Detection and prevention of slow-rate DDoS attacks on HTTP protocol in P4-based software defined networks using machine learning techniques

SDN architecture has become popular nowadays due to the abstract
view that it provides. Due to the centralized network Controller in SDN, Most
of the processing load is on the controller. This centralized controller has
made this architecture a great target to DDoS attacks. Over the few past
decades, many detection methods has been proposed; but with increased
traffic and complexity of DDoS attacks, researchers aimed to utilize the data
plane processing power. One of the most effective methods that has been
proposed, is the P4 technology. With P4, we can utilize the processing power
of the data plane devices in detection and prevention procedure of DDoS
attacks on SDN; which will result the reduction of controller overhead and
more flexibility data plane devices. In this research, we proposed a detection
and prevention model that utilizes machine learning techniques along with
implementation of P4 switches to detect slow-rate DDoS attacks on SDN. The
ONOS controller has been used for implementation of this model. The goal of
proposing this model, is to use programmable P4 switches in detection
procedure, in order to minimize the controller overhead. The procedure of
extracting feature values for machine learning models, will result processing
overhead for the controller, but with implementing this procedure with P4
switches on data plane and local processing of packets in the switch, the
controller overhead will be minimized. The proposed model has been
analyzed in terms of detection time, bandwidth consumption and CPU
utilization of the controller. In compare to the normal SDN, the results shows
about 60 seconds improvement in detection time, about 50% less overhead
on bandwidth consumption and CPU utilization in proposed method. The
results show that implementation of P4 data plane, with programming the
data plane devices, will have significant effects on detection of slow-rate DDoS
attacks and processing load of the controller in SDN