ERT-EDR: Online defense framework for TCP-targeted LDoS attacks in SDN

The Low-rate denial of service (LDoS) attack is a variant of denial of service (DoS) attack that exploits low overhead to render target services unreachable for legitimate users. Unlike legacy networks, software-defined networking (SDN) separates the behavior of controlling and forwarding, providing excellent programmability to achieve real-time defense against LDoS attacks. Leveraging the potential of SDN’s programmability, we propose a real-time anomaly defense framework tailored for SDN, named ERT-EDR. This framework is capable of detecting and mitigating TCP-targeted LDoS Attacks and comprises three modules: (1) The Information Collection Module. It periodically samples the traffic statistics for analysis. (2) The LDoS Attack Detection Module. It combines six features of traffic statistics and utilizes the Extremely Randomized Trees (ERT) algorithm to detect. (3) LDoS Attack Mitigation Module. It locates attacked ports with the Edit Distance on Real sequence (EDR) algorithm and installs flow table entries to filter attack traffic. Extensive experiments are conducted under various background traffic scenarios to validate the effectiveness and scalability of ERT-EDR. The results demonstrate that ERT-EDR can effectively detect TCP-targeted LDoS attacks with 96.4667% accuracy and 96.4977% F1score. Furthermore, it accurately identifies the attacked port and successfully mitigates attacks. •Develop a robust and low-cost Detector against TCP-targeted Low-rate DoS attacks.•Leverage the aggregated traffic analysis to identify attack flows in Mitigator.•Only enable Mitigator after a determined detection to reduce the overhead.•Accurately target and block attack flows, preserving benign flows.