SDN-based In-Band DDoS Detection Using Ensemble Learning Algorithm on IoT Edge

Software-Defined Networking (SDN) has introduced ways to detect and manage potential vulnerabilities in Internet-of-Things (IoT) networks. On the IoT Edge, when the Edge servers may be vulnerable to attacks like Distributed Denial of Service (DDoS), fast feature extraction and attack detection are vital for timely mitigation. The capabilities for attack detection in SDN networks, however, are limited by the latency imposed by feature collection and extraction from the control plane. In this paper, we present a DDoS detection method by deploying programmable switches on the IoT Edge. Programmable switches can perform flexible feature collection and extraction directly in the data plane, allowing in-band feature processing. With such an in-band scheme and applying and comparing three Ensemble Learning models, the system can achieve a detection time within tens of milliseconds at an accuracy above 94% and a low False Positive Rate (FPR) of 0.002, while minimizing the impact on CPU usage.