A GRU deep learning system against attacks in software defined networks

[EN] The management of modern network environments is becoming more and more complex due to new requirements of devices' heterogeneity regarding the popularization of the Internet of Things (IoT), as well as the dynamic traffic required by next-generation applications and services. To addre...

Descripción completa

Detalles Bibliográficos
Autores: Assis, Marcos V.O., Carvalho, Luiz F., Proença Jr, Mario L., Lloret, Jaime|||0000-0002-0862-0533
Tipo de recurso: artículo
Fecha de publicación:2021
País:España
Institución:Universitat Politècnica de València (UPV)
Repositorio:RiuNet. Repositorio Institucional de la Universitat Politécnica de Valéncia
Idioma:inglés
OAI Identifier:oai:riunet.upv.es:10251/189732
Acceso en línea:https://riunet.upv.es/handle/10251/189732
Access Level:acceso abierto
Palabra clave:Gated recurrent units
SDN