APATCP: programmable multi-controller framework for real-time detection and mitigation of complex TCP flooding...

Area of Science:

• Cybersecurity
• Network Security
• Internet of Things (IoT)

Background:

• The Internet of Things (IoT) faces escalating Distributed Denial-of-Service (DDoS) threats, particularly TCP flooding attacks that exploit protocol vulnerabilities.
• Existing Software-Defined Networking (SDN) defenses struggle with scalability, controller overhead, and adaptability to dynamic traffic patterns.
• Constrained IoT devices are particularly vulnerable to service disruption and resource exhaustion from sophisticated network attacks.

Purpose of the Study:

• To propose APATCP, a P4-enabled, multi-controller SDN framework for real-time adaptive detection and mitigation of TCP flooding in IoT environments.
• To enhance the resilience and security of Software-Defined Internet of Things (SD-IoT) infrastructures against advanced network threats.
• To develop a scalable and resource-efficient solution for defending against complex and evolving TCP flooding attack vectors.

Main Methods:

• Integration of four coordinated modules: ACID for decentralized intelligence, DTAM for adaptive thresholding, DTAC for P4-extracted feature classification, and FlowGuard-AP for context-aware mitigation.
• Leveraging 24 P4-extracted features and an adaptive weighted ensemble classifier for accurate multi-type attack classification.
• Evaluation using three IoT-centric datasets (CICIoT2024, Edge-IIoTset, ToN_IoT) and live network emulations under high attack rates.

Main Results:

• APATCP achieved high performance metrics, including 99.3-99.98% accuracy, 98.2-99.5% recall, and F1-scores up to 99.2%, with a false positive rate as low as 0.4%.
• Outperformed baseline models like LightGBM and XGBoost in both binary and multi-class (eight adversarial scenarios) evaluations, maintaining >98% accuracy.
• Demonstrated resilience in live emulations (>100k packets/s attack rates) with low CPU load (<30%), minimal packet loss (<2%), and rapid throughput restoration (>95% within seconds).

Conclusions:

• APATCP presents a scalable, adaptive, and resource-efficient framework for defending SD-IoT infrastructures against sophisticated TCP flooding threats.
• The proposed system offers high detection accuracy, low overhead, and robust mitigation capabilities, ensuring reliable network service.
• The P4-enabled, multi-controller architecture provides a promising direction for next-generation network security in the expanding IoT landscape.