Building DDoS Resilient SDNs Using Hybridised Deep Learning Methods

The explosion in the number of IP-based systems and IoT devices has created significant security and traffic engineering challenges on the Internet. The current Internet architecture is not optimised to handle the unprecedented amounts of traffic generated by these huge amount of interconnected devices as it was designed based on a simple model using an intelligent edge and a dumb core, providing a best effort routing service. The surge in traffic poses several risks and has raised the need for new protocols and approaches to keep the internet manageable and safe. Software-defined networking (SDN) has therefore, emerged as a promising solution for network management. By enabling the separation between the data plane and control plane, SDN overcomes the challenges of traditional networks by providing programmability and dynamism. SDN further introduces intelligent network centralisation to improve routing optimisation. However, because of SDN's centralised architecture, the central controller has became as single point of failure subjecting it to cyber-assaults, DDoS to be specific. In this paper, we proposed a hybrid deep learning model as a solution to detect DDoS attacks on SDNs. The result shows that the proposed LSTM-RNN hybrid model outperformed the single models as well as some existing hybrid models with an accuracy of 99.33% on the CICIDS-2017 dataset. Due to the high dimensionality of network traffic data, and sophisticated attack patterns, detecting malicious traffic with a single classifier is becoming a challenge. Hybrid methods are therefore becoming popular as they can provide better generalization which ultimately leads to improved robustness.

I. Introduction

THE Internet was designed based on a simple model using an intelligent edge and a dumb core providing a best effort routing service that has enabled its expansion to billions of connected devices and resulted in its adoption and popularity. However, the recent increase in the number of connected IP-based systems, including Mobile and Internet of Things (IoT) devices, both generating unprecedented amounts of traffic, has raised the need for the rethinking of its design and the need for new protocols and techniques for keeping with this surge in traffic. Furthermore, the increasing presence of data centers at its core is transforming the Internet into a complex network whose security and traffic engineering are becoming key challenges to be tackled by both the research and practitioner communities. The traditional Internet is based on a routing model where routing devices (routers) host both the controlling plane and the data plane. This has led to traffic engineering issues related, for example, to the load balancing over a network. Software-defined networking (SDN) is an emerging technology in networking that addresses these issues. By enabling the separation between the data plane and control plane, SDN overcomes the challenges of traditional networks by providing programmability and dynamism for efficient network configuration thus improving network performance. Through its features, SDN further introduces network centralisation to increase routing optimisation and intelligence with the aim of increasing the security and reconfiguration of networks.