Nova metoda detekcije DDoS napada primenom softverski definisanih mreža

Abstract

This dissertation is the result of a detailed research of detection and identification of DDoS attacks by denying network services. The scientific justification of the research is based on the fact that this important type of attack is increasingly carried out within software-defined networks, which represent a completely new and increasingly important paradigm of network management. A new method for the detection of anomalies and DDoS attacks is proposed and analyzed, which applies a combined approach that includes the entropy calculation of network attributes and the application of supervised machine learning algorithms. Entropy calculation as a high-level metric was applied on the edge OpenFlow network switch to realize fast attack detection, while supervised machine learning algorithms were executed on the controller, which achieved more accurate detection, reduced the number of false alarms and performed effective classification of network traffic. The detailed experimental analysis performed for the simulation topology of the software-defined network, obtained results that show that the proposed DDoS attack detection method achieves a high degree of efficiency and classification accuracy. Also, the proposed solution has the characteristic of generality, so it has the ability to detect different flooding attacks.