Detección de ataques de denegación de servicio activados mediante botnets en redes definidas por software.

Abstract

In recent years, the volume of traffic circulating on public and private networks has increased thanks to the emergence of new online services. For this reason, networks periodically suffer from significant saturation and complexity problems. Additionally, the number of IoT devices connected to the network constantly grows. Thus, software-defined network (SDN) is a new architecture which offers innovative advantages that helps to reduce saturation problems. Despite its advantages, SDNs introduce new security challenges. Both traditional and SDNs networks are victims of the same types of attacks despite the difference in how their architecture works. On this context, Distributed Denial of Service (DDoS) is considered one of the most important attacks which can damage the normal operation of an SDN network. Furthermore, if these attacks are executed through the use of botnets, they can harness the power of thousands of compromised devices to overwhelm and disrupt critical online services. This paper proposes a framework for detecting DDoS attacks generated by a group of botnets in an SDN network. The framework is implemented using open-source tools such as Mininet and OpenDaylight and tested in a centralized network topology using BYOB and SNORT. The results of the experiments demonstrate that the system can rapidly identify an attack in real-time by implementing an intrusion detection mechanism in the victim client. Our proposed solution offers a quick and effective detection method against DDoS attacks in SDN networks. The framework can successfully differentiate the type of attack with high accuracy in a short time