A DDoS attack detection method based on time series and random forest in SDN

Since the decision and forwarding function are not coupled together in SDN, the network service configuration and deployment of SDN are more flexible than traditional networks. However, a DDoS attack can consume a lot of resources of controller, thereby paralyzing the entire network service. To solve this problem, a DDoS attack detection method based on time series and random forest (RF) in SDN is proposed. The detection method first uses the ARIMA model to predict the current flow information based on the historical information entropy. If the predicted value differs significantly from the actual situation, the detailed traffic features are further extracted. Finally, the RF algorithm is used to detect whether the SDN is attacked by DDoS. Experimental results show that this detection method has better detection performance than SVM, XGBoost, RF, and KNN algorithms.