Performance Evaluation of Machine Learning Approaches for Classification of Ddos Attacks in Software Defined

doi:10.21203/rs.3.rs-4324004/v1

Download PDF

Research Article

Performance Evaluation of Machine Learning Approaches for Classification of Ddos Attacks in Software Defined

https://doi.org/10.21203/rs.3.rs-4324004/v1

This work is licensed under a CC BY 4.0 License

Version 1

posted

You are reading this latest preprint version

Enhancing network management and centralized network control is the goal of software-defined network. It separates the data plane from the control plane. Pros of SDN include its programmability, flexibility, and manageability to accommodate network users' ever-increasing demands. SDN is known to be a strong and safe defense against malicious network activity, but it is also susceptible to attacks like distributed denial-of-service attacks. This is a result of its centralized control features. To defend against this threat, a number of machine learning strategies have been employed. This study evaluated the performance of five Machine learning (ML) Algorithm (Naive Bayes, K-nearest neighbour, Random Forest, support vector machine, Logistic regression) for classifcation of traffic dataset as either normal or DDOS attacks in SDN. The study adopted 10-fold cross validation on each of the ML Algorithms and the result showed Random forest has the highest performance compared with other machine learning model while Naive Bayes had the lowest training time.

DDOS Attack

Software defined Network

Machine learning

Support Vector Machine

Detection

Software defined Networking (SDN) is a new network paradigm that allows for advancements and gives networks the chance to offer intelligence [26]. It ensures programmability and centralized control through a remote device called a controller, which decouples the data plane from the control plane and promotes flexibility. There are three planes in the SDN architecture. The data plane houses the networking switches, which are merely packet-forwarding devices that operate according to the rules established by the controller, whereas the control plane uses a controller to determine the behavior of the network. The SDN controller serves as the communication channel between the network infrastructure and the application plane, which is made up of network service applications, business services, security services, and other services [8]. The architecture becomes a target for Distributed Denial of Service (DDOS) attacks due to SDN's programmability feature and centralized control. Distributed denial of service (DDOS) attacks are attempts to render a device or network resource inaccessible to its intended users. DDOS attacks are launched by two or more individuals or automated programs. Different DDOS Attacks exist in SDN. The taxonomy is show in Fig. 1.

Application Layer DDOS Attacks

Applications that are malicious may disguise themselves as another program to launch DDOS attacks, on this layer [11].

Control layer DDOS Attacks

Attackers send several packets_in messages to the controller in order to consume controller resources while denying controller services to genuine traffic. [9][10] [18] [19]

Data layer DDOS attacks

Attackers send series of unique flows through the SDN switch thereby filling up the switch buffer since a portion of the packet is being stored in the Switch's nodes while waiting for the Controller’s response [11].

Attacks on communication channels

When growing amount of data are sent on the network, the bandwidth between the Control and Data planes could become Saturated[9]. The Control-Application layer can also be exploited to launch attacks on the controller. [10].

The field of Software-Defined Networking (SDN) has witnessed various applications of machine learning (ML) approaches for the detection of Distributed Denial of Service (DDoS) attacks. Numerous studies have explored the effectiveness of different ML algorithms in enhancing security measures within SDN environments. One notable study conducted by [26] utilized supervised learning algorithms to address DDoS attacks based on flow fluctuations. Analyzing Packet_in requests from an emulated SDN network, they compared the performance of eight supervised learning models. However, their approach using a single feature for detection might not generalize well to all forms of attack traffic.

In contrast, [17] employed an Advanced SVM with a 5-tuple feature for detecting flooding-based DDoS attacks, achieving a 97% detection rate for TCP SYN flood and UDP Flooding. Yet, this approach focused on specific types of attacks, potentially neglecting other forms harmful to the network. The work of [28] took a comprehensive approach, considering three attack forms (TCP SYN, UDP, and ICMP) and transforming traffic features into a 6-tuple for detection. Although achieving a 95% accuracy with a low false alarm rate, the limited dataset may impact generalization.[12] aimed to improve accuracy using KNN and SVM models but only utilized two features, potentially limiting generalization. Similarly, [21] proposed a KPCA-GA-SVM algorithm, demonstrating a high accuracy of 98.09%. However, using traditional datasets might limit generalization capabilities.

