LR-STGCN: Detecting and mitigating low-rate DDoS attacks in SDN based on spatial–temporal graph neural network

Abstract

Software Defined Network (SDN) is an emerging network architecture. The decoupled data plane and control plane provide programmability for efficient network management. As a new network architecture, SDN also faces the threat of Low-rate Distributed Denial of Service (LDDoS) attacks. However, the centralized control, forwarding separation, scalability, and programmability of SDN provide new ideas for the detection and defense of LDDoS attacks. In this paper, we perform feature extraction of LDDoS attack flows in terms of time–frequency distribution of LDDoS attack flows and quality of service (QoS) of TCP flows, and identify the victim switch and victim ports by using the hybrid GCN-GRU deep learning model and the double sliding window method. Finally, the location of the attacking host is determined based on the victim port, and defense measures are issued to the victim switch at the attack source through the OpenFlow protocol. The evaluation results indicate that the detection method deployed on SDN controllers has a high detection rate and low false positive rate for LDDoS attacks, and can detect and alleviate LDDoS attacks online and in real-time.