Education, Science, Technology, Innovation and Life
Open Access
Sign In
  1. Home
  2. Journals
  3. Internet of Things (IoT) and Engineering Applications
  4. Vol 6, Issue 1, 2021

Structured and Unstructured Log Analysis as a Methods to Detect DDoS Attacks in SDN networks

Download as PDF

DOI: 10.23977/iotea.2021.060101 | Downloads: 48 | Views: 1456

Author(s)

Nazar Peleh 1, Stanislav Zhuravel 1, Olha Shpur 1, Olha Rybytska 2

Affiliation(s)

1 Department of Telecommunication, Lviv Polytechnic National University S. Bandery str., 12, Lviv, Ukraine
2 Department of Mathematics, Lviv Polytechnic National University S. Bandery str., 12, Lviv, Ukraine

Corresponding Author

Olha Shpur

ABSTRACT

In this paper, we proposed a method for detecting DDoS attacks in SDN networks. Since the SDN controller contains information about the network and can create rules for its proper functioning, we propose to configure the SDN controller to detect a possible DDoS attack by examining the session information based on information from logs and flow tables. The information from the logs will be transmitted to the Log Analysis Subsystem, where two independent analysis processes will be started. To achieve this goal, we divide session information into normal and abnormal using the entropy method. If traffic deviations are detected, which will indicate a DDoS attack, the Log Analysis Subsystem will transmit the information to the SDN controller, which will create a rule to block the harmful connection. To identify these connections, we suggest using the Kulbak-Labler approach to detect anomalies during the session so that the SDN controller can block the IP addresses suspected of a harmful connection.

KEYWORDS

Data analysis, log analysis, structured data, unstructured data, DDoS attacks, SDN

CITE THIS PAPER

Nazar Peleh, Stanislav Zhuravel, Olha Shpur and Olha Rybytska. Structured and Unstructured Log Analysis as a Methods to Detect DDoS Attacks in SDN networks. Internet of Things (IoT) and Engineering Applications (2021) 6: 1-9. DOI: http://dx.doi.org/10.23977/iotea.2021.060101.

REFERENCES

[1] Bawany, N., Shamsi, J. & Salah, K., 2017. DDoS Attack Detection and Mitigation Using SDN: Methods, Practices, and Solutions. Arabian Journal for Science and Engineering, Volume 42, p. 425–441.
[2] Braga, R., Mota, E. & Passito, A., 2010. Lightweight DDoS flooding attack detection using NOX/OpenFlow. Denver, s.n., p. 408–415.
[3] Dawoud, A., Shahristani, S. & Raun, C., 2018. Deep learning and software-defined networks: Towards secure IoT architecture. Internet of Things, Volume 3, p. 82–89.
[4] Giura, P. & Wang, W., 2012. Using large scale distributed computing to unveil advanced persistent threats. Science J, Volume 1, p. 93–105.
[5] Gonçalves, D., Bota, J. & Correia, M., 2015. Big data analytics for detecting host misbehavior in large logs. In: Trustcom/BigDataSE/ISPA, 2015 IEEE. s.l.:s.n., p. 238–245.
[6] Hu, Q., Tang, B. & Lin, D., 2017. Anomalous user activity detection in enterprise multi-source logs. New Orleans, LA, USA, s.n., p. 797–804.
[7] Klymash, M., Peleh, N., Shpur, O. & Hladun, S., 2020. Monitoring of Web Service Availability in Distributed Infocommunication Systems. Lviv-Slavske; Ukraine, s.n., p. 723–728.
[8] Landauer, M. et al., 2018. Dynamic log file analysis: An unsupervised cluster evolution approach for anomaly detection. Computers & Security, Volume 79, p. 94–116.
[9] Lin, H. & Wang, P., 2016. Implementation of an SDN-based security defense mechanism against DDoS attacks. Pennsylvania, s.n.
[10] Raj, A., Truong-Huu, T., Mohan, P. & Gurusamy, M., 2019. Crossfire Attack Detection using Deep Learning in Software Defined ITS Networks. Kuala, s.n.
[11] Saied, A., Overill, R. & Radzik, T., 2016. Detection of known and unknown DDoS attacks using Artificial Neural Networks. Neurocomputing, Volume 172, p. 385–393.
[12] Shu, X., Smiy, J., Yao, D. & Lin, H., 2013. Massive distributed and parallel log analysis for organizational security. In: 2013 IEEE Globecom Workshops (GC Wkshps). s.l.:s.n., p. 194–199.
[13] Smith, R., Zincir-Heywood, A., Heywood, M. & Jacobs, J., 2016. Initiating a Moving Target Network Defense with a Real-time Neuro-evolutionary Detector. New York, New York, USA, s.n., p. 1095–1102.
[14] Ten, C., Manimaran, G. & Liu, C., 2010. Cybersecurity for critical infrastructures: Attack and defense modeling. IEEE Transactions on Systems, Man, and Cybernetics - Part A: Systems and Humans, July, Volume 40, p. 853–865.
[15] Wang, X., Chen, M., Xing, C. & Zhang, T., 2016. Defending DDoS attacks in software-defined networking based on legitimate source and destination IP address database. IEICE Transaction on Information and Systems, Volume 99, p. 850–859.
[16] Yang, J., Wang, X. & Liu, L., 2016. Based on traffic and IP entropy characteristics of DDoS attack detection method. Application Research of Computers, Volume 33, p. 1145–1149.

Subscription
E-Mail Alert
Most popular papers
Call for Special Issue
Publication Ethics & OA Statement
Plagiarism Policy
Contact Us
Downloads: 818
Visits: 68492

Sponsors, Associates, and Links

All published work is licensed under a Creative Commons Attribution 4.0 International License.

Copyright © 2016 - 2031 Clausius Scientific Press Inc. All Rights Reserved.