Open AccessA passive DDoS attack detection approach based on abnormal analysis in SDN environment
Author(s) -
Shujing Sun,
Xinchao Zhang,
Wentian Huang,
Aixin Xu,
Xiaofan Wang,
Li Han
Publication year - 2021
Publication title -
journal of physics. conference series
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.21
H-Index - 85
eISSN - 1742-6596
pISSN - 1742-6588
DOI - 10.1088/1742-6596/2010/1/012146
Subject(s) - denial of service attack , application layer ddos attack , computer science , computer network , computer security , operating system , the internet
Most of the detection methods against DDoS attacks are based on periodic detection, which leads to high communication overhead, untimely detection, and slow attack response. This paper proposes a passive abnormality detection approach. First, we record the two flow-table characteristics of the regular switches. Then, based on dynamic threshold method and Grubbs outlier test method, we make a determination of abnormal switches. This method reduces the amount of data duplication and regular traffic collection. Moreover, we use Support Vector Machine (SVM) algorithm to evaluate the performance of the passive anomaly detection method. The experiment results show a better performance than active period DDoS attack detection approaches.