Detection of DDoS attacks in SDN using Machine Learning

With the growth in network industry, traditional network is being replaced with Software Defined Network. SDN is growing technology, which provides the control of network communication flexible. SDN decouples into three planes namely control plane, data plane and application plane, making it centralized. Due to centralization, the network is cost effective, dynamic and resource management is efficient. Network administrators believes that SDN has a breakthrough in network industry due to programmability and remote accessing while network providers appreciate SDN as it has reduced capital expenditure (CAPEX) and operational expenditure (OPEX). In spite of vast capabilities, the SDN face security issues as it has complex architecture and centralization feature. The SDN introduces network security challenges among which Distributed Denial of Service has devastating effect on the entire network. In SDN, network becomes vulnerable when large number of packets are requested with random IP address. When the packet is not matched in flow entry rules by the switch, packet gets encapsulated in packet_in messages and it passes to controller for instruction and as number of requests increases it will limit the resources and becomes bottleneck for the entire network leading to generation of DDoS attack. It is important to have quick provisional methods to pre vent the switches and controller from breaking down. To resolve this problem, we proposed a machine learning technique which includes Naïve Bayes, Decision tree, k-nearest neighbors, Logistic Regression, and Random Forest for detection of malicious traffic. The experiment outcomes shows that Random Forest and Decision Tree algorithms provides better accuracy and decision rate compared to other algorithms.