Machine Learning Approach Equipped with Neighbourhood Component Analysis for DDoS Attack Detection in Software-Defined Networking
The Software-Defined Network (SDN) is a new network paradigm that promises more dynamic and efficiently manageable network architecture for new-generation networks. With its programmable central controller approach, network operators can easily manage and control the whole network. However, at the s...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2021-05-01
|
| Series: | Electronics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2079-9292/10/11/1227 |
| _version_ | 1797533246477565952 |
|---|---|
| author | Özgür Tonkal Hüseyin Polat Erdal Başaran Zafer Cömert Ramazan Kocaoğlu |
| author_facet | Özgür Tonkal Hüseyin Polat Erdal Başaran Zafer Cömert Ramazan Kocaoğlu |
| author_sort | Özgür Tonkal |
| collection | DOAJ |
| description | The Software-Defined Network (SDN) is a new network paradigm that promises more dynamic and efficiently manageable network architecture for new-generation networks. With its programmable central controller approach, network operators can easily manage and control the whole network. However, at the same time, due to its centralized structure, it is the target of many attack vectors. Distributed Denial of Service (DDoS) attacks are the most effective attack vector to the SDN. The purpose of this study is to classify the SDN traffic as normal or attack traffic using machine learning algorithms equipped with Neighbourhood Component Analysis (NCA). We handle a public “DDoS attack SDN Dataset” including a total of 23 features. The dataset consists of Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP) normal and attack traffics. The dataset, including more than 100 thousand recordings, has statistical features such as byte_count, duration_sec, packet rate, and packet per flow, except for features that define source and target machines. We use the NCA algorithm to reveal the most relevant features by feature selection and perform an effective classification. After preprocessing and feature selection stages, the obtained dataset was classified by k-Nearest Neighbor (kNN), Decision Tree (DT), Artificial Neural Network (ANN), and Support Vector Machine (SVM) algorithms. The experimental results show that DT has a better accuracy rate than the other algorithms with 100% classification achievement. |
| first_indexed | 2024-03-10T11:11:49Z |
| format | Article |
| id | doaj.art-fa503bb1cf974f72be91e4bb37d48dd9 |
| institution | Directory Open Access Journal |
| issn | 2079-9292 |
| language | English |
| last_indexed | 2024-03-10T11:11:49Z |
| publishDate | 2021-05-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Electronics |
| spelling | doaj.art-fa503bb1cf974f72be91e4bb37d48dd92023-11-21T20:46:35ZengMDPI AGElectronics2079-92922021-05-011011122710.3390/electronics10111227Machine Learning Approach Equipped with Neighbourhood Component Analysis for DDoS Attack Detection in Software-Defined NetworkingÖzgür Tonkal0Hüseyin Polat1Erdal Başaran2Zafer Cömert3Ramazan Kocaoğlu4Department on Information Technology, Samsun University, 55080 Samsun, TurkeyFaculty of Technology, Gazi University, 06500 Ankara, TurkeyDepartment of Computer Technologies, Ağrı İbrahim Çeçen University, 04000 Ağrı, TurkeyDepartment on Information Technology, Samsun University, 55080 Samsun, TurkeyDepartment on Computer Engineering, Ostim Technical University, 06500 Ankara, TurkeyThe Software-Defined Network (SDN) is a new network paradigm that promises more dynamic and efficiently manageable network architecture for new-generation networks. With its programmable central controller approach, network operators can easily manage and control the whole network. However, at the same time, due to its centralized structure, it is the target of many attack vectors. Distributed Denial of Service (DDoS) attacks are the most effective attack vector to the SDN. The purpose of this study is to classify the SDN traffic as normal or attack traffic using machine learning algorithms equipped with Neighbourhood Component Analysis (NCA). We handle a public “DDoS attack SDN Dataset” including a total of 23 features. The dataset consists of Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP) normal and attack traffics. The dataset, including more than 100 thousand recordings, has statistical features such as byte_count, duration_sec, packet rate, and packet per flow, except for features that define source and target machines. We use the NCA algorithm to reveal the most relevant features by feature selection and perform an effective classification. After preprocessing and feature selection stages, the obtained dataset was classified by k-Nearest Neighbor (kNN), Decision Tree (DT), Artificial Neural Network (ANN), and Support Vector Machine (SVM) algorithms. The experimental results show that DT has a better accuracy rate than the other algorithms with 100% classification achievement.https://www.mdpi.com/2079-9292/10/11/1227SDNDistributed Denial of Service attacksNeighbourhood Component Analysismachine learning |
| spellingShingle | Özgür Tonkal Hüseyin Polat Erdal Başaran Zafer Cömert Ramazan Kocaoğlu Machine Learning Approach Equipped with Neighbourhood Component Analysis for DDoS Attack Detection in Software-Defined Networking Electronics SDN Distributed Denial of Service attacks Neighbourhood Component Analysis machine learning |
| title | Machine Learning Approach Equipped with Neighbourhood Component Analysis for DDoS Attack Detection in Software-Defined Networking |
| title_full | Machine Learning Approach Equipped with Neighbourhood Component Analysis for DDoS Attack Detection in Software-Defined Networking |
| title_fullStr | Machine Learning Approach Equipped with Neighbourhood Component Analysis for DDoS Attack Detection in Software-Defined Networking |
| title_full_unstemmed | Machine Learning Approach Equipped with Neighbourhood Component Analysis for DDoS Attack Detection in Software-Defined Networking |
| title_short | Machine Learning Approach Equipped with Neighbourhood Component Analysis for DDoS Attack Detection in Software-Defined Networking |
| title_sort | machine learning approach equipped with neighbourhood component analysis for ddos attack detection in software defined networking |
| topic | SDN Distributed Denial of Service attacks Neighbourhood Component Analysis machine learning |
| url | https://www.mdpi.com/2079-9292/10/11/1227 |
| work_keys_str_mv | AT ozgurtonkal machinelearningapproachequippedwithneighbourhoodcomponentanalysisforddosattackdetectioninsoftwaredefinednetworking AT huseyinpolat machinelearningapproachequippedwithneighbourhoodcomponentanalysisforddosattackdetectioninsoftwaredefinednetworking AT erdalbasaran machinelearningapproachequippedwithneighbourhoodcomponentanalysisforddosattackdetectioninsoftwaredefinednetworking AT zafercomert machinelearningapproachequippedwithneighbourhoodcomponentanalysisforddosattackdetectioninsoftwaredefinednetworking AT ramazankocaoglu machinelearningapproachequippedwithneighbourhoodcomponentanalysisforddosattackdetectioninsoftwaredefinednetworking |