The use of traditional datasets is a common trend, [16] applied Naïve Bayes on NSL-KDD data, and [13] used CICIDOS 2017 for DNN-based real-time DDoS threat detection. While achieving good accuracy, concerns about generalization capabilities persist. [23] explored different ML techniques for classifying bandwidth attacks, Controller attacks, and flow table attacks. [3] proposed a Snort IDS and deep learning technique, showcasing the superiority of SAE over adaptive sampling. [7] employed a CNN-based multi-dimensional IP flow analysis for DDOS detection, demonstrating effectiveness in SDN data simulation. [22] applied four ML algorithms for DDOS flooding attacks, showcasing their vulnerability testing and detection capabilities. [5] utilized LR, SVM, KNN, RF, and LSTM for DDOS detection, with Random Forest exhibiting the highest accuracy. However, their offline testing may limit real-time applicability. [4] compared SVM, KNN, DT, MLP, and CNN for DDOS detection, with SVM performing better, but generalization concerns remain due to the dataset's nature. [2] introduced a novel dataset and applied a hybrid Random Forest-Support Vector Classifier and other ML algorithms for DDOS detection. However, the inclusion of multiple features may pose overhead on the controller in a real SDN network.

In summary, various ML approaches have been explored for DDoS detection in SDN, however most study did not Mathew correlation coefficient (MCC), logistic loss and training time as metric of evaluation. The MCC is not affected by imbalance dataset and can help to determine a perfect classification. While the log loss is used to assess a model’s uncertainty. The training time can be used ascertaining the computational intensity of a model. Hence, these metrics were incorporated in this study to evaluate performance.

Table 1

Existing studies and performance evaluation metrics used
Author	Accuracy	Precision	F1score/Fmeasure	Specificity	Recall	MCC	Log Loss	Training time
[4]	✓	✓	✓			✓
[5]	✓	✓	✓		✓
[26]	✓	✓	✓		✓
[22]	✓				✓
[2]	✓	✓	✓	✓
[21]	✓	✓			✓
[23]	✓			✓				✓
[7]	✓	✓	✓	✓
[3]	✓	✓	✓		✓
[17]	✓
[28]	✓
[16]		✓	✓		✓
This study	✓	✓	✓	✓	✓	✓	✓	✓

2.1 Machine learning techniques used

Nearest Neighbor (KNN): KNN is a supervised machine learning algorithm that uses k nearest data points to determine the most frequently occurrence of a class in a query, with the final classification based on the most frequent class [25].

Random Forest

Random Forest is a machine learning algorithm that uses multiple decision trees to predict class labels [29]. It uses a sample size of N, assumes M characteristics, and m parameters in the input to influence attribute selection. A replacement tree is built for each sample, and m attributes are randomly selected from a tree node [24].

Naives Bayes Classifier

Naïve Bayes classifier is a classification algorithm based on Bayes rule, assuming attribute independence. It uses supervised learning to build a prediction model, calculating the probability of an instance belonging to each class. Equations (2.1) establish the probability of a class occurrence and causing an instance to belong to it [15].

$$\text{P}(\left(\text{y}|\text{x}\right)= \text{P}\left(\text{y}\right)\text{P}\left(\text{x}|\text{y}\right)/\text{P}(\text{x})$$

2.1

$\text{P}(\left(\text{y}|\text{x}\right)$ is the probability of instance x being in class y

$\text{P}\left(\text{y}\right)$ is the probability of y occurrence? It connotes how frequent the class x is in the given dataset. $\text{P}(\left(\text{x}|\text{y}\right)$ is the probability of causing x in y while the $\text{P}\left(\text{x}\right)$ is the probability of x occurrence.

