Deep Learning-based Slow DDoS Attack Detection in SDN-based Networks

Software-Defined Networking (SDN) is a promising networking paradigm that provides outstanding manageability, scalability, controllability, and flexibility. Despite having such promising features, SDN is not intrinsically secure. For instance, it still suffers from Denial of Service (DDoS) attacks, which is one of the major threats that compromise the availability of the network. One type of DDoS attacks, that is considered as one of the most challenging to be detected, are slow DDoS attacks. In recent years, deep learning algorithms have been applied for reliable and highly accurate traffic anomaly detection. Therefore, in this paper, we propose the use of a hybrid Convolutional Neural Network-Long-Short Term Memory (CNN-LSTM) model to detect slow DDoS attacks in SDN-based networks. The performance of this method is evaluated based on custom datasets. The obtained results are quite impressive - all considered performance metrics are above 99%. Our hybrid CNN-LSTM model also outperforms other deep learning models like MultiLayer Perceptron (MLP) and standard machine learning models like 1-Class Support Vector Machines (1-Class SVM).