Detection and Defense Mechanism of LDoS Attack in SDN Environment

Abstract

Low-rate denial of service (LDoS) attack is a new type of network attack, which is characterized by low attack cost and strong concealment. As a new type of network architecture, software defined network (SDN) is also threatened by LDoS attacks. The control and forwarding separation of the SDN network and the programmable net-work behavior provide new ideas for the detection and defense of LDoS attacks. This paper proposes a new LDoS attack detection and defense method based on OpenFlow protocol. The rate of each OpenFlow data stream is separately counted, and the double-sliding-window method in signal detection is used to detect the attack traffic. Once the attack traffic is detected, the controller can implement real-time defense against the attack behavior by sending a flow table. Experi-ments show that this method can effectively detect LDoS attacks and can defend against LDoS attacks in a short time.

Keywords

• low-rate denial of service (ldos) attack
• software-defined network (sdn)
• detection
• defense
• open network operating system (onos)