تشخیص حملات منع سرویس توزیع‌شده در شبکه‌های نرم‌افزارمحور

نوع مقاله : مقاله پژوهشی

نویسندگان

دانشگاه آزاداسلامی،واحداصفهان(خوراسگان)،اصفهان،ایران

چکیده

شبکه‌های نرم‌افزارمحور، معماری جدیدی از شبکه‌های کامپیوتری بوده که از هدایت‌کننده مرکزی استفاده می‌کنند. این شبکه‌ها متکی بر نرم‌افزار هستند و از این‌رو، حملات امنیتی گوناگونی می‌تواند از طریق اجزای مختلف شبکه بر ضد آن‌ها صورت گیرد. یکی از این نوع حملات، حمله منع سرویس توزیع‌شده است. این حمله یکی از جدی‌ترین تهدیدات در دنیای شبکه‌های کامپیوتری است و بر روی کارایی شبکه، تاثیرمی‌گذارد. در این پژوهش یک روش تشخیص حملات منع‌سرویس توزیع‌شده به نام «حمله‌یاب» در شبکه‌های نرم‌افزارمحور ارائه شده است. این سامانه مبتنی بر ترکیب روش‌های آماری و یادگیری ‌ماشین است. در روش آماری از آنتروپی مبتنی بر آی پی مقصد و توزیع نرمال با استفاده از حد آستانه انعطاف‌پذیر، برای تشخیص حملات استفاده شده است، توزیع نرمال، یکی از مهم‌ترین توزیع‌های احتمال پیوسته در نظریه احتمالات است. در این توزیع، میانگین آنتروپی و انحراف استاندارد در تشخیص حملات تأثیر دارند. در بخش یادگیری‌ ماشین، با استخراج ویژگی‌های مناسب و استفاده از الگوریتم‌های کلاس‌بندی نظارت‌شده، دقت تشخیص حملات منع‌سرویس توزیع‌شده بالا می‌رود. مجموعه داده‌های مورد استفاده در این پژوهش، ISCX-SlowDDoS2016، ISCX-IDS2012، CTU-13 و ISOT هستند. روش پیشنهادی حمله‌یاب با چند روش دیگر مقایسه شده است که نتیجه مقایسه نشان می‌دهد که روش حمله‌یاب با دقت 65/99 و نرخ هشدار غلط، 12/0 برای مجموعه داده UNB-ISCX و دقت تشخیص ۹۹٫۸۴ و نرخ هشدار غلط ۰٫۲۵ برای مجموعه‌ داده 13-CTU دقت و کارایی بالایی نسبت به سایر روش‌های دیگر دارد.

کلیدواژه‌ها


عنوان مقاله [English]

Distributed Denial of Service Attacks Detection in Software Defined Networks

نویسندگان [English]

  • A. Banitalebi dehkordi
  • M. R. Soltanaghaie
  • F. Zamani Boroujeni
Department of Computer Engineering, Isfahan (Khorasgan) Branch, Islamic Azad University, Isfahan, Iran
چکیده [English]

The software defined network (SDN) is a new computer architecture, where the central controller is applied. These networks rely on software and consequently, their security is exposed to different attacks through different components therein. One type of these attacks, which is the latest threat in computer network realm and the efficiency therein, is called the distributed denial of services (DDoS). An attempt is made to develop an attack- detector, through a combined statistical and machine learning method. In the statistical method, the entropy, based on destination IP and normal distribution in addition to dynamic threshold are applied to detect attacks. Normal distribution is one of the most important distributions in the theory of probability. In this distribution the entropy average and standard deviation are effective in attack detection. As for the learning algorithm, by applying the extracted features from the flows and supervised               classification algorithms, the accuracy of attack detection increases in such networks. The applied datasets in this study consist of: ISCX-SlowDDoS2016، ISCX-IDS2012, CTU-13 and ISOT. This method outperforms its counterparts with an accuracy of 99.65% and 0.12 false positive rate (FPR) for the          UNB-ISCX dataset, and with an accuracy of 99.84% and 0.25 FPR for CTU-13 dataset.
 

کلیدواژه‌ها [English]

  • Distributed Denial of Service
  • Software Defined Network
  • Entropy
  • Normal Distribution
  • Classification Algorithm
[1]     J. Cui, M. Wang, Y. Luo, and H. Zhong, “DDoS detection and defense mechanism based on cognitive-inspired computing in SDN,” Future generation computer systems, vol. 97, pp. 275-283, 2019.##
[2]     M. S. Mahmoud and Y. Xia, “Cloud Control Systems: Analysis,” Design and Estimation, Academic Press, 2020.##
[3]     Q. Yan, Q. Gong, and F.-A. Deng, “Detection of DDoS Attacks Against Wireless SDN Controllers Based on the Fuzzy Synthetic Evaluation     Decision-making Model,” Adhoc & Sensor Wireless Networks, vol. 33, 2016.##
[4]     S. Hilton, “Dyn analysis summary of friday october 21 attack,” Dyn blog https://dyn. com/blog/dyn-analysis-summary-of-friday-october-21-attack, 2016.##
[5]     L. H. Newman, “Github survived the biggest DDoS attack ever recorded,” Wired, vol. 1, 2018.##
[6]     Y. Dai, J. He, Y. Wu, S. Chen, and P. Shang, “Generalized entropy plane based on permutation entropy and distribution entropy analysis for complex time series,” Physica A: Statistical Mechanics and its Applications, vol. 520, pp.       217-231, 2019.##
[7]     S. Lim, J. Ha, H. Kim, Y. Kim, and S. Yang, “A SDN-oriented DDoS blocking scheme for        botnet-based attacks,” In 2014 Sixth International Conference on Ubiquitous and Future Networks (ICUFN), IEEE, pp. 63-68, 2014.##
[8]     K. M. Prasad, A. R. M. Reddy, and K. V. Rao, “Anomaly based Real Time Prevention of under rated App-DDOS attacks on web: An experiential metrics based machine learning approach,” Indian Journal of Science and Technology, vol. 9, p. 27, 2016.##
[9]     M. H. Bhuyan, D. Bhattacharyya, and J. K. Kalita, “An empirical evaluation of information metrics for low-rate and high-rate DDoS attack detection,” Pattern Recognition Letters, vol. 51, pp. 1-7, 2015.##
[10]   W. Yassin, N. I. Udzir, A. Abdullah, M. T. Abdullah, H. Zulzalil, and Z. Muda, “Signature-Based Anomaly intrusion detection using Integrated data mining classifiers,” In 2014 International Symposium on Biometrics and Security Technologies (ISBAST), IEEE, pp. 232-237, 2014.##
[11]   R. Wang, Z. Jia, and L. Ju, “An entropy-based distributed DDoS detection mechanism in     software-defined networking,” In 2015 IEEE Trustcom/BigDataSE/ISPA, IEEE, vol. 1, pp.      310-317, 2015.##
[12]   Z. Tan, A. Jamdagni, X. He, P. Nanda, R. P. Liu, and J. Hu, “Detection of denial-of-service attacks based on computer vision techniques,” IEEE transactions on computers, vol. 64, no. 9, pp. 2519-2533, 2014.##
[13]   A. Saied, R. E. Overill, and T. Radzik, “Detection of known and unknown DDoS attacks using Artificial Neural Networks,” Neurocomputing, vol. 172, pp. 385-393, 2016.##
[14]   B. Wang, Y. Zheng, W. Lou, and Y. T. Hou, “DDoS attack protection in the era of cloud computing and software-defined networking,” Computer Networks, vol. 81, pp. 308-319, 2015.##
[15]   N. Fallahi, A. Sami, and M. Tajbakhsh, “Automated flow-based rule generation for network intrusion detection systems,” In 2016 24th Iranian Conference on Electrical Engineering (ICEE), IEEE, pp.      1948-1953, 2016.##
[16]   S. Behal, K. Kumar, and M. Sachdeva, “D-FACE: An anomaly based distributed approach for early detection of DDoS attacks and flash events,” Journal of Network and Computer Applications, vol. 111, pp. 49-63, 2018.##
[17]   R. K. Deka, D. K. Bhattacharyya, and J. K. Kalita, “Active learning to detect DDoS attack using ranked features,” Computer Communications, vol. 145, pp. 203-222, 2019.##
