DOE-DTL: A ML-Utilized System Combined With PDP for Detection and Mitigation of DLDoS Attack

Software-Defined Network (SDN) revolutionizes traditional network structures by isolating the data plane and the control plane, which offers greater flexibility in managing network resources. Nevertheless, SDN remains vulnerable to certain threats inherited from the traditional network, including Distributed Low-rate Denial-of-Service (DLDoS) attack. This attack is more subtle and harder to detect than traditional Distributed Denial-of-Service (DDoS) attacks, because it employs a lower average attack rate. We design a real-time detection and mitigation system named DOE-DTL specifical for the DLDoS attack in SDN. For the DLDoS attack detection, we utilize Machine-Learning (ML) methods to construct a detection model and introduce it in DOE-DTL. In the construction, we leverage Extreme Learning Machine (ELM) and make a dual optimization using Whale Optimization Algorithm (WOA). For the DLDoS attack mitigation, we use double thresholds to determine the attack sources and make corresponding mitigation rules. DOE-DTL innovatively combines the Programmable Data Plane (PDP) in detection and mitigation, shifting some control plane tasks to the data plane. Performance assessments reveal that DOE-DTL ensures fast, accurate attack identification and low-latency mitigation while maintaining low resource usage.