Detection and Mitigation of DDoS Attacks in SDN Using Machine Learning (ML)

The Software Defined Network (SDN) is a new network paradigm that has been growing in recent years because of its flexibility and ease in managing and operating computer networks. In SDN one of the advantages is the separation of the data plane from the control plane, unlike the traditional network where the data plane and the control plane are integrated together in the same device. However, SDN is facing a severe security issue today. One of the biggest threats to SDN security is distributed denial of service (DDoS). These DDoS attacks can take place across all SDN layers and communication channels. Several techniques are used for the detection, prevention, and mitigation of DDoS attacks in SDN in general but more specifically on the controller. However, one of the most popular techniques used in recent years to detect DDoS attacks is machine learning. It is in this context that we will use supervised Machine Learning algorithms such as K-Nearest Neighbors (K-NN), Support Vector Machine (SVM), and Naive Bayes (NB). These algorithms will be trained on the CIC-2019 dataset. Finally, a real-time SDN simulation environment composed of Mininet, Ryu controller, and SNORT NIDS is used to evaluate the effectiveness of these algorithms. Once the attack is detected, the attacker's IP address and port number are blocked and recorded in a blacklist for mitigation.