qualities. The size of the dataset also influences the classifier’s performance.

Preprocessing

Once the data has been collected, it must be cleaned and preprocessed so that the ML algorithm can use it. This might include activities such as removing unnecessary or missing data, standardizing or normalizing the findings, and converting category data to numerical values. Preprocessing is a critical step since it improves the usefulness and stability of the classifier [42].

Feature Extraction

The next step is to extract relevant characteristics from the preprocessed data. Feature extraction is the process of selecting and extracting the most informative parts of the data that will be used to train the classifier. This might include dimensionality reduction tactics such as feature selection algorithms, which identify the most important variables in a dataset. The dataset features, which comprise more than 80 network flow parameters in CSV format, were created using the CICFlowMeter programme. We have selected top 42 features as show in Table 1 based on correlation matrix score [42].

Table 1

Attribute selected for classification
S. No.	Attributes	S. No.	Attributes	S. No.	Attributes
1.	Protocol	15.	Flow IAT Std	29.	Packet Length Variance
2.	Flow Duration	16.	Flow IAT Max	30.	Average Packet Size
3.	Total Fwd Packets	17.	Fwd IAT Total	31.	Avg Fwd Segment Size
4.	Total Backward Packets	18.	Fwd IAT Mean	32.	Avg Bwd Segment Size
5.	Total Length of Fwd Packets	19.	Fwd IAT Std	33.	Fwd Header Length
6.	Total Length of Bwd Packets	20.	Fwd IAT Max	34.	Subflow Fwd Packets
7.	Fwd Packet Length Max	21.	Bwd IAT Mean	35.	Subflow Fwd Bytes
8.	Fwd Packet Length Mean	22.	Bwd IAT Std	36.	Subflow Bwd Packets
9.	Fwd Packet Length Std	23.	Fwd Header Length	37.	Subflow Bwd Bytes
10.	Bwd Packet Length Max	24.	Bwd Header Length	38.	act_data_pkt_fwd
11.	Bwd Packet Length Min	25.	Fwd Packets/s	39.	Idle Mean
12.	Bwd Packet Length Mean	26.	Max Packet Length	40.	Idle Std
13.	Bwd Packet Length Std	27.	Packet Length Mean	41.	Idle Max
14.	Flow IAT Mean	28.	Packet Length Std	42.	Idle Min

Model Training

The classifier trained using the prepared data after preprocessing and features extraction. Typically, this requires feeding the algorithm the input characteristics and output labels and then allowing the algorithm to “learn” from the data. Throughout training, the algorithm adjusts its internal settings to maximize its performance on the training data.

3.1.4. Machine learning classification

A classification algorithm, a form of machine learning approach, predicts the class or category of a given sample or data point. The basic idea behind a classification technique is to train the model with a dataset, which means that the class or category of each sample has been identified. The model may then associate certain data features or properties to specific classes. The trained model can predict the class of new, unlabeled data. Logistic Regression (LR), Decision Tree (DT), K-Nearest Neighbors (KNN), and Multi-Layer Perceptron (MLP) algorithms are used in our approach for classification. The classifier may predict outcomes for entirely new datasets.

3.2 DDoS attacks Mitigation Module

Mitigation is the process of eliminating the effects of an attack on a target network. Therefore, there are several different strategies that organisations can use to mitigate DDoS attacks, including traffic filtering and rate limiting, scrubbing and traffic shaping, network segmentation, cloud-based solutions, and increasing network capacity [43]. In the proposed work, whenever DDoS is detected in the machine learning method, the mitigation module will be active. A message will be passed to the controller, and algorithm 1 will run from step 7 onwards. After that, the system blocks malicious ports and IP addresses, i.e., sockets from which a huge amount of requests are coming, and adds these sockets into a queue. However, a legitimate user may be blocked in the queue, so the algorithm will give the legitimate user another chance to interact with the server. The proposed approach uses algorithm 3 for DDoS mitigation. A variable ‘n’ has an initial value of zero and a maximum value of 10. For measuring waiting time, take ‘w’ as a variable, and w = k*t, where ‘t’ is the time value and the value of ‘k’ will be randomly picked between 0 and 2ⁿ-1. If the value of ‘w’ is equal to (2n-1)*t, then remove the socket from the queue on first in, first out basis.

