A Machine Learning Approach for Detecting DoS Attacks in SDN Switches

Abstract

Software Defined Networking (SDN) breaks the vertical integration of existing Internet architecture and makes the network programmable from a logically centralized control point. Even though the centralized network control provides several advantages, attacks toward SDN framework remain as a challenge. In this paper, we propose a method based on machine learning to detect Denial of Service (DoS) attack in data plane devices, i.e., the OpenFlow switches, resulting from flow-table overflow. We created an SDN dataset using Mininet and features are extracted from switch-controller communication trace as well as flow-table snapshots of OpenFlow switches. Further, we use three algorithms, (i) Neural Network, (ii) Support Vector Machines, and (iii) Naive Bayes, to classify the network to either malicious or benign. The results show that neural network and Naive Bayes provide 100% accuracy with the extracted features.