Logistic regression

This is a machine learning classification technique that assigns input to one of the possible classes using a sigmoid function [6]. It can be expressed in the form

$$\text{P}\left(\text{X}\right)= {\text{e}}^{\text{b}0+\text{b}1\ast \text{x}}/{\text{e}}^{\text{b}0+\text{b}1\ast \text{x}}$$

2.2

Here P(X) is the probability of X which is the output, b0 is bias and b1 is the coefficient associated with input value (x). Classification label is set to 0 when the probability of an event is less than a given threshold value else it is assigned class label 1.

Support Vector Machine

Support Vector Machine (SVM) is a classification Algorithm.The idea of SVM is to find a hyper-plane that best separates two classes [18].

Given a training data set $\text{D}=\left\{{(\text{X}}_{1}, {\text{y}}_{1}){,(\text{X}}_{2}, {\text{y}}_{2}),\dots ,{(\text{X}}_{\text{n}}, {\text{y}}_{\text{n}})\right\} \text{w}\text{h}\text{e}\text{r}\text{e} {\text{X}}_{\text{i}}$is the characteristic vector of the training sample and ${\text{y}}_{\text{i}}$ is the associated class label. ${\text{y}}_{\text{i}}$ takes + 1 or − 1 ${\text{y}}_{\text{i}}\in \left\{+1,-1\right\}$. The linear hyperplane for a set of training data is defined as: $\text{w}.\text{x}+\text{b}=0$. Where $\text{w}$ is the vector, and $\text{b}$ is the bias term. The point above the separation hyperplane is satisfied by $\text{w}.\text{x}+\text{b}>0$ while the point below is satisfied by $\text{w}.\text{x}+\text{b}<0.$The two margins need to be adjusted to control the separability of data thus:

$$\text{w}.\text{x}+\text{b} \{ \ge 1 \text{f}\text{o}\text{r} {\text{y}}_{\text{i}}=1 \le -1 \text{f}\text{o}\text{r} {\text{y}}_{\text{i} }=-1$$

$$\text{H}1:\text{w}.\text{x}+\text{b}\le 1 \text{f}\text{o}\text{r} {\text{y}}_{\text{i}}=1$$

2.3

$$\text{H}2:\text{w}.\text{x}+\text{b}\le 1 \text{f}\text{o}\text{r} { \text{y}}_{\text{i}}=-1$$

2.4

This means that, the class falling on or above H1 belongs to class + 1, while the vector falling on or below H2 is in class $-1$. ${\text{y}}_{\text{i}}\left(\text{w}.\text{x}+\text{b}\right)\ge 1, \forall \text{i}$

The maximum edge is: $\frac{2}{\Vert \text{w}\Vert }+\text{C}{\sum }_{\text{i}=1}^{\text{N}}{{\xi }}_{\text{i}}$(2.5)

such that: ${\text{y}}_{\text{i}}\left(\text{w}.{\text{x}}_{\text{i}}\right)+\text{b}\ge 1-{{\xi }}_{\text{i}}, {\xi } \ge 0, \text{i}=1,\dots ,\text{N}.$

Where C > 0 is the penalty parameter indicating the degree of attention of outlier and the relaxation variable ${{\xi }}_{\text{i}}$ is a measure of the degree of outliers. Finding the maximum value of $\frac{2}{\Vert \text{w}\Vert } \text{i}\text{s} \text{e}\text{q}\text{u}\text{i}\text{v}\text{a}\text{l}\text{e}\text{n}\text{t} \text{t}\text{o}$calculating the minimum value of $\Vert \text{w}\Vert$.