Algorithm 3: Algorithm for backoff waiting

backoff_algorithm(max_retries, initial_backoff)

Step − 1: Set the initial number of retries to 0 and maximum value is 10, initialize the back off time to the initial back off value.

Retries = 0

backoff = initial_backoff

Step − 2: Enter a loop that continues until the maximum number of retries is reached.

Step − 3: Inside the loop, perform the operation that you want to retry in case of failure. Check the result of the operation.

While W!=(2^ retries − 1)* backoff:

retries = retries + 1

if retries < max_retries:

k = random(0,2^ retries − 1)

W = k*backoff

Else:

return failure

Step − 4: If the operation is successful, return success and exit the function.

Step − 5: If the maximum number of retries is reached without success, return failure.

Return success

This section presents the matrices used to validate the datasets and their corresponding experimental results.

4.1 Evaluation Metrics

Table 2 presents the evaluation matrix used to measure the performance of the proposed approach in terms of accuracy, recall, and precision, F-measure, False Positive Rate (FPR), and True Positive Rate (TPR). Where ‘N’ denotes the number of genuine negative cases, while P is the number of genuine positive (attack) cases. TPR is the percentage of attacks that a detection system correctly identifies as attacks. While FPR shows the fraction of normal events misidentified as attacks. The alert rate is determined by dividing the total number of categorized samples by the number of occurrences identified as attacks.

Table 2

Equations of confusion metrics
Parameter	Equation
Accuracy	\(\frac{(TP+TN)}{(TP+FN+TN+FP)}\)
Precision	\(\frac{\left(TP\right)}{(TP+FP)}\)
Recall	\(\frac{\left(TP\right)}{(TP+FN)}\)
F1 measure	\(\frac{\left(2PrecisionRecall\right)}{(Precision+Recall)}\)
TPR	\(\frac{\left(TP\right)}{(TP+FN)}\)
FPR	\(\frac{\left(FP\right)}{(TN+FP)}\)

4.2 Dataset Details

Proposed work used two datasets i.e. NSL-KDD dataset [6] and CICFlowMeter created dataset. NSL-KDD data which is publically available and the NSL dataset was utilized by the researcher [16, 19] for testing several types of DDoS attacks. In addition, the NSL-KDD test and training sets have a sufficient number of recordings. It makes it possible to evaluate the entire set despite having to randomly select a small sample. Another dataset is composed of more than 80 network flow parameters in CSV format, created using the CICFlowMeter programme [38]. Because the SDN dataset is substantially less than other datasets, the system selects two labels classification dataset that is normal or attack. Since the datasets split, we used 60% of the dataset for training and 40% for testing purposes.

4.3 Topological Configuration:

Figure 8 depicts the topological configurations to testing phase of our proposed method. We created tests that included multiple attack scenarios in order to undertake a quantitative assessment of our technique. In order to start the SDN networks, network configuration is required. The simulated network structure consists of 64 hosts generated on the Mininet network [41] emulator, which is given below in fig as H1,H2,H3…H64 and each with an IP address distributed as 10.0.0.1 to 10.0.0.64.

4.4 Experimental Results

4.4.1 Performance analysis of multiple ML algorithms using NSL-KDD dataset:

Proposed work uses NSL-KDD dataset which comprises 3 types of DDoS attacks namely User Datagram Protocol (UDP) attack, Internet Control Message Protocol (ICMP) attack, and Transmission Control Protocol (TCP) attacks. Proposed work used four ML algorithms for classification namely MLP, LR, KNN, and DT.

Table 4 presents the classification results of proposed approach on UDP attack. In this, the DT achieves higher accuracy.

