Lightweight DDoS flooding attack detection using NOX/OpenFlow

Authors:
Braga, Rodrigo Braga;Mota, Edjard Mota;Passito, Alexandre Passito
Affiliations:
Departamento de Ciência da Computação, Universidade Federal do Amazonas, Av. Rodrigo Octavio, 3000 - 69077-000 - Brazil;Departamento de Ciência da Computação, Universidade Federal do Amazonas, Av. Rodrigo Octavio, 3000 - 69077-000 - Brazil;Departamento de Ciência da Computação, Universidade Federal do Amazonas, Av. Rodrigo Octavio, 3000 - 69077-000 - Brazil
Venue:
LCN '10 Proceedings of the 2010 IEEE 35th Conference on Local Computer Networks
Year:
2010

Citing 0
Cited 4

Modeling and performance evaluation of an OpenFlow architecture

Proceedings of the 23rd International Teletraffic Congress
Classification of UDP traffic for DDoS detection

LEET'12 Proceedings of the 5th USENIX conference on Large-Scale Exploits and Emergent Threats
AVANT-GUARD: scalable and vigilant switch flow management in software-defined networks

Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments

Computer Networks: The International Journal of Computer and Telecommunications Networking

Quantified Score

Hi-index	0.00

Visualization

Abstract

Distributed denial-of-service (DDoS) attacks became one of the main Internet security problems over the last decade, threatening public web servers in particular. Although the DDoS mechanism is widely understood, its detection is a very hard task because of the similarities between normal traffic and useless packets, sent by compromised hosts to their victims. This work presents a lightweight method for DDoS attack detection based on traffic flow features, in which the extraction of such information is made with a very low overhead compared to traditional approaches. This is possible due to the use of the NOX platform which provides a programmatic interface to facilitate the handling of switch information. Other major contributions include the high rate of detection and very low rate of false alarms obtained by flow analysis using Self Organizing Maps.