2.3 Performance Evaluation metrics

The metrics used to evaluate the performance of the various models is the Accuracy, Precision, F1score, Recall, Specificity, Mathews correlation coefficient, and Logistic loss function

Accuracy is the measurement of the system that correctly classified both Benign traffic and malicious traffic [21].

$$\text{A}\text{c}\text{c}\text{u}\text{r}\text{a}\text{c}\text{y}=\frac{\text{T}\text{P}+\text{T}\text{N}}{\text{T}\text{P}+\text{T}\text{N}+\text{F}\text{P}+\text{F}\text{N}}\ast 100\text{\%}$$

Precision

Precision is defined as the percentage of the model prediction out of the total data values about the positive class [17].

$$Precision=\frac{TP}{TP+FP}\ast 100$$

Recall is the measurement of the relevant instance that is successfully retrieved [2]. $Recall=\frac{TP}{TP+FN}\ast 100$

F1 score is defined as the measure where recall and precision both are used [2] $F1Score=\frac{2\ast Precision\ast Recall}{Precision+Recall}\ast 100$

Specificity

Specificity is defined as the measure of the prediction of the negative class in the dataset [2]. Specificity =

The Matthews correlation coefficient (MCC) is a method using contingency matrices to compute the Pearson product–moment correlation coefficient between observed and predicted values. This different approach remains robust even when dealing with imbalanced datasets [4].

MCC = $\frac{\left(TP\ast TN\right)-(FP\ast FN)}{\sqrt{\left(TP+FN\right) \times \left(TN+FP\right)\times \left(TN+FN\right) \times (TP+FP)}}$

Logistic loss

is a metric used to assess the effectiveness of a classification model. It assesses the model's uncertainty by comparing projected probability against genuine binary outcomes. The lower the log loss, the better the model's predictions match the actual results.

Logistic Loss = $N1\sum i=1 N[{y}_{i}\text{log}\left({p}_{i}\right)+\left(1-{y}_{i}\right)\text{log}\left(1- {p}_{i}\right)]$

N is the number of instances or samples in the dataset. ${y}_{i}$ is the actual binary class label for the i-th instance (0 or 1). ${p}_{i}$is the predicted probability of the positive class for the i-th instance.

3.1 DATASET

The experiment was carried out on 4gram 1TB Intel Corei7 HP Laptop with a 64bit processor. This study used the SDN DDOS dataset from our previous study [1] for training and testing. The dataset consisted of 12 features and 82,289 instances. The distribution of traffic on dataset is shown in Table I. The feature set used are shown in Table II.

Table 2

Dataset instances and class
Traffic	Number of Instances		Total
Traffic	Normal	Malicious
ICMP	18,457	9,866	28,323
TCP	14,603	12,170	26,773
UDP	18,352	8,841	27,193
			82,289

Table 3

Summary of Feature Dataset
Sn	Feature	Keyword
1	Growth of flow entry	gfe
2	Growth of Unique Source IP	g_usip
3	Mean flow packet	Mean_pakt
4	Mean Flow byte	Mean_byte
5	Dispersion of flow packet	Disp_pakt
6	Dispersion of flow byte	Disp_byte
7	Average flow duration	avg_durat
8	Growth of source port	gsp
9	Average flow with same destination	avg_flow_dst
10	Rate of Packet_in	rate_pkt_in
11	Dispersion of flow interval	Disp_interval
12	Ratio of interactive flow IP pair	rfip

The experiment was carried out with a 10-fold Cross Validation on the different Machine learning as shown in Table 4.and Fig. 4. The performance of each model was estimated using the Accuracy, Precision, Recall, Specificity, F1score, Mathew’s correlation coefficient (MCC), Logistic loss and Training time. The training time of each model is depicted on Table 5.

Random Forest (RF) had the highest accuracy of 99.8% Precision of 99.8% Recall of 91.3%, Specificity of 99.8, F1Scores of 99.8%, MCC 99.7% and Logistic loss of 0.009. The RF has shown to be a good classifier because it uses various decision trees to achieve its classification as such a wrong decision of one tree is tackled by another tree. The classification is concluded based on the classification result of each tree.

