Addressing Spoofed DDoS Attacks in Software-defined Networking

Software-defined networking (SDN) has become a popular networking paradigm that provides a separation of control plane from the data plane devices. This separation offers various facilities such as flexibility, programmability, and a centralized global view of the complete network. However, SDN introduces various cyber-attacks due to its architectural design. In the present scenario, Distributed denial-of-service (DDoS) is one of the most severe attacks that makes the resources unavailable for normal users. Attackers use spoofed IPs in the DDoS attack and hide their original identity, which making it difficult to mitigate the impacts of such kind of DDoS attacks. An spoofed DDoS attack in SDN can affect all three important entities, such as switch, controller, and switch-controller channel. Therefore, in this work, we propose an statistical measure - z-score based mechanism against spoofed flooding DDoS attack (TCP-SYN) for attack detection. The proposed mechanism also mitigates the impacts of the attacks and avoids any additional communication between switches and controller. The performance results show that the proposed attack defense mechanism mitigates the spoofed TCP-SYN flooding attack efficiently and reduces the CPU usage on the victim host after attack detection.