Table 4

UDP attack results on NSL-KDD dataset
Algorithm	Accuracy(%)	F1-Score (%)		Precision(%)		Recall (%)
		0	1	0	1	0	1
MLP	71.16	81	43	100	27	68	98
LR	71.13	71	72	57	92	92	58
KNN	71.63	78	60	84	53	73	68
DT	77.19	81	72	79	75	83	70

Table 5 presents the classification results of proposed approach on ICMP attack In this, the Decision tree (DT) and KNN achieves higher accuracy than other classification algorithms.

Table 5

ICMP attack results on NSL-KDD dataset
Algorithm	Accuracy(%)	F1-Score (%)		Precision(%)		Recall (%)
		0	1	0	1	0	1
MLP	99.78	00	100	00	100	00	100
LR	99.93	85	100	93	100	77	100
KNN	99.99	99	100	99	100	99	100
DT	99.99	100	100	99	100	100	100

Table 6 presents the classification results of proposed approach on TCP attack. TCP attacks data gave better results than UDP and ICMP in the NSL-KDD dataset and it generates some output which is given in Table 6. According to the statistics presented in Tables 4, 5, and 6, the DT and KNN algorithms achieve higher accuracy than other classification algorithms when used to detect DDoS attacks. To visually represent the performance of these algorithms, we have created Fig. 12, which shows the combined performance of the DT, LR, MLP, and KNN algorithms in different DDoS attack scenarios.

Table 6

TCP attack results on NSL-KDD dataset
Algorithm	Accuracy(%)	F1-Score (%)		Precision(%)		Recall (%)
		0	1	0	1	0	1
MLP	99.94	00	100	00	100	00	100
LR	99.94	00	100	00	100	00	100
KNN	99.98	80	100	100	100	67	100
DT	99.98	81	72	83	70	79	75

4.4.2 TPR and FPR values for different ML algorithm in NSL-KDD dataset:

Tables 7, Table 8, and Table 9 present the statistics of TPR and FPR. A graph has been plotted to compare the TPR and FPR of different classification algorithms. The graph indicates that KNN and DT algorithms have a significantly lower FPR rate compared to LR and MLP, making them the best options for the classification task. Figure 10 shows a graphical representation of this comparison between TPR and FPR.

Table 7

TPR and FPR analysis on UDP attack
Algorithm	TP	FP	FN	TN	TPR	FPR
MLP	4835	22	2288	866	0.67	0.02
LR	2787	2070	242	2912	0.92	0.41
KNN	4064	793	1479	1675	0.73	0.32
DT	3831	1026	802	2352	0.82	0.30

Table 8

TPR and FPR analysis on ICMP attack
Algorithm	TP	FP	FN	TN	TPR	FPR
MLP	0	106	0	49385	nan	0.0021
LR	82	24	6	49379	0.93	0.0004
KNN	105	1	1	49384	0.99	2.02
DT	106	0	1	49384	0.99	0.0

Table 9

TPR and FPR analysis on TCP attack results
Algorithm	TP	FP	TN	TPR	FPR
MLP	0	3	5466	nan	0.0005
LR	0	3	5466	nan	0.0005
KNN	2	1	5466	1.0	0.0001
DT	2	1	5466	1.0	0.0001

4.4.3 Performance analysis of multiple ML algorithms in CICFlowMeter created dataset:

Proposed work used MLP, LR, KNN, and DT for classification on CICFlowMeter created dataset. In this, DT algorithm achieves higher accuracy than other classification algorithms and Table 10 presents comparison of four ML algorithm results

Table 10

DDoS attack result on CICFlowMeter created dataset
Algorithm	Accuracy(%)	F1-Score (%)		Precision(%)		Recall (%)
		0	1	0	1	0	1
MLP	98.47	98	99	98	99	98	99
LR	91.69	90	93	98	88	82	99
KNN	99.82	100	100	100	100	100	100
DT	99.93	100	100	100	100	100	100

4.4.4 TPR and FPR values for different ML algorithm on CICFlowMeter created dataset:

Table 11 presents the statistics of TPR and FPR on the CICFlowMeter created dataset. And further a graph has been plotted to compare the TPR and FPR of different classification algorithms. The graph indicates that KNN and DT algorithms have a minimum FPR rate compared to LR and MLP, making them the best options for the classification task. Figure 11 shows a graphical representation of this comparison between TPR and FPR.

