Discoverymethod for distributed denial-of-service attack behavior inSDNs using a feature-pattern graphmodel

Abstract

The security threats to software-defined networks (SDNs) have become a significant problem, generally because of the open framework of SDNs. Among all the threats, distributed denial-of-service (DDoS) attacks can have a devastating impact on the network. We propose a method to discover DDoS attack behaviors in SDNs using a feature-pattern graph model. The feature-pattern graph model presented employs network patterns as nodes and similarity as weighted links; it can demonstrate not only the traffic header information but also the relationships among all the network patterns. The similarity between nodes is modeled by metric learning and the Mahalanobis distance. The proposed method can discover DDoS attacks using a graph-based neighborhood classification method; it is capable of automatically finding unknown attacks and is scalable by inserting new nodes to the graph model via local or global updates. Experiments on two datasets prove the feasibility of the proposed method for attack behavior discovery and graph update tasks, and demonstrate that the graph-based method to discover DDoS attack behaviors substantially outperforms the methods compared herein.

Keywords

Software-defined network / Distributed denial-of-service (DDoS) / Behavior discovery / Distance metric learning / Feature-pattern graph

RIGHTS & PERMISSIONS

2019 Zhejiang University and Springer-Verlag GmbH Germany, part of Springer Nature