DDoS attack detection method based on improved convolutional long short-term memory and three-way decision in SDN.

Area of Science:

• Computer Science
• Network Security
• Artificial Intelligence

Background:

• Software Defined Networking (SDN) architecture separates control and data planes, creating vulnerabilities for Distributed Denial of Service (DDoS) attacks.
• Existing methods struggle with effective feature extraction in SDN environments, impacting DDoS attack detection accuracy.

Purpose of the Study:

• To propose a novel method, ConvLSTM-MHA-TWD, for accurate and efficient detection of DDoS attacks in SDN.
• To enhance feature extraction and classification capabilities for improved network security.

Main Methods:

• Utilizes Convolutional Long Short-Term Memory Network (ConvLSTM) for data feature extraction.
• Employs a Multi-Head Attention (MHA) mechanism to capture long-distance dependencies and construct multi-granularity feature spaces.
• Integrates residual connections between ConvLSTM and MHA outputs to improve feature extraction and temporal modeling.
• Applies Three-Way Decision (TWD) theory for immediate and delayed decision-making on network behaviors.

Main Results:

• Achieved high accuracy rates of 0.994 on the CICIDS2017 dataset and 0.977 on the DDoS SDN dataset.
• Demonstrated superior overall performance compared to existing methods in DDoS attack detection.
• The proposed method effectively addresses gradient disappearance issues during training.

Conclusions:

• ConvLSTM-MHA-TWD offers a robust and accurate solution for DDoS attack detection in SDN environments.
• The method's enhanced feature extraction and decision-making capabilities make it suitable for large-scale data training.
• This research contributes to improving the security and reliability of SDN infrastructure.