ENHANCING SECURITY IN SOFTWARE DEFINED NETWORKING USING DEEP LEARNING FOR DETECTION AND MITIGATION OF DISTRIBUTED DENIAL OF SERVICE ATTACKS

Abstract

The growing reliance on Software-Defined Networking (SDN) necessitates robust security solutions, particularly against the escalating threat of Distributed Denial-of-Service (DDoS) attacks. Accurately and efficiently detecting both known and novel DDoS attacks in SDN environments remains a significant challenge. This study proposes a novel deep learning approach for efficient and accurate DDoS attack detection and mitigation within SDN. The proposed method utilizes a two-stage model: Stage 1 involves a comparative analysis between optimized Convolutional Neural Networks (CNN), Convolutional Neural Networks with Bidirectional Long Short-Term Memory (CNN-BiLSTMs), and Convolutional Neural Networks with Bidirectional Long Short-Term Memory and Attention (CNN-BiLSTMAttns), where all models achieved near-perfect accuracy (99.99%), with the CNN emerging as the most resource-efficient option. Stage 2 evaluates unsupervised learning with tuned Auto encoders (AE) and Variation Auto encoders (VAE) for anomaly detection, with the AE outperforming the VAE at a 99.86% detection rate. Various threes holding techniques were assessed with the AE, including percentile, Interquartile Range (IQR), Cumulative Sum (CUSUM), Peak-to-Peak, Control Chart, and Z-score, with CUSUM achieving the highest precision (100%) while Control Chart and Z-score demonstrated lower effectiveness. This two-stage approach combines the efficiency of a CNN for known attacks with the anomaly detection capability of an AE for novel attacks, using CUSUM thresholding for optimal results, thereby enhancing the resilience of SDN networks against DDoS threats. This innovative two-stage deep learning approach enhances SDN resilience by efficiently detecting both known and evolving DDoS attacks. It combines a resource-efficient Convolutional Neural Network (CNN) for known threats with the anomaly detection capability of Autoencoders (AE) for novel attacks.