HLD-DDoSDN: High and low-rates dataset-based DDoS attacks against SDN.

Area of Science:

• Computer Science
• Network Security

Background:

• Software Defined Networks (SDN) offer flexibility but are vulnerable to Distributed Denial of Service (DDoS) attacks targeting the controller.
• Existing detection methods lack evaluation on realistic datasets and struggle with high-rate DDoS attacks.

Purpose of the Study:

• Introduce HLD-DDoSDN, a novel, realistic dataset for evaluating DDoS attack detection in SDN environments.
• Provide a benchmark dataset that includes diverse traffic fluctuations and prevalent attack types.

Main Methods:

• Developed the HLD-DDoSDN dataset, incorporating User Internet Control Message Protocol (ICMP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP) based DDoS attacks.
• Qualitatively compared HLD-DDoSDN with existing SDN datasets and quantitatively evaluated its performance across eight scenarios.
• Utilized a Deep Multilayer Perception (D-MLP) based detection approach to evaluate the dataset's features.

Main Results:

• HLD-DDoSDN demonstrates superiority over existing SDN datasets.
• The dataset features are highly effective for detecting realistic SDN attacks.
• The D-MLP detection approach achieved high accuracy, recall, and precision for both high and low-rate DDoS flooding attacks.

Conclusions:

• HLD-DDoSDN is a comprehensive benchmark dataset crucial for advancing DDoS attack detection in SDN.
• The dataset facilitates the development and validation of robust security mechanisms for SDN controllers.
• Effective detection of various DDoS attack types and rates is achievable with appropriate datasets and detection methods.