[18]   R. M. A. Ujjan, Z. Pervez, K. Dahal, A. K. Bashir, R. Mumtaz, and J. González, “Towards sFlow and adaptive polling sampling for deep learning based DDoS detection in SDN,” Future Generation Computer Systems, vol. 111, pp. 763-779, 2020.##
[19]   V. Yadegari and A. Matinfar, “Detect Web Denial of Service Attacks Using Entropy and Support Vector Machine Algorithm,” 2019. (In Persian)##
[20]   J. David and C. Thomas, “DDoS attack detection using fast entropy approach on flow-based network traffic,” Procedia Computer Science, vol. 50, pp.   30-36, 2015.##
[21]   V. Shyamaladevi and R. Umarani, “Thwarting Distributed Denial of Service Attacks Using Normal Distribution and Weibull Theorem,”##
[22]   F. E. Harris, “Mathematics for physical science and engineering: symbolic computing applications in Maple and Mathematica,” Academic Press, 2014.##
 [23]   A. L. Buczak and E. Guven, “A survey of data mining and machine learning methods for cyber security intrusion detection,” IEEE Communications surveys & tutorials, vol. 18, no. 2, pp. 1153-1176, 2015.##
[24]   H. H. Jazi, H. Gonzalez, N. Stakhanova, and A. A. Ghorbani, “Detecting HTTP-based application layer DoS attacks on web servers in the presence of sampling,” Computer Networks, vol. 121, pp. 25-36, 2017.##
[25]   O. Yavanoglu and M. Aydos, “A review on cyber security datasets for machine learning algorithms,” In 2017 IEEE International Conference on Big Data (Big Data), IEEE, pp. 2186-2193, 2017.##
[26]   D. Bhamare, T. Salman, M. Samaka, A. Erbad, and R. Jain, “Feasibility of supervised machine learning for cloud security,” In 2016 International Conference on Information Science and Security (ICISS), IEEE, pp. 1-5, 2016.##
[27]   T.-T. Wong, “Performance evaluation of classification algorithms by k-fold and leave-one-out cross validation,” Pattern Recognition, vol. 48, no. 9, pp. 2839-2846, 2015.##
[28]   E. Adi, Z. Baig, and P. Hingston, “Stealthy Denial of Service (DoS) attack modelling and detection for HTTP/2 services,” Journal of Network and Computer Applications, vol. 91, pp. 1-13, 2017.##
[29]   R. L. S. De Oliveira, C. M. Schweitzer, A. A. Shinoda, and L. R. Prete, “Using mininet for emulation and prototyping software-defined networks,” In 2014 IEEE Colombian Conference on Communications and Computing (COLCOM), IEEE, pp. 1-6, 2014.##
[30]   S. Asadollahi and B. Goswami, “Experimenting with scalability of floodlight controller in software defined networks,” In 2017 International Conference on Electrical, Electronics, Communication, Computer, and Optimization Techniques (ICEECCOT), IEEE, pp. 288-292, 2017.##
[31]   V. N. Maiorov and G. M. Crippen, “Significance of root-mean-square deviation in comparing           three-dimensional structures of globular proteins,” Journal of molecular biology, vol. 235, no. 2, pp. 625-634, 1994.##
[32]   P. Kalaivani and M. Vijaya, “Mining based detection of botnet traffic in network flow,” Int. J. Comput. Sci. Inf. Technol. Secur., vol. 6, pp. 535-540, 2016.##
[33]   A. Bansal and S. Mahapatra, “A comparative analysis of machine learning techniques for botnet detection,” In Proceedings of the 10th International Conference on Security of Information and Networks, pp. 91-98, 2017.##
[34]   R. Chen, W. Niu, X. Zhang, Z. Zhuo, and F. Lv, “An effective conversation-based botnet detection method,” Mathematical Problems in Engineering, vol. 2017, 2017.##
 
دوره 9، شماره 1 - شماره پیاپی 33
شماره پیاپی 33، فصلنامه بهار
اردیبهشت 1400
صفحه 43-59
  • تاریخ دریافت: 25 اسفند 1398
  • تاریخ بازنگری: 18 اردیبهشت 1399
  • تاریخ پذیرش: 15 مرداد 1399
  • تاریخ انتشار: 01 اردیبهشت 1400