An Approach to Detecting Distributed Denial of Service Attacks in Software Defined Networks

Distributed Denial of Service (DDoS) flooding attack continue to be one of the major security concerns as attack volumes are increasing year on year. Many works have shown Slowloris, ACK and SYN flooding attacks to be notorious amongst several other forms of DDoS attacks. This is mainly due to similarity in attack and legitimate traffic, weaknesses in protocols been exploited and anomaly detection mechanism deployed. Conventional approach to detection demands a paradigm shift and the emerging Software Defined Networks (SDN) introduces new opportunities to detect and mitigate attacks based on its central management system. In this work, we assess the severity of TCP-ACK, SYN and Slowloris attack on the server at the data plane layer. We evaluate the detection of DDoS attacks by simulating with Mininet. Our detection mechanism relies on deviation from the confidence interval obtained from normal distribution of throughput polled without attack from the server. Our emulation result shows that using a window size of one minute, flooding attacks can be detected with an accuracy of 99%.