Design of Ensemble Learning Methods for DDoS Detection in SDN Environment

Abstract

Software Defined Network (SDN) is a new approach to build architecture of computer networks that is dynamic, adaptable, manageable and low cost. The SDN paradigm offers virtualized network services, promoting architecture compatible with the current networks that use infrastructure-hosted services computing. In SDN, switches match for the incoming packets in the flow tables but do not process the packets. Denial of Services (DoS) are attacks in which the network is flooded by a large number of packets sent from machines committed. One class of such attacks is Distributed Denial of Service Attacks (DDoS), where several compromised machines aim simultaneously a target. In this paper, we propose an ensemble technique by adopting different machine learning (ML) algorithms namely K- Nearest Neighbor (KNN), Naive Bayes, Support Vector Machine(SVM) and Self-Organizing Map(SOM) to detect anomalous behavior of the data traffic in the SDN controller. Our experimental results show that the ensemble method in machine learning provides better accuracy, detection rate, false alarm rate than the single learning algorithm.