Table 11

DDoS attack result on CICFlowMeter created dataset
Algorithm	TP	FP	FN	TN	TPR	FPR
MLP	28505	457	573	37889	0.98	0.01
LR	24043	5219	405	38057	0.98	0.12
KNN	29195	67	54	38408	0.99	0.01
DT	29246	16	31	38431	0.99	0.00

4.5 Comparison Analysis of proposed approach with state-of-art

Table 12 compares the proposed technique with existing work. The table clearly demonstrates that the proposed method achieves the highest accuracy of 99.9% compared to other techniques. Most of the existing methods [8, 11, 16, ]do not describe the detection accuracy in their results .

The approach proposed by Yang et al. [16] used only seven features and one ML algorithm therefore it may be not effective to detect all kinds of DDoS attacks. The detection accuracy of approach [37] is very low. The approach proposed by sayed et al. [37] is complex and does not fit in the IoT environment.

Table 12

DDoS attack results comparison
Reference	Features	Methodology	Dataset	Strength	Experiment results	Drawbacks
Conti et al. [8]	entropy threshold, size of window	periodic surveillance based on statistics from traffic analysis	CAIDA	Gain in packet delivery rate, decrease in bandwidth utilization, and request processing	NA	Cannot detect Zero-hour attack
Idhammad et al. [9]	source/destination ports, Connection definition features, source/destination Ips	RF based and Information Theoretic Entropy	public dataset CIDDS-001	Superior than single classifier approaches in terms of accuracy	Accuracy = 99.6% Precision = NA TPR = 99% FPR = NA	With more noisy traffic, FPR variations rise, and high detection time
Koay et al. [11]	separation TCP, separation network, IP, port, MAC,	Multi classifier system ,Entropy based	DARPA and ISCX’12	RNN has a greater overall accuracy and performs well with sequenced data. ADT is capable of handling missing values well.	Accuracy = NA Precision = 99% TPR = 94% FPR = NA	high computation complexity
Yang [16]	network packets, Source IP, destination IP, source port number, packet types, destination port number,	Information entropy and SVM based	NSL KDD, DARPA KDD	Suitable for large networks	Accuracy = NA Precision = 99% TPR = NA% FPR = NA	Because of Entropy’s restricted representation range, only attacks within a particular range may be identified.
Hosseini et al. [19]	forward-selected subset of features chosen in accordance with classifiers	Decision Tree, KNN-based Divergence Test and NB, Random Forest, and MLP	Generated dataset, NSL KDD	Multiple classifiers are used to detect a wide variety of attacks.	Accuracy = 98.9% Precision = 99% TPR = 87% FPR = 1%	The cost of selecting a feature subset for each classifier
Zheng Yang [35]	Only Seven features	KNN	MAWI [41]	Attacks in synthetic and IOT-Bot	Accuracy = 99.7% Precision = NA TPR = NA FPR = 1%	feature selection and Non volumetric DdoS attacks
Mahmoud Said El [36]	Selected subset of features	LSTM and RNN	CICIDS2017 and CICIDS2018	Use ML and DL Algorithm	Accuracy = 99.6% Precision = 99.9% TPR = NA FPR = 1%	overfitting
Sudar[37]	Selected subset of features	SVM, decision tree	KDD99	SVM better than DT	Accuracy = 85% Precision = 80% TPR = NA FPR = NA	Poor performance
Proposed work	Select 40 features out of 80 corresponding to classifiers as given in Table 1	Gini impurity based detection and using ML Algorithm KNN ,decision tree, MLP, based and LR	NSL KDD, datasets and real time dataset	Detects both high rate and low rate attacks, Superior than single classifier approaches in terms of accuracy	Accuracy = 99.9% Precision = 100% TPR = 98% FPR = 1%	Performance may vary on feature selection method

