Open AccessSYNGuard: Dynamic threshold‐based SYN flood attack detection and mitigation in software‐defined networks
Author(s) -
Rahouti Mohamed,
Xiong Kaiqi,
Ghani Nasir,
Shaikh Farooq
Publication year - 2021
Publication title -
iet networks
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.466
H-Index - 21
eISSN - 2047-4962
pISSN - 2047-4954
DOI - 10.1049/ntw2.12009
Subject(s) - testbed , computer science , intrusion detection system , computer security , overhead (engineering) , software defined networking , software , computer network , operating system
SYN flood attacks (half‐open attacks) have been proven a serious threat to software‐defined networking (SDN)‐enabled infrastructures. A variety of intrusion detection and prevention systems (IDPS) have been introduced for identifying and preventing such security threats, but they often result in significant performance overhead and response time. Therefore, those existing approaches are inflexible for large‐scale networks and real‐time applications. For this reason, a novel and adaptive threshold‐based kernel‐level intrusion detection and prevention system by leveraging SDN capabilities are proposed. The proposed systems to detect and mitigate the aforementioned threats within an SDN over widely used traditional IDPS technologies, Snort and Zeek, are comparatively examined. The approach is evaluated using a mixture of fundamental adverse attacks and SDN‐specific threats on a real‐world testbed. The experimental results demonstrate the efficacy of the mechanism to detect and mitigate SYN flood attacks within an SDN environment.