Detection and prevention of Slow-rate DDoS attacks on P4-based software defined networks using machine learning techniques

Detection and prevention of Slow-rate DDoS attacks on P4-based software defined networks using machine learning techniques


Detection and prevention of Slow-rate DDoS attacks on P4-based software defined networks using machine learning techniques

نوع: Type: thesis

مقطع: Segment: masters

عنوان: Title: Detection and prevention of Slow-rate DDoS attacks on P4-based software defined networks using machine learning techniques

ارائه دهنده: Provider: Reza Fallahi Kapourchaali

اساتید راهنما: Supervisors: Dr. Reza Mohammadi, Dr. Mohammad Nassiri

اساتید مشاور: Advisory Professors:

اساتید ممتحن یا داور: Examining professors or referees: Dr. Hassan Khotanlou, Dr. Muharram Mansoorizadeh

زمان و تاریخ ارائه: Time and date of presentation: February 19, 2023, 12:00 PM

مکان ارائه: Place of presentation: Amphitheater Hall of Technical Engineering Faculty

چکیده: Abstract: SDN architecture has become popular nowdays due to it's separation of control plane from data plane. The abstract view resulted from this separation, has made this network architecture more flexible in terms of network function virtualization. Due to the abstract view, resulted from separation of control plane from data plane, the dataplane consists of fixed-function deviceswith limited processing power, therefore most of the processes will be on controller. The controller is the central processing unit in this architecture and this feature has made SDN a great target to DDoS attacks. DDoS attacks aim to overload a system resources in order to prevent them from providing services to their customers. One of the most dangerous DDoS attacks are slow-rate DDoS attacks, which mostly aim web servers with legitimate but slow or partial requests. Over the few past decades, many researchers has proposed various DDoS detection methods with great results. But the proposed methods will have less effect with daily growing complexity of traffics and attacks, therefore researchers aimed to utilize the data plane processing power, and the results were various software or hardware methods. P4 is one of most effective technologies produced in this way. With implementation of P4 data planes, P4 target can be useful in detection of DDoS attacks and introducing new detection techniques, resulting in lower controller processing and bandwidth overhead. In this research, along with analyzing different modules of a detection system, we proposed a detection model that utilizes machine learning techniques along with implementation of P4 switches to detect slow-rate DDoS attacks on SDN. The proposed model has been analyzed in terms of detection time, bandwidth consumption and CPU overhead in controller. The results shows about 60 seconds improvement in detection time and about less than 50% overhead on bandwidth consumption and CPU utilization. The results show that implementation of P4 data plane will have significant effects on detection of slow-rate DDoS attacks in SDN.

فایل: ّFile: