Statistical slice-level analysis for online detection of distributed denial-of-service (DDoS) attacks in network slicing environments

Network slicing (NS) is a technique that enables network operators to create multiple virtual networks, each customized for specific clients, services, or applications, while still utilizing a shared physical network infrastructure. Although this approach provides benefits in terms of resource usage and flexibility, it also introduces new security risks, particularly in the form of DDoS attacks. These attacks can be targeted at specific slices, causing disruptions to the services provided by those slices, which may impact multiple clients or applications that rely on those services. To mitigate the security risks posed by NS, the paper proposes an intrusion detection system that is designed to safeguard network slices from DDoS attacks. The proposed system relies on statistical methods that use joint entropy and dynamic thresholds to analyze network traffic in real time. Based on the findings of the testbed conducted for network slices, the proposed system exhibited a remarkable level of effectiveness in identifying DDoS attacks directed targeting a specific slice. The detection rate was recorded at 99%, and the delay rate was extremely low at 0.32 s. These results imply that the system can recognize and respond to attacks swiftly, which can aid in swiftly mitigating potential threats.