Integration of Machine Learning for DDoS Attack Detection in SDN

Abstract

Application layer Distributed Denial of Service (DDoS) attacks pose significant threats to network security and service availability. This project addresses these threats by leveraging Software-Defined Networking (SDN) and Deep Learning (DL) technologies. We developed and tested several architectures to tackle these attacks effectively. The first architecture is the 1D-CNN, which excels at capturing spatial features from the traffic data. The second is the LSTM network, designed to capture temporal dependencies and patterns over time. The third is a hybrid CNN-LSTM model, which combines the spatial feature extraction capabil- ities of CNN with the temporal sequence processing strengths of LSTM. Based on the evaluations of these individual architectures, we designed the YOUD ensemble model to combine their strengths. Our custom SDN topology, created using Mininet and the Ryu controller, integrates an Intrusion Detection System (IDS) powered by the YOUD model. This IDS, coupled with a Flask-based application for real-time monitoring, includes an Intrusion Prevention System (IPS) that dynamically blocks malicious IP addresses. The system is trained on an enhanced version of the CICIDS2017 dataset, ensuring a robust, adaptive, and scalable defense mechanism against application layer DDoS attacks. This project demonstrates the potential of in- tegrating Deep Learning with SDN to significantly enhance network security.