The proposed method detects DDoS attacks in SDN and uses the Gini impurity technique as a metric and a trained classifier to filter network traffic. The proposed approach is deployed on an SDN network, which allows for centralized control and efficient management of security threats in IoT networks. The approach is suitable for IoT networks as it requires low computational power. Experimental results on various datasets reveal that the Gini-based static threshold gives better performance than existing entropy-based methods. The proposed approach achieves a high detection rate of 98% to 100%. The proposed method not only detects the DDoS attack but also mitigates this brutal attack.

Although only one SDN controller is used in this approach to detect DDoS attacks, future research will use multi controllers to increase the effectiveness of this approach in networks. Moreover, the proposed work used a static threshold for Gini values, so future research may use a dynamic threshold based method.

Funding: The authors declare that no funds, grants, or other support were received during the preparation of this manuscript.

Competing Interests Disclosure: The authors have no relevant financial or non-financial interests to disclose.

Research Data Policy and Data Availability Statements: The datasets used during the study are available at: https://www.unb.ca/cic/datasets/nsl.html

P. J. Criscuolo, Distributed Denial of Service, Tribe Flood Network 2000, and Stacheldraht CIAC-2319, Department of Energy Computer Incident Advisory Capability (CIAC), UCRL-ID-136939, Rev. 1.,Lawrence Livermore National Laboratory, February 14, 2000.
I. Farris, T. Taleb, Y. Khettab, and J. Song, “A survey on emerging SDN and NFV security mechanisms for IoT systems,” IEEE Commun. Surveys Tuts., vol. 21, no. 1, pp. 812–837, 1st Quart., 2019.
M. Du and K. Wang, “An SDN-enabled pseudo-honeypot strategy for distributed denial of service attacks in industrial Internet of Things,” IEEE Trans. Ind. Informat., vol. 16, no. 1, pp. 648–657, Jan. 2020.
Mirkovic, J., & Reiher, P. (2004). A taxonomy of DdoS attack and DdoS defence mechanisms. ACM SIGCOMM Computer Communication Review, 34(2), 39–53.
Banitalebi Dehkordi, Afsaneh, MohammadReza Soltanaghaei, and Farsad Zamani Boroujeni. “The DdoS attacks detection through machine learning and statistical methods in SDN.” The Journal of Supercomputing 77 (2021): 2383–2415.
https:// accessed on 11 April 2023)
J. Mirkovic and P. Reiher, A taxonomy of DdoS attack and DdoS defense mechanisms, ACM SIGCOMM Computer Communications Review, vol. 34, no. 2, pp. 39–53, April 2004.
Mauro Conti, Chhagan Lal, Reza Mohammadi, Umashankar Rawat, Lightweight solutions to counter DdoS attacks in software defined networking, Wirel. Netw. 25 (5) (2019) 2751–2768.
Mohamed Idhammad, Karim Afdel, Mustapha Belouch, Detection system of HTTP DdoS attacks in a cloud environment based on information theoretic entropy and random forest, Secur. Commun. Netw. 2018 (2018).
J. Zheng, Q. Li, G. Gu, J. Cao, D. K. Y. Yau, and J. Wu, “Realtime DdoSdefense using cots sdn switches via adaptive correlation analysis,” IEEE Transactions on Information Forensics and Security, vol. 13, no. 7, pp. 1838–1853, July 2018.
Abigail Koay, Aaron Chen, Ian Welch, Winston K.G. Seah, A new multi classifier system using entropy-based features in DdoS attack detection, in: Proceedings of International Conference on Information Networking (ICOIN), IEEE, 2018, pp. 162–167.
