ORCID Identifiers
Document Type
Article
Source of Publication
Sustainability (Switzerland)
Publication Date
2-1-2021
Abstract
In modern network infrastructure, Distributed Denial of Service (DDoS) attacks are considered as severe network security threats. For conventional network security tools it is extremely difficult to distinguish between the higher traffic volume of a DDoS attack and large number of legitimate users accessing a targeted network service or a resource. Although these attacks have been widely studied, there are few works which collect and analyse truly representative characteristics of DDoS traffic. The current research mostly focuses on DDoS detection and mitigation with predefined DDoS data-sets which are often hard to generalise for various network services and legitimate users’ traffic patterns. In order to deal with considerably large DDoS traffic flow in a Software Defined Networking (SDN), in this work we proposed a fast and an effective entropy-based DDoS detection. We deployed generalised entropy calculation by combining Shannon and Renyi entropy to identify distributed features of DDoS traffic—it also helped SDN controller to effectively deal with heavy malicious traffic. To lower down the network traffic overhead, we collected data-plane traffic with signature-based Snort detection. We then analysed the collected traffic for entropy-based features to improve the detection accuracy of deep learning models: Stacked Auto Encoder (SAE) and Convolutional Neural Network (CNN). This work also investigated the trade-off between SAE and CNN classifiers by using accuracy and false-positive results. Quantitative results demonstrated SAE achieved relatively higher detection accuracy of 94% with only 6% of false-positive alerts, whereas the CNN classifier achieved an average accuracy of 93%.
DOI Link
ISSN
Publisher
MDPI AG
Volume
13
Last Page
27
Disciplines
Electrical and Computer Engineering
Keywords
Distributed denial of service (DDoS), Entropy, Intrusion detection system, Software defined network (SDN)
Scopus ID
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 International License.
Recommended Citation
Ujjan, Raja Majid Ali; Pervez, Zeeshan; Dahal, Keshav; Khan, Wajahat Ali; Khattak, Asad Masood; and Hayat, Bashir, "Entropy based features distribution for anti-ddos model in SDN" (2021). All Works. 1517.
https://zuscholars.zu.ac.ae/works/1517
Indexed in Scopus
yes
Open Access
yes
Open Access Type
Gold: This publication is openly available in an open access journal/series