Introducing a New Linear Regression Based Method for Early DDoS Attack Detection in SDN

The software Defined Networks, by separating the data plane and control plane of the network, have made a drastic change to the scope of computer networks. Although this separation has accelerated and simplified the management, configuration and error detection, it has also caused some new security problems. One of these problems is the Vulnerability of the software defined networks' architecture to distributed denial of service attacks on the network's controllers. One of the most recent distributed denial of service attacks which entropy-based methods are incapable of detecting, is to send fake packets with different source to random addresses in a software defined network. In this paper, given the SDN structure and tra □ ic analysis, a statistical trapezoid model is introduced to estimate number of table misses for each switch. Then, using the linear regression method and EWMA estimation, the threshold of the table misses in specified time intervals, is estimated. The evaluation results imply that using this method, one can detect DDoS attacks in early stage in software defined networks, regardless of the sort of DDoS attack.