Evaluation of the Effectiveness Mitigation of Distributed Denial of Service in Software-Defined Networking Using the Nearest Centroid Classification

Software-defined networking (SDN) is a modern approach in computer networking where the control plane and data plane layers are decoupled. The advantage of this separation is that it allows computer networks to be programmed dynamically and facilitates network management. SDN uses the OpenFlow Protocol (OFP), developed by the Open Networking Foundation, to manage the communication between the control and data planes. Like other networks, OFP-based networks pose similar security challenges, such as a Distributed Denial of Service (DDoS) attack. These challenges affect the controller, data plane, and network users in the SDN network. Therefore, an OFP-based network requires a mechanism to identify network traffic. This study implements and evaluates security mechanisms on OFP networks using the Intrusion Detection System (IDS) application running on the SDN controller that leverages traffic flow classification. The machine learning approach is employed to categorize data flows, after which the detected DDoS (Distributed Denial of Service) flows are blocked and obstructed within the data-plane flow table. In classifying the DDoS traffic flow, three extracted features were used based on flow entries arrival, source of IP address changes, and the ratio of pair-flow entries. The experiments were conducted using generated DDoS and normal traffic with exciting results. We centered the experiments using the Nearest Centroid classification method compared to several classification methods. The result shows an accuracy of 85.48% and an F1-Score value of 0.87 on the Nearest Centroid classification. The implemented IDS application on the Ryu-based SDN controller shows the effectiveness of DDoS detection and successful mitigation by being blocked in the data plane.