Abstract:

Distributed denial of service (DDoS) attacks have always been a major threat to Internet. In SDN network, it will lead to the exhaustion of controller resources and affect the normal operation of the entire network. Aiming at mitigating DDoS attacks in SDN network, a two-stage attack detection and defense method is designed and implemented, which firstly collects flow data based on the controller's northbound interface to extract direct and derived features, and uses sequential probability ratio test (SPRT) and light gradient boosting machine (LightGBM) to locate attacks quickly and differentiate attack types accurately, at last filters the attack traffic in real time by installing flow rules. Experimental results show that this attack detection method can quickly locate the attack port and classify the attack traffic which accuracy reaches to 98%, and attack defense method can install defense flow rules in time to filter the attack traffic within 2 s after attack happens to protect the safety of SDN network effectively.

Key words: software defined network, distributed denial of service attack, sequential probability ratio test, light gradient boosting machine