The performance of Naïve Bayes was good with an Accuracy, Precision, Recall, Specificity and F1score of 97.2.% each. Mathews correlation coefficient (MCC) of 94% and logistic loss of 0.124. Similarly, kNN also performed well with an accuracy of 91.2%, precision of 91.3%, recall 91.2%, F1 score of 91.1%, specificity of 88.3%, MCC of 81.2% and logistic loss of 0.983

Logistic regression and SVM performed lowest. The logistic regression model did not capture the linear relationship between the features correctly, therefore the class labels are predicted incorrectly resulting in low Accuracy of 78.0%, precision 78.3%, recall of 78.0%, F1 score of 78.1%, specificity of 76.3%, MCC of 53.7 and logistic loss of 0.539.

Table 4

Performance of Machine Learning Algorithm applied to the generated Dataset
Model	Accuracy	Precision	Recall	F1score	Specificity	MCC	LOG LOSS
NB	97.2	97.2	97.2	97.2	97.2	94.0	0.124
kNN	91.2	91.3	91.2	91.1	88.3	81.2	0.983
Randomforest	99.8	99.8	91.3	99.8	99.8	99.7	0.009
SVM	88.4	89.7	88.4	87.9	81.2	75.9	0.311
Logistic regression	78.0	78.3	78.0	78.1	76.3	53.7	0.539

On the other hand, the SVM model didn’t perform well because the model tries to find a decision boundary that best separate two classes. Most of the features are correlated. Therefore, in trying to achieve good accuracy, it can suffer the problem of overfitting. Additionally, the hyper parameters of SVM if not precisely defined affects its performance. Hence, accounts for the low performance with Accuracy of 88.4%, precision 89.7%, recall of 88.4%, F1 score of 87.9%, specificity of 81.2%, MCC of 75.9 and logistic loss of 0.311.

From Table 5, SVM appears to be more computationally intensives it has the highest training time of 23.7second followed by Random Forest 1.707. The algorithm with the lowest training time is NB, which means is its less computationally expensive followed by logistic regression and KNN.

Table 5

Training times of different ML algorithms
Model	Training time (Seconds)
NB	0.452
kNN	0.96
Random forest	1.707
SVM	23.7
Logistic regression	0.657

This study investigated the performance of five Machine learning techniques for DDOS attack detection in SDN. The SDN data set was used to train the five model with 10-fold cross validation test. It can be seen that different model yielded different results with varying training times. Naive Bayes appears to have the lowest training time compared to other algorithms while random forest appears to perform better than other three models.

SVM and LR regression appears to perform lower than other Algorithm with SVM recording the highest training time. Consequently, there is a need to find a way and means to optimized the performance of both SVM and LR and also reduce SVM training time. As a future work, the different mean of improving the two models’ performance shall be investigated.

Author Contribution

A.A.W wrote the main manuscript and figures. All authors reviewed the manuscript.

☒ The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

☐ The authors declare the following financial interests/personal relationships which may be considered as potential competing interests:

