DDoSNet: A Deep-Learning Model for Detecting Network Attacks

TL;DR

This paper introduces DDoSNet, a deep learning-based intrusion detection system for SDN networks, leveraging RNN and autoencoder techniques to detect diverse DDoS attacks using the comprehensive CICDDoS2019 dataset.

Contribution

The paper presents a novel deep learning model combining RNN and autoencoder for DDoS detection in SDN, evaluated on a new, diverse dataset to improve detection accuracy.

Findings

Significant improvement over benchmark methods.

Effective detection of diverse DDoS attack patterns.

Enhanced security for SDN environments.

Abstract

Software-Defined Networking (SDN) is an emerging paradigm, which evolved in recent years to address the weaknesses in traditional networks. The significant feature of the SDN, which is achieved by disassociating the control plane from the data plane, facilitates network management and allows the network to be efficiently programmable. However, the new architecture can be susceptible to several attacks that lead to resource exhaustion and prevent the SDN controller from supporting legitimate users. One of these attacks, which nowadays is growing significantly, is the Distributed Denial of Service (DDoS) attack. DDoS attack has a high impact on crashing the network resources, making the target servers unable to support the valid users. The current methods deploy Machine Learning (ML) for intrusion detection against DDoS attacks in the SDN network using the standard datasets. However, these methods suffer several drawbacks, and the used datasets do not contain the most recent attack patterns - hence, lacking in attack diversity. In this paper, we propose DDoSNet, an intrusion detection system against DDoS attacks in SDN environments. Our method is based on Deep Learning (DL) technique, combining the Recurrent Neural Network (RNN) with autoencoder. We evaluate our model using the newly released dataset CICDDoS2019, which contains a comprehensive variety of DDoS attacks and addresses the gaps of the existing current datasets. We obtain a significant improvement in attack detection, as compared to other benchmarking methods. Hence, our model provides great confidence in securing these networks.