Day 14: Reviewing DDoS Attack detection method using SVM in SDN network

Hey guys, as promised yesterday, let's review a recent work on DDoS attack detection method using Support Vector Machines (SVM) today.

This paper beautifully describes how SDN flows can be used to build a feature set to train SVM model to detect a DDoS attack. Kudos to the authors!
Jin Ye, Xiangyang Cheng, Jian Zhu, Luting Feng, and Ling Song, “A DDoS Attack Detection Method Based on SVM in Software Defined Network,” Security and Communication Networks, vol. 2018, Article ID 9804061, 8 pages, 2018. https://doi.org/10.1155/2018/9804061


Let's start by understanding the contents of a flow. The diagram below is a good flow structure representation.

Next, a six-tuple characteristic values matrix containing the following features is built.
In all the features T is the sample interval.

• The speed of source IP (SSIP) is the number of source IP addresses per unit of time:If SSIP is large, more likely it is an attack.
• The speed of source port (SSP) is the number of attack source ports per unit of timeIf SSP is large, more likely that it is an attack.
• The Standard Deviation of Flow Packets (SDFP), that is, the standard deviation of the number of packets in the  period, is as follows:where  represent the average number of the packets in the  period.  is the total number of flow entries per period, in the event of an attack; in order to produce the attack effect, since entropy decreases, SDFP also decreases.
• The Deviation of Flow Bytes (SDFB), that is, the standard deviation of the number of bits in the  period, is as follows:where , represent the average of the number of bits in the  period. In the event of an attack, in order to reduce the packet load, attacker will send a smaller bit of data packets and the standard deviation flow bits will be smaller than the normal flow.
• The speed of flow entries (SFE), that is, the number of flow entries per unit time, is as follows:

SFE dramatically increases when an attack occurs.

• The Ratio of Pair-Flow (RPF), that is, the ratio of interactive flow entries to total flow entries, is as follows:where  is the number of interactive flow entries. i.e The server responds back to the client. When an attack occurs, the flow entries sent to the destination host in a  period increase sharply, the destination host cannot respond to the interactive flow in time, and in general the attacker typically uses massive pseudo-source addresses when attacking, so the number of interactive flow entries per will drop in the  period.

So, the above features make up the feature-set for training SVM model. SVM works well even with lesser data, and it is indeed a good classifier.

The network topology for testing the model employed by the authors

In the experiment, the normal traffic is composed of three basic communication kinds of traffic (TCP, UDP, and ICMP) and the attack traffic consists of three separate types of attack traffic: TCP, UDP, and ICMP. So, the metrics used for measuring the performance of the model are Detection rate and False alarm rate given by the following formula.

The performance of the attack detection is displayed by the detection rate (DR) and false alarm rate (FAR); the formulas are calculated as the values:In this formula,  indicates that the attack flow is detected as an attack flow, and  means that the attack flow is detected as a normal flow.In the formula,  means that the normal flow is detected as an attack flow, and  indicates that the normal flow is detected as a normal flow.

A good detection rate and lower false alarm rate was obtained by the authors.

From my perspective, 

What could be added to this paper is the concept of making the model real time and scalable so that it can be incorporated into the real SDN network.

That's it for today folks! Tomorrow lets study some architectures to make the model real time and scalable!