Abdullahi Wabi, Aishatu; Ismaila, Idris; Olayemi Mikail, Olaniyi (2023), “DDOS ATTACKS DATASET FOR SOFTWARE DEFINED NETWORK”, Mendeley Data, V1, doi: 10.17632/x6vr3sdm75.1.
Ahuja, N., Singal, G., Mukhopadhyay, D., & Kumar, N. (2021). Journal of Network and Computer Applications Automated DDOS attack detection in software defined networking. Journal of Network and Computer Applications, 187(November 2020), 103108. https://doi.org/10.1016/j.jnca.2021.103108
Ali, R. M., & Bashi, K. (2020). Towards sFlow and adaptive polling sampling for deep learning based DDoS detection in SDN. https://doi.org/10.1016/j.future.2019.10.015
Ali, T. E., Chong, Y. W., & Manickam, S. (2023). Comparison of ML/DL Approaches for Detecting DDoS Attacks in SDN. Applied Sciences (Switzerland), 13(5). https://doi.org/10.3390/app13053033
Alubaidan, H., Alzaher, R., AlQhatani, M., & Mohammed, R. (2023). DDoS Detection in Software-Defined Network (SDN) Using Machine Learning. International Journal on Cybernetics & Informatics, 12(04), 93–104. https://doi.org/10.5121/ijci.2023.120408
Archer, K. J., & Lemeshow, S. (2006). Goodness-of-fit test for a logistic regression model fitted using survey sample data. Stata Journal, 6(1), 97–105. https://doi.org/10.1177/1536867x0600600106
Assis, M. V. O. De, Carvalho, L. F., Rodrigues, J. J. P. C., Lloret, J., & Proença, M. L. (2020). Near real-time security system applied to SDN environments in IoT networks using convolutional neural network R. Computers and Electrical Engineering, 86, 106738. https://doi.org/10.1016/j.compeleceng.2020.106738
Cabaj, K., Wytrębowicz, J., Kukliński, S., Radziszewski, P., & Dinh, K. T. (2014). SDN Architecture Impact on Network Security. Position Papers of the 2014 Federated Conference on Computer Science and Information Systems, 3, 143–148. https://doi.org/10.15439/2014F473
Conti, M., & Gangwal, A. (2019). A Comprehensive and Effective Mechanism for DDoS Detection in SDN. October 2017. https://doi.org/10.1109/WiMOB.2017.8115796
Dayal, N., Maity, P., Srivastava, S., & Khondoker, R. (2017). Research Trends in Security and DDoS in SDN. 1(February), 6386–6411. https://doi.org/10.1002/sec
Hafizah, S., Ariffin, S., Muazzah, N., Latiff, A., Khairi, M. H. H., Ariffin, S. H. S., Latiff, N. M. A., Abdullah, A. S., & Hassan, M. K. (2018). A Review of Anomaly Detection Techniques and Distributed Denial of Service (DDoS) on Software Defined Network (SDN). Technology & Applied Science Research, 8(2), 2724–2730. https://www.researchgate.net/publication/324830666
Kaur, G., & Gupta, P. (2019). Hybrid Approach for detecting DDOS Attacks in Software Defined Networks. 2019 Twelfth International Conference on Contemporary Computing (IC3), 1–6.
Makuvaza, A., Singh, D., & Attlee, J. (2021). Deep Neural Network ( DNN ) Solution for Real ‑ time Detection of Distributed Denial of Service ( DDoS ) Attacks in Software Defined Networks ( SDNs ). SN Computer Science, 2(2), 1–10. https://doi.org/10.1007/s42979-021-00467-1
Manurung, J., Mawengkang, H., & Zamzami, E. (2017). Optimizing Support Vector Machine Parameters with Genetic Algorithm for Credit Risk Assessment. Journal of Physics: Conference Series, 930(1). https://doi.org/10.1088/1742-6596/930/1/012026
Meti, N., Narayan, D. G., & Baligar, V. P. (2017). Detection of distributed denial of service attacks using machine learning algorithms in software defined networks. 2017 International Conference on Advances in Computing, Communications and Informatics, ICACCI 2017, 2017-Janua, 1366–1371. https://doi.org/10.1109/ICACCI.2017.8126031
Mohammed, S. S., Hussain, R., Senko, O., Bimaganbetov, B., & Lee, J. (2018). A New Machine Learning-based Collaborative DDoS Mitigation Mechanism in Software-Defined Network. 2018 14th International Conference on Wireless and Mobile Computing, Networking and Communications (WiMob), 1–8.
Myint Oo, M., Kamolphiwong, S., Kamolphiwong, T., & Vasupongayya, S. (2019). Advanced Support Vector Machine-(ASVM-) based detection for Distributed Denial of Service (DDoS) attack on Software Defined Networking (SDN). Journal of Computer Networks and Communications, 2019. https://doi.org/10.1155/2019/8012568
Phan, T. V., Van Toan, T., Van Tuyen, D., Huong, T. T., & Thanh, N. H. (2016). OpenFlowSIA: An optimized protection scheme for software-defined networks from flooding attacks. 2016 IEEE 6th International Conference on Communications and Electronics, IEEE ICCE 2016, 13–18. https://doi.org/10.1109/CCE.2016.7562606
Polat, H., & Polat, O. (2020). Detecting DDoS Attacks in Software-Defined Networks Through Feature Selection Methods and Machine Learning Models.
Raghunath, K., & Krishnan, P. (2018). Towards A Secure SDN Architecture. 2018 9th International Conference on Computing, Communication and Networking Technologies, ICCCNT 2018, 1–7. https://doi.org/10.1109/ICCCNT.2018.8494043.
Sahoo, K. S., Tripathy, B. K., Naik, K., Member, S., & Ramasubbareddy, S. (2020). An Evolutionary SVM Model for DDOS Attack Detection in Software Defined Networks. 8. https://doi.org/10.1109/ACCESS.2020.3009733.
Sangodoyin, A. O., & Akinsolu, M. O. (2021). Detection and Classification of DDoS Flooding Attacks on Software-Defined Networks : A Case Study for the Application of Machine Learning. IEEE Access, 9, 122495–122508. https://doi.org/10.1109/ACCESS.2021.3109490.
Santos, R., Souza, D., Santo, W., Ribeiro, A., & Moreno, E. (2020). Machine learning algorithms to detect DDoS attacks in SDN. Concurrency and Computation: Practice and Experience, 32(16), e5402. https://doi.org/https://doi.org/10.1002/cpe.5402.
Shaik, A. B., & Srinivasan, S. (2019). A brief survey on random forest ensembles in classification model. In Lecture Notes in Networks and Systems (Vol. 56). Springer Singapore. https://doi.org/10.1007/978-981-13-2354-6_27
Uddin, S., Haque, I., Lu, H., Moni, M. A., & Gide, E. (2022). Comparative performance analysis of K ‑ nearest neighbour ( KNN ) algorithm and its different variants for disease prediction. Scientific Reports, 1–11. https://doi.org/10.1038/s41598-022-10358-x
Wang, S., Fernando, J., Gomez, K., Al-hourani, A., Kandeepan, S., Rizwan, M., & Russello, G. (2022). Engineering Science and Technology , an International Journal Detecting flooding DDoS attacks in software defined networks using supervised learning techniques. Engineering Science and Technology, an International Journal, 35, 101176. https://doi.org/10.1016/j.jestch.2022.101176.
Xie, J., Richard Yu, F., Huang, T., Xie, R., Liu, J., Wang, C., & Liu, Y. (2019). A survey of machine learning techniques applied to software defined networking (SDN): Research issues and challenges. IEEE Communications Surveys and Tutorials, 21(1), 393–430. https://doi.org/10.1109/COMST.2018.2866942.
Ye, J., Cheng, X., Zhu, J., Feng, L., & Song, L. (2018). A DDoS Attack Detection Method Based on SVM in Software Defined Network. Security and Communication Networks, 2018. https://doi.org/10.1155/2018/9804061.
Yu, J., Zhu, L., Qin, R., Zhang, Z., Li, L., & Huang, T. (2021). Combining k-means clustering and random forest to evaluate the gas content of coalbed bed methane reservoirs. Geofluids, 2021. https://doi.org/10.1155/2021/9321565

No competing interests reported.

Download PDF

Version 1

posted

You are reading this latest preprint version

Performance Evaluation of Machine Learning Approaches for Classification of Ddos Attacks in Software Defined

Status:

Version 1

Abstract

Figures

1. INTRODUCTION

2. LITERATURE REVIEW

2.1 Machine learning techniques used

2.3 Performance Evaluation metrics

3. IMPLEMENTATION

3.1 DATASET

4. RESULT DISCUSSION

5. CONCLUSION/FUTURE WORK

Declarations

Author Contribution

References

Additional Declarations

Status:

Version 1