A Two-level DDoS attack Detection using Entropy and Machine Learning in SDN

Software Defined Networking (SDN) separates the control plane from the data plane and has evolved into the next generation of internet architecture because of programmability and flexibility. This enables the centralized controller to completely control the entire network. Since the control plane is centralized, it is more prone to attacks. Distributed Denial of Service (DDoS) attack is one of the primary SDN attacks. In DDoS, a malicious attacker attempts to interrupt services by overwhelming the target network with malicious internet traffic. The resources of the impacted server, such as bandwidth and buffer size, are reduced that leads to the unavailability of resources to legitimate clients. In this work, we propose a new two-level approach for the detection of DDoS attacks using a faster entropy method on flow-based analysis and machine learning techniques for classification. Initially, entropy method is used to identify the malicious nodes. Later, the machine learning algorithms like Na¨ıve Bayes, support vector machine, and random forest are used to detect attacks. We use Mininet emulator with POX controller to implement the proposed work. The results reveal that random forest has a better accuracy of 98.3% compared to the remaining algorithms. Furthermore, the proposed two-level approach reduces the false positive rate.