N. Meti, D. G. Narayan, and V. P. Baligar, “Detection of distributed denial of service attacks using machine learning algorithms in software defined networks,” in 2017 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Sept 2017, pp. 1366–1371.
L. Barki, A. Shidling, N. Meti, D. G. Narayan, and M. M. Mulla, “Detection of distributed denial of service attacks in software defined networks,” in 2016 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Sept 2016, pp. 2576–2581.
J. Ashraf and S. Latif, “Handling intrusion and DdoS attacks in software defined networks using machine learning techniques,” in 2014 National Software Engineering Conference, Nov 2014, pp. 55–60.
Galeano-Brajones, J., Carmona-Murillo, J., Valenzuela-Valdés, J. F., & Luna-Valero, F. (2020). Detection and mitigation of DoS and DDoS attacks in IoT-based stateful SDN: An experimental approach. Sensors, 20(3), 816.
Chen Yang, Anomaly network traffic detection algorithm based on infor- mation entropy measurement under the cloud computing environment, Cluster Comput. (2018) 1–9.
Ravi, N., & Shalinie, S. M. (2020). Learning-driven detection and mitigation of DDoS attack in IoT via SDN-cloud architecture. IEEE Internet of Things Journal, 7(4), 3559–3570.
Wang B, Zheng Y, Lou W, Hou YT (2015) DdoS attack protection in the era of cloud computing and software-defined networking. Comput Netw 81:308–319
Soodeh Hosseini, Mehrdad Azizi, The hybrid technique for DdoS detection with supervised learning algorithms, Comput. Netw. 158 (2019) 35–45.
Abou El Houda, Z., Hafid, A., & Khoukhi, L. (2019, December). Co-IoT: A collaborative DDoS mitigation scheme in IoT environment based on blockchain using SDN. In 2019 IEEE Global Communications Conference (GLOBECOM) (pp. 1–6). IEEE.
Liang X, Znati T (2019) On the performance of intelligent techniques for intensive and stealthy DdoS detection. Comput Netw 164:106906
20. Ujjan RMA, Pervez Z, Dahal K, Bashir AK, Mumtaz R, González J (2019) Towards sFlow and adaptive polling sampling for deep learning based DdoS detection in SDN. Future Gener Comput Syst
Specht, S. M., & Lee, R. B. (2004). Distributed denial of service: Taxonomies of attacks, tools, and countermeasures. In ISCA PDCS (pp. 543–550).
Lemon, J. (2002, February). Resisting SYN flood DoS attacks with a SYN Cache. In BSDCon (Vol. 2002, pp. 89–97).
Farwell, J. P., & Rohozinski, R. (2011). Stuxnet and the future of cyber war. Survival, 53(1), 23–40. [26]DDOS Report in 2018. https://securelist.com/DDoS-report-in-q3-2018/88617/. Accessed 04 December 2018.
Mousavi, S.; St-Hilaire, M. Early Detection of DdoS Attacks Against Software Defined Network Controllers. J. Netw. Syst. Manag.2018, 26, 573–591.
Kia, M. Early Detection and Mitigation of DdoS Attacks in Software Defined Networks. Master’s Thesis, Ryerson University,Toronto, ON, Canada, 2015.
Dave, T.A. OpenFlow: Enabling innovation in campus networks. ACM SIGCOMM Comput. Commun. Rev. 2008, 38, 69–74.
DdoS Threat Landscape Report Q2 2022, Available at: https://www.nexusguard.com/threat-report-q3-2021/ (Last accessed on 11 April 2023)
https://securelist.com/kaspersky-DDoS-protection-q2-2022-report/103127/(Last accessed on 11 April 2023)
https://(Last accessed on 11 April 2023)
https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/q2-2021-state-of-the-internet-security-report.pdf(Last accessed on 11 April 2023)
Breiman, L., Friedman, J., Olshen, R., & Stone, C. (1984). Classification and regression trees. CRC press.
Saad, A., Taki, E., & El-Araby, E. (2017). Comparative analysis of decision tree ID3 and C4.5. International Journal of Computer Applications, 177(43), 6–11.
T. Cai, T. Jia, S. Adepu, Y. Li and Z. Yang, “ADAM: An Adaptive DdoS Attack Mitigation Scheme in Software-defined Cyber-Physical System,” in IEEE Transactions on Industrial Informatics, doi: 10.1109/TII.2023.3240586.
M. S. E. Sayed, N. –A. Le-Khac, M. A. Azer and A. D. Jurcut, “A Flow-Based Anomaly Detection Approach With Feature Selection Method Against DdoS Attacks in SDNs,” in IEEE Transactions on Cognitive Communications and Networking, vol. 8, no. 4, pp. 1862–1880, Dec. 2022, doi: 10.1109/TCCN.2022.3186331.
K. M. Sudar, M. Beulah, P. Deepalakshmi, P. Nagaraj and P. Chinnasamy, “Detection of Distributed Denial of Service Attacks in SDN using Machine learning techniques,” 2021 International Conference on Computer Communication and Informatics (ICCCI), Coimbatore, India, 2021, pp. 1–5, doi: 10.1109/ICCCI50826.2021.9402517.
CIC Flow Meter. (2020). Canadian Institute for Cybersecurity. [Online].Available: https://github.com/CanadianInstituteForCybersecurity/CICFlowMeter
I. Sharafaldin, A. H. Lashkari, S. Hakak, and A. A. Ghorbani, ``Developing realistic distributed denial of service (DdoS) attack dataset and taxonomy,’’ in Proc. Int. Carnahan Conf. Secur. Technol. (ICCST), Oct. 2019,pp. 1_8.
“Openflow1.3specification,”https://opennetworking.org/wpcontent/uploads/2014/10/openflow-spec-v1.3.0.pdf
“Mininet,” http://mininet.org/ K. M. Kenjiro Cho and A. Kato., “Traffic Data Repository at the WIDE Project,” in {USENIX ATC}. IEEE, 2000, pp. 731–736.
Ali, T. E., Chong, Y. W., & Manickam, S. (2023). Machine Learning Techniques to Detect a DdoS Attack in SDN: A Systematic Review. Applied Sciences, 13(5), 3183.
Liu, Z., Jin, H., Hu, Y. C., & Bailey, M. (2018). Practical proactive DDoS-attack mitigation via endpoint-driven in-network traffic control. IEEE/ACM Transactions on Networking, 26(4), 1948–1961.
Ge, M.; Syed, N.F.; Fu, X.; Baig, Z.; Robles-Kelly, A. Towards a deep learning-driven intrusion detection approach for Internet of Things. Comput. Netw. 2021, 186, 107784.

No competing interests reported.

Detection and Mitigation of DDoS Attacks on SDN Controller in IoT Network using Gini Impurity

Status:

Version 1

Abstract

Figures

1. INTRODUCTION

2 LITERATURE REVIEW

3 THE PROPOSED METHOD

3.1 DDoS Detection Phase

3.1.1 Module 1: Concept of timer

3.1.2 Module 2: Concept of Gini Impurity

3.1.3. Module 3: Classification section

3.1.4. Machine learning classification

3.2 DDoS attacks Mitigation Module

4. Experimental Evaluation

4.1 Evaluation Metrics

4.2 Dataset Details

4.3 Topological Configuration:

4.4 Experimental Results

4.4.1 Performance analysis of multiple ML algorithms using NSL-KDD dataset:

4.4.2 TPR and FPR values for different ML algorithm in NSL-KDD dataset:

4.4.3 Performance analysis of multiple ML algorithms in CICFlowMeter created dataset:

4.4.4 TPR and FPR values for different ML algorithm on CICFlowMeter created dataset:

4.5 Comparison Analysis of proposed approach with state-of-art

5. CONCLUSION AND FUTURE WORKS

Statements & Declarations

References

Additional Declarations

Status:

Version 1