Efficient Defense Against DNS Floods Using Machine Learning in SDN-Based Networks

Distributed denial-of-service (DDoS) attacks are serious network threats. Domain name system (DNS) floods belong to DDoS attacks, where victim DNS servers are overwhelmed by lots of malicious DNS queries, making web services unavailable to hosts. The paper combines machine learning (ML) and software-defined networking (SDN) to cope with DNS floods. We analyze the performance of detecting malicious DNS queries using different ML techniques. Based on the analysis, we propose an efficient DT-based defense against DNS floods (ED3F) scheme. The SDN controller checks if the frequency of DNS queries is high and employs a trained ML model to identify malicious DNS queries. Moreover, ED3F adjusts its blocking time depending on the status of a host sending malicious DNS queries. Using simulation, we show that the ED3F scheme can quickly and accurately block malicious DNS queries, thereby defending against DNS floods efficiently.