Self-organizing map-based approaches in DDoS flooding detection using SDN

Abstract

Distributed Denial of Service (DDoS) attack is one of the most long-lasting problems in network security. Recently, although the DDoS attack mechanisms are widely understood, the problems are becoming more frequent due to the similarity between DDoS attack and normal traffic. In this work, we propose two approaches of DDoS attack detection which are based on the Self-Organizing Map (SOM). The proposed algorithms with their detection architecture are implemented in the Software-Defined Networking (SDN) technology which has the flexibility and programmable abilities. The SDN controller allows us to quickly perform complex classification and detection algorithm. By deploying a testbed environment, we successfully evaluate our proposed algorithms in terms of both accuracy and computational overhead. The experimental results show that these algorithms can reduce the processing time while maintain the suitable accuracy rate.