Open Access

ARTICLE

Dynamic Threshold-Based Approach to Detect Low-Rate DDoS Attacks on Software-Defined Networking Controller

by Mohammad Adnan Aladaileh, Mohammed Anbar^*, Iznan H. Hasbullah, Abdullah Ahmed Bahashwan, Shadi Al-Sarawn

National Advanced IPv6 Centre of Excellence, Universiti Sains Malaysia, Penang, Malaysia

* Corresponding Author: Mohammed Anbar. Email:

Computers, Materials & Continua 2022, 73(1), 1403-1416. https://doi.org/10.32604/cmc.2022.029369

Received 02 March 2022; Accepted 02 April 2022; Issue published 18 May 2022

Abstract

The emergence of a new network architecture, known as Software Defined Networking (SDN), in the last two decades has overcome some drawbacks of traditional networks in terms of performance, scalability, reliability, security, and network management. However, the SDN is vulnerable to security threats that target its controller, such as low-rate Distributed Denial of Service (DDoS) attacks, The low-rate DDoS attack is one of the most prevalent attacks that poses a severe threat to SDN network security because the controller is a vital architecture component. Therefore, there is an urgent need to propose a detection approach for this type of attack with a high detection rate and low false-positive rates. Thus, this paper proposes an approach to detect low-rate DDoS attacks on the SDN controller by adapting a dynamic threshold. The proposed approach has been evaluated using four simulation scenarios covering a combination of low-rate DDoS attacks against the SDN controller involving (i) a single host attack targeting a single victim; (ii) a single host attack targeting multiple victims; (iii) multiple hosts attack targeting a single victim; and (iv) multiple hosts attack targeting multiple victims. The proposed approach’s average detection rates are 96.65%, 91.83%, 96.17%, and 95.33% for the above scenarios, respectively; and its average false-positive rates are 3.33%, 8.17%, 3.83%, and 4.67% for similar scenarios, respectively. The comparison between the proposed approach and two existing approaches showed that it outperformed them in both categories.

---

Keywords

---