Detection and Mitigation of DDoS attacks based on Multi-dimensional Characteristics in SDN

Detection and Mitigation of DDoS attacks based on Multi-dimensional Characteristics in SDN | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Detection and Mitigation of DDoS attacks based on Multi-dimensional Characteristics in SDN Kun Wang, Yu Fu, Xueyuan Duan, Taotao Liu This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-4466116/v1 This work is licensed under a CC BY 4.0 License Status: Published Journal Publication published 16 Jul, 2024 Read the published version in Scientific Reports → Version 1 posted 13 You are reading this latest preprint version Abstract Due to the large computational overhead, underutilization of features, and high bandwidth consumption in traditional SDN environments for DDoS attack detection and mitigation methods, this paper proposes a two-stage detection and mitigation method for DDoS attacks in SDN based on multi-dimensional characteristics. Firstly, an analysis of the traffic statistics from the SDN switch ports is performed, which aids in conducting a coarse-grained detection of DDoS attacks within the network. Subsequently, a Multi-Dimensional Deep Convolutional Classifier (MDDCC) is constructed using wavelet decomposition and convolutional neural networks to extract multi-dimensional characteristics from the traffic data passing through suspicious switches. Based on these extracted multi-dimensional characteristics, a simple classifier can be employed to accurately detect attack samples. Finally, by integrating graph theory with restrictive strategies, the source of attacks in SDN networks can be effectively traced and isolated. The experimental results indicate that the proposed method, which utilizes a minimal amount of statistical information, can quickly and accurately detect attacks within the SDN network. It demonstrates superior accuracy and generalization capabilities compared to traditional detection methods, especially when tested on both simulated and public datasets. Furthermore, by isolating the affected nodes, the method effectively mitigates the impact of the attacks, ensuring the normal transmission of legitimate traffic during network attacks. This approach not only enhances the detection capabilities but also provides a robust mechanism for containing the spread of cyber threats, thereby safeguarding the integrity and performance of the network. Physical sciences/Mathematics and computing/Computer science Physical sciences/Mathematics and computing/Information technology Physical sciences/Mathematics and computing/Software deep learning software defined network distributed denial of service attack detection Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Published Journal Publication published 16 Jul, 2024 Read the published version in Scientific Reports → Version 1 posted Editorial decision: Accepted 05 Jul, 2024 Reviews received at journal 27 Jun, 2024 Reviewers agreed at journal 18 Jun, 2024 Reviews received at journal 15 Jun, 2024 Reviews received at journal 05 Jun, 2024 Reviewers agreed at journal 30 May, 2024 Reviewers agreed at journal 30 May, 2024 Reviewers agreed at journal 30 May, 2024 Reviewers invited by journal 30 May, 2024 Editor assigned by journal 30 May, 2024 Editor invited by journal 27 May, 2024 Submission checks completed at journal 27 May, 2024 First submitted to journal 23 May, 2024 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-4466116","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":311206859,"identity":"c355da0f-be6b-46be-83c8-b7adf00bb34a","order_by":0,"name":"Kun Wang","email":"","orcid":"","institution":"Naval University of Engineering","correspondingAuthor":false,"prefix":"","firstName":"Kun","middleName":"","lastName":"Wang","suffix":""},{"id":311206862,"identity":"f63599b1-cc3b-4505-8f7c-774a7986d9b7","order_by":1,"name":"Yu Fu","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAwElEQVRIiWNgGAWjYBAC9gYgkVAhIcfPzHz4AVFaeA4AiQ9nLIwl29nSDIjWwjizrSJxw3keBQnitEjkmEnzsEkkbj7Mw2DAUGMTTaQWHgnjbYd5DzxgOJaW20BIiz1Yi4SE7LbDfAkGjA2HCWuB2GIgwbi5GUQSq0VyRoKE4gZmorXwPCu2+HBAwljiMDCQE4jxCw978sYbif/q5Pj7Dx9+8KHGhrAWBgYOpAhMIKwcBNgfEKduFIyCUTAKRi4AADCpOU1Paf4qAAAAAElFTkSuQmCC","orcid":"","institution":"Naval University of Engineering","correspondingAuthor":true,"prefix":"","firstName":"Yu","middleName":"","lastName":"Fu","suffix":""},{"id":311206863,"identity":"552a711c-258e-4bfe-9d13-e1343479cea3","order_by":2,"name":"Xueyuan Duan","email":"","orcid":"","institution":"Xinyang Normal University","correspondingAuthor":false,"prefix":"","firstName":"Xueyuan","middleName":"","lastName":"Duan","suffix":""},{"id":311206866,"identity":"2982b00e-6977-4a7d-bd4a-70cf4427a6ef","order_by":3,"name":"Taotao Liu","email":"","orcid":"","institution":"Naval University of Engineering","correspondingAuthor":false,"prefix":"","firstName":"Taotao","middleName":"","lastName":"Liu","suffix":""}],"badges":[],"createdAt":"2024-05-23 10:15:36","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-4466116/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-4466116/v1","draftVersion":[],"editorialEvents":[{"content":"https://doi.org/10.1038/s41598-024-66907-z","type":"published","date":"2024-07-16T16:13:15+00:00"}],"editorialNote":"","failedWorkflow":false,"files":[{"id":61595159,"identity":"aaab995e-eb44-4005-9946-0ff6d0e35f16","added_by":"auto","created_at":"2024-08-01 17:20:45","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":869504,"visible":true,"origin":"","legend":"","description":"","filename":"20240525DetectionandMitigationofDDoSattacksbasedonMultidimensionalcharacteristicsinSDN.pdf","url":"https://assets-eu.researchsquare.com/files/rs-4466116/v1_covered_eee429e8-8b28-4c22-a069-22994cea0cc2.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Detection and Mitigation of DDoS attacks based on Multi-dimensional Characteristics in SDN","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":true,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"deep learning, software defined network, distributed denial of service, attack detection","lastPublishedDoi":"10.21203/rs.3.rs-4466116/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-4466116/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eDue to the large computational overhead, underutilization of features, and high bandwidth consumption in traditional SDN environments for DDoS attack detection and mitigation methods, this paper proposes a two-stage detection and mitigation method for DDoS attacks in SDN based on multi-dimensional characteristics. Firstly, an analysis of the traffic statistics from the SDN switch ports is performed, which aids in conducting a coarse-grained detection of DDoS attacks within the network. Subsequently, a Multi-Dimensional Deep Convolutional Classifier (MDDCC) is constructed using wavelet decomposition and convolutional neural networks to extract multi-dimensional characteristics from the traffic data passing through suspicious switches. Based on these extracted multi-dimensional characteristics, a simple classifier can be employed to accurately detect attack samples. Finally, by integrating graph theory with restrictive strategies, the source of attacks in SDN networks can be effectively traced and isolated. The experimental results indicate that the proposed method, which utilizes a minimal amount of statistical information, can quickly and accurately detect attacks within the SDN network. It demonstrates superior accuracy and generalization capabilities compared to traditional detection methods, especially when tested on both simulated and public datasets. Furthermore, by isolating the affected nodes, the method effectively mitigates the impact of the attacks, ensuring the normal transmission of legitimate traffic during network attacks. This approach not only enhances the detection capabilities but also provides a robust mechanism for containing the spread of cyber threats, thereby safeguarding the integrity and performance of the network.\u003c/p\u003e","manuscriptTitle":"Detection and Mitigation of DDoS attacks based on Multi-dimensional Characteristics in SDN","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2024-06-07 20:23:45","doi":"10.21203/rs.3.rs-4466116/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Accepted","date":"2024-07-05T04:39:12+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2024-06-27T14:57:56+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"37110817605035981758426885387976591468","date":"2024-06-19T03:31:16+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2024-06-15T06:41:17+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2024-06-05T08:02:28+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"320802186557340206234957851106543322291","date":"2024-05-31T01:24:55+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"226830333442357491868098884762476247647","date":"2024-05-30T17:24:00+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"132447486516083502809138836038222007456","date":"2024-05-30T16:52:19+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2024-05-30T16:28:37+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2024-05-30T16:09:53+00:00","index":"","fulltext":""},{"type":"editorInvited","content":"","date":"2024-05-27T12:36:43+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2024-05-27T04:47:37+00:00","index":"","fulltext":""},{"type":"submitted","content":"Scientific Reports","date":"2024-05-23T10:14:22+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"4230c9c9-1eb9-48a0-9a6d-fd329d413701","owner":[],"postedDate":"June 7th, 2024","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"published-in-journal","subjectAreas":[{"id":32890440,"name":"Physical sciences/Mathematics and computing/Computer science"},{"id":32890441,"name":"Physical sciences/Mathematics and computing/Information technology"},{"id":32890442,"name":"Physical sciences/Mathematics and computing/Software"}],"tags":[],"updatedAt":"2024-08-01T16:19:51+00:00","versionOfRecord":{"articleIdentity":"rs-4466116","link":"https://doi.org/10.1038/s41598-024-66907-z","journal":{"identity":"scientific-reports","isVorOnly":false,"title":"Scientific Reports"},"publishedOn":"2024-07-16 16:13:15","publishedOnDateReadable":"July 16th, 2024"},"versionCreatedAt":"2024-06-07 20:23:45","video":"","vorDoi":"10.1038/s41598-024-66907-z","vorDoiUrl":"https://doi.org/10.1038/s41598-024-66907-z","workflowStages":[]},"version":"v1","identity":"rs-4466116","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-4466116","identity":"rs-4466116","version":["v1"]},"buildId":"qtupq5eGEP_6zYnWcrvyt","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}