While Software Defined Networking (SDN) provides well-known advantages in terms of network automation, flexibility and resources utilization, it has been observed that SDN controllers may represent critical points of failure for the entire network infrastructure, especially when they are targeted by malicious cyber attacks such as Distributed Denial of Service (DDoS). To address this issue, in this paper we exploit stateful data planes, as enabled by P4 programming language, where switches maintain persistent memory of handled packets to perform attack detection directly at the data plane, with only marginal involvement of the SDN controllers. As machine learning (ML) is recognized as primary anomaly detection methodology, we perform DDoS attack detection using a MLbased classification and compare different ML algorithms in terms of classification accuracy and train/test duration. Moreover, we combine ML and P4-enab1ed stateful data planes to design a real-time DDoS attack detection module, which we evaluate in terms of latency required for the detection. Three real-time scenarios are considered, where P4-enab1ed switches elaborate the received packets in different ways, namely, packet mirroring, header mirroring, and P4-metadata extraction. Numerical results show significant latency reduction when P4 is adopted.

Machine-learning-assisted DDoS attack detection with P4 language

Musumeci F.;Ionata V.;Tornatore M.
2020

Abstract

While Software Defined Networking (SDN) provides well-known advantages in terms of network automation, flexibility and resources utilization, it has been observed that SDN controllers may represent critical points of failure for the entire network infrastructure, especially when they are targeted by malicious cyber attacks such as Distributed Denial of Service (DDoS). To address this issue, in this paper we exploit stateful data planes, as enabled by P4 programming language, where switches maintain persistent memory of handled packets to perform attack detection directly at the data plane, with only marginal involvement of the SDN controllers. As machine learning (ML) is recognized as primary anomaly detection methodology, we perform DDoS attack detection using a MLbased classification and compare different ML algorithms in terms of classification accuracy and train/test duration. Moreover, we combine ML and P4-enab1ed stateful data planes to design a real-time DDoS attack detection module, which we evaluate in terms of latency required for the detection. Three real-time scenarios are considered, where P4-enab1ed switches elaborate the received packets in different ways, namely, packet mirroring, header mirroring, and P4-metadata extraction. Numerical results show significant latency reduction when P4 is adopted.
IEEE International Conference on Communications
978-1-7281-5089-5
File in questo prodotto:
File Dimensione Formato  
ICC20_cybersecP4_v04.pdf

accesso aperto

: Pre-Print (o Pre-Refereeing)
Dimensione 1.66 MB
Formato Adobe PDF
1.66 MB Adobe PDF Visualizza/Apri

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: http://hdl.handle.net/11311/1156520
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 15
  • ???jsp.display-item.citation.isi??? 12
social impact