![Introduction
Figure 1: Different planes and network
application in SDN[1]
Figure 2: Reactive traffic flow set-up in
SDN[1]
[1]Niyaz Q, Sun W, Javaid AY, and Alam M. A deep learning approach for network intrusion detection system. International conference wireless networks and mobile communications (WINCOM),
pages 258{263, 2016](https://image.slidesharecdn.com/paperid24-190118163907/85/Leveraging-Machine-Learning-Approach-to-Setup-Software-Defined-Network-SDN-Controller-Rules-During-DDoS-Attack-2-320.jpg)
Leveraging Machine Learning Approach to Setup Software Defined Network(SDN) Controller Rules During DDoS Attack
- 1. Leveraging Machine Learning Approach to Setup Software Defined Network(SDN) Controller Rules During DDoS Attack Authors Sajib Sen, Kishor Datta Gupta, and Md Manjurul Ahsan 4/30/18 1
- 2. Introduction Figure 1: Different planes and network application in SDN[1] Figure 2: Reactive traffic flow set-up in SDN[1] [1]Niyaz Q, Sun W, Javaid AY, and Alam M. A deep learning approach for network intrusion detection system. International conference wireless networks and mobile communications (WINCOM), pages 258{263, 2016
- 3. Introduction Figure 3: OpenVSwitch architecture Figure 4: Packet flow
- 4. Introduction Figure 5: sFlow-RT interface
- 5. Introduction Figure 6: Traffic monitoring Figure 7: Event handling
- 6. Implementation: • To create a virtual network SDN topology: • sudo mn --controller=remote,ip=127.0.0.1,port=6653 --topo=single,3 --mac --switch ovsk • This tells Mininet to start up a 3-host, single-(openvSwitch-based)switch topology, set the MAC address of each host equal to its IP, and point to a remote controller which defaults to the localhost.
- 7. Implementation: Figure 8: Setting of Virtual SDN
- 8. Flow rules set up in SDN controller: # sudo ovs-ofctl add-flow s1 in_port=1,actions=output:2 # sudo ovs-ofctl add-flow s1 in_port=2,actions=output:1 This will forward packets coming at port 1 to port 2 and vice-verca.
- 9. Implementation: • To connect OpenVSwitch to sFlow-RT analyzer: • sudo ovs-vsctl -- --id=@sflow create sflow agent=eth0 target="127.0.0.1:6343" sampling=10 polling=20 -- -- set bridge s1 sflow=@sflow • Here the OpenVSwitch has been connected to sFlow-RT with eth0 as agent and flow switch as s1. • To start: ./sFlow-rt/start.sh and to check the topology of mininet network in sFlow-RT need to visit • http://localhost:8008/metric/127.0.0.1/html • http://localhost:8080/ui/pages/index.html
- 10. Implementation: • xterm h1 h2 • on h1 terminal "python -m SimpleHTTPServer 80& • on h2 terminal "ping 10.0.0.1" Figure 9: Ping request to node h1
- 11. Implementation: Figure 10: Network packet information in Wireshark
- 12. Implementation: Figure 11 : Packet flow in s1-eth0 interface
- 13. Implementation: Data Description: No. Features Description 1 Service network service on the destination, e.g., http, telnet, etc. 2 Header length Length of Header data 3 Flags normal (0) or error(1) status of the connection 4 TTL Time to Live 5 Protocol type of the protocol, e.g. tcp, udp, etc. 6 Data bytes Bytes of data needed for certain protocol 7 Epoch Time Time to complete one epoch 8 Reply Response Time Time to give response 9 Land 1 if connection is from/to the same host/port; 0 otherwise
- 14. Implementation: • DDoS flood attack: • ping -f 10.0.0.1 command from different MiniNet hosts. • Besides to create flood attack manually, a payload had been created by python code using scapy library. Figure 12: DDoS Attack
- 15. Implementation: Figure 13: Ping flood attack to node h1
- 16. Implementation: Figure 14: Ping flood packet data in wireshark
- 17. Figure 15: Dos attack in sFlow-RT Implementation:
- 18. No Techniques Precision Recall F- Measure ROC Area 1 Bayes Net 0.889 0.885 0.885 0.863 2 Naïve Bayes 0.731 0.705 0.693 0.707 3 Multilayer Perceptron 0.836 0.836 0.836 0.834 4 Support Vector Machine(ker nel=3) 0.853 0.852 0.852 0.853 5 AdaBoost (Decision Stump as weak classifier) 0.934 0.934 0.934 0.887 6 J48 decision tree 0.903 0.902 0.901 0.880 7 Random Forest 0.837 0.836 0.836 0.899 Result and Observation:
- 19. 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Bayes Net Naïve Bayes Multilayer Perceptron Support Vector Machine(kernel=3) AdaBoost(Decision Stump as weak classifier) J48 decision tree Random Forest Comparison of F-measure Among Classifier Result and Observation
- 20. • Virtual SDN testbed environment has been created • DoS attack performed on the network • Data collected for both normal and attack scenario. • Model trained and performance compare for different classifier Conclusion