Detection and Mitigation of DDOS Attack Using CART-SVC Approach in SDN

Software-defined networking separates the network control plane and the data plane to make network management easier and increase network efficiency. By separating network control from physical infrastructure, SDN enhances flexibility and efficiency in network management. However, this separation also introduces a vulnerability to distributed denial of service (DDoS) attacks as a significant disadvantage, primarily because the control plane, responsible for managing the entire network, becomes a potential target when isolated from the data plane. To detect this DDoS attack, we are using classification and regression tree (CART) and support vector classifier (SVC) machine learning algorithms. The dataset is generated using the CICFlowMeter tool, which includes both normal and abnormal requests. Then the feature selection is performed using the selectKbest and mutual information methods. In the detection phase, the model is trained using a binary classifier, CART. The output of the CART then serves as input for the classification stage to classify the traffic pattern as TCP, UDP, and HTTP using a multiclass classifier, SVC. After the classification stage, mitigation measures are taken by blocking a request from a host. The accuracy of this approach by the True Positives, True Negatives, False Positives, and False Negatives is 98.87%.