Performance Evaluation of SDN DDoS Attack Detection and Mitigation Based Random Forest and K-Nearest Neighbors Machine Learning Algorithms

SDN design aims to address the shortcomings of the existing traditional network architecture through a new architectural design that is based on the decoupling of the control plane from the data plane, allowing the controller to be directly programmable and have full management. So, the SDN environment provides great reliability, simplicity, and flexibility for network management [1]. But SDN poses additional security issues due to the centralized controller, which is a vulnerable point that attackers target.

One of the most common attacks on SDN networks is the Distributed Denial of Service (DDoS) attack. This attack aims to make network services unavailable to legitimate users by sending large amounts of malicious traffic to exhaust the network resources. It launches his attack by taking control of several compromised hosts and making them part of a network called a botnet [2, 3]. This attack should be detected early before bringing the entire network down by causing damage to the controller. So, SDN should be equipped with efficient detection and mitigation techniques to ensure the safety of its resources and data in the face of various DDoS attacks.

Several detection techniques have been used to defend the SDN network against DDoS attack: entropy, machine learning algorithm, Traffic pattern analysis, intrusion detection system (IDS) like SNORT [4]. Machine Learning (ML) is mainly a classifier that classifies network traffic into normal and attacks. First, it builds a classifier model based on sample data called the training data set. Then, it tests the model in order to make predictions [5, 6]. There are many mitigation techniques provided through the use of OpenFlow protocol in SDN networks: drop packets, block port, redirection, control bandwidth, deep packet inspection, network reconfiguration, and topology change; each solution has its advantages and disadvantages [7]. The most fast and simple mitigation technique is the drop packet and the block ports. They completely block the attack sources, which may result in dropping the legitimate traffic if the legitimate host is compromised or in the case of a false alarm. So, a timeout is added to the blocking rule to ensure a non-permanent block for a real user in this work.

In this context, this paper presents a DDoS attack detection and mitigation technique in an SDN environment using two machine learning algorithms. The main contributions of this paper can be summarized as follow:

• Apply machine learning algorithms on three testing environments: single, linear with one controller, and linear with multi-controller SDN networks.
• Generate SDN dataset using Mininet emulator for each scenario.
• Evaluate and compare four different ML algorithms (RF, KNN, NB, LR) accuracy.
• Implement a machine learning model to detect DDoS attacks. Two ML algorithms have been selected: RF and KNN.
• Implement attack mitigation technique in both algorithm types.

The rest of this paper is organized as follow: in section 2, a related work for DDoS detection techniques based on machine learning in SDN are introduced. In section 3, a theoretical background of the machine learning techniques is discussed. Section 4 presents the proposed algorithms implementation and environment setup. Section 5 shows the results and discussion. Finally, a conclusion introduced in section 6.

Machine learning algorithms be divided into four categories: supervised, unsupervised, semi-supervised, and reinforcement learning. Table 2 explains the main differences between them. In supervised learning algorithms, the input is combined with a label that represents a classification class and during the testing phase, the machine predicts the class of that input data based on the training sample. This is called supervised because we pre-trained the model on a known classed training sample [16]. In this work the supervised learning has been used since the generated data is labeled to 1 and 0 to indicate a normal or attack flow.

Table 2. Machine learning techniques

Next is a further explanation of some of the supervised algorithms that have been used in this work:

Random Forest (RF): Also known as a random decision forest, because it is constructs from many decision trees (forest). It is one of the popular supervised learning algorithms that used both in classification and regression problems. The accuracy of the algorithm depends on the number of trees used [17]. To build the final decision about the new unclassified sample each decision tree will make a vote about this sample and the final prediction is the class with the most votes among the tree outputs.

K-nearest neighbor (KNN): It is a simple, easy-to-implement supervised machine learning algorithm that can be used to solve both classification and regression problems. It assumes the similarity between the new case/data and available cases and put the new case into the category that is most similar to the available categories [18].

Naive Bayes (NB): It is one of the simplest supervised ML algorithms that used to solve the classification problem. It based on the Bayes theorem that uses conditional probability to describe the relationship between statistical quantities. Bayes theorem uses conditional probability of an event which based on the assumption that predictors or input features are independent to each other [19].

Logistic Regression (LR): it is a supervised ML algorithm used for the classification problem based on the logistic function or sigmoid function which is a mathematical function used to map the predicted values to probabilities and have value between 0 and 1, different from linear function that is used in linear regression that can gives value above 1 or below 0 [20]. Logistic regression uses a threshold value, so as values above the threshold tends to 1, and a value below the threshold tends to 0.

Table 6. Simulation results of RF and KNN models

Test metrics	RF			KNN
	single	linear	2-controller	single	linear	2-controller
Normal Tx packet	580	580	480	580	480	480
Normal Rx packet	416	577	418	351	480	450
Packet loss	28%	0%	12%	39%	0%	6%
Attack Tx packet	34487300	26242144	24647452	33910143	24104797	25092838
Detection time	12	5	3	10	5	3
*Max. Mitigation time	22/32/48	8/11/10	5/7/4	14/12/58	9/10/8	6/4/6
*Target max. Packet rate during attack	2425/6344/6313	314/183/184	220/276/244	2394/5092/8605	178/185/212	224/227/295

*The values (x/x/x) are for the three attack strikes.

10a.png

(a) Target packets rate

10b.png

(b) Ryu controller packets rate

Figure 10. System results in single topology during detection and mitigation of DDoS attack using RF and KNN classifiers

11a.png

(a) Target packets rate

11b.png

(b) Ryu controller packets rate

Figure 11. System results in linear topology during detection and mitigation of DDoS attack using RF and KNN classifiers

12a.png

(a) Target packets rate

12b.png

(b) Ryu controller packets rate

Figure 12. System results in multi-controller linear topology during detection and mitigation of DDoS attack using RF

13.png

Figure 13. Detection time for all tests

We can observe that:

• There is a high packet loss at the single topology (28 % at RF, 39% at KNN).
• The mitigation time is high and not stable in single topology as shown in Figure 10. However, in linear and multi-controller topologies it is lower and optimum as shows in Figures 11 and 12.
• No packet loss in linear topology and a little loss in multi-controllers.
• The target exposed to a high packet rate during attack strikes in single topology reach up to 6300 packets during RF test and up to 8600 packets during KNN test, which is very high traffic that saturate target resources and caused a packet loss for legitimate traffic.
• The packet loss in the multi-controller topology is due to the 30-second port blocking between the two domains during the attack and not because of the classifier efficiency.
• Detection time is low and the single topology has the maximum detection time (12 sec.) as shown in Figure 13.

From observing the target and controller traffic we can find that the packets per second are significantly increased during the launch of DDoS attack, and it is mostly affecting the controller traffic because since the source addresses of the attack are spoofed random IPs, the switch will forward all them. When mitigation started, the target will return to the normal traffic faster than the controller does.