DDoS Detection Based on Sliding Window Entropy and Decision Tree with Programmable Switch

Abstract

Distributed denial-of-service (DDoS) attacks have become a constant threat to modern networks, and how to detect and respond to them is a key challenge for network operators. Data plane programmability is a promising technology that enables fast control loops to detect and mitigate cyberattacks. At the same time, the domain-specific language P4 used by the programmable switch allows users to flexibly customize DDoS detection methods and attack mitigation behaviors, so the programmable switch can bring some new opportunities for DDoS attack detection. This paper proposes an in-network architecture for DDoS attack detection that combines the entropy of statistical measures describing traffic distribution and machine learning models for network devices. The proposed sliding window detection mechanism completes the fine-grained detection of a single packet within the linear time complexity, and the machine learning model can perform secondary detection of the flow of normal packets in the suspected DDoS attack window to improve the accuracy of detection. We evaluated the proposed framework using real publicly available traffic tracing as input to the experiment, the results show that our framework has the advantages of high accuracy, fine-graininess, and coverage of a wide range of attack types compared with state-of-the-art methods, and is completely executed on the data plane.