An Intelligent DoS Attack Detection Framework For SDN

How to detect DoS attacks in SDN precisely and intelligently is a big challenge. Most of SDN DoS attack detection methods artificially analyze DoS traffic characteristics, and thus they are unscalable. Additionally, they pay little attention to minimizing the impact of DoS attacks on other normal traffic of the victim switches, which might make packets from normal traffic hard to be served because DoS attack traffic jams the bandwidth between the victim switches and the controller. In this paper, we propose DADF, which is an intelligent framework deployed in the controller to detect DoS attacks in SDN. The framework has two important modules, i.e., the detection module and the diversion module. The detection module aims to detect DoS attacks precisely and intelligently by employing deep learning. The diversion module adopts reinforcement learning to migrate DoS attack traffic intelligently and minimize the impact of DoS attacks on other normal traffic of the victim switches. The extensive experimental evaluation shows that DADF can precisely detect DoS attacks and minimize the impact of DoS attacks on other normal traffic of the victim switches by migrating DoS attack traffic to neighbor switches intelligently.