School of Electronic Information Engineering, Hebei University, Baoding 071002, China.
Information Technology Center, Hebei University, Baoding 071002, China.
Sensors (Basel). 2023 Jul 5;23(13):6176. doi: 10.3390/s23136176.
Distributed denial-of-service (DDoS) attacks pose a significant cybersecurity threat to software-defined networks (SDNs). This paper proposes a feature-engineering- and machine-learning-based approach to detect DDoS attacks in SDNs. First, the CSE-CIC-IDS2018 dataset was cleaned and normalized, and the optimal feature subset was found using an improved binary grey wolf optimization algorithm. Next, the optimal feature subset was trained and tested in Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbor (k-NN), Decision Tree, and XGBoost machine learning algorithms, from which the best classifier was selected for DDoS attack detection and deployed in the SDN controller. The results show that RF performs best when compared across several performance metrics (e.g., accuracy, precision, recall, F1 and AUC values). We also explore the comparison between different models and algorithms. The results show that our proposed method performed the best and can effectively detect and identify DDoS attacks in SDNs, providing a new idea and solution for the security of SDNs.
分布式拒绝服务 (DDoS) 攻击对软件定义网络 (SDN) 构成了重大的网络安全威胁。本文提出了一种基于特征工程和机器学习的方法，用于检测 SDN 中的 DDoS 攻击。首先，清理和规范化了 CSE-CIC-IDS2018 数据集，并使用改进的二进制灰狼优化算法找到了最优特征子集。接下来，在随机森林 (RF)、支持向量机 (SVM)、K-最近邻 (k-NN)、决策树和 XGBoost 机器学习算法中对最优特征子集进行训练和测试，从中选择最佳分类器用于 DDoS 攻击检测，并将其部署在 SDN 控制器中。结果表明，在比较多个性能指标（例如准确率、精度、召回率、F1 和 AUC 值）时，RF 的表现最佳。我们还探索了不同模型和算法之间的比较。结果表明，我们提出的方法表现最佳，可以有效地检测和识别 SDN 中的 DDoS 攻击，为 SDN 的安全性提供了新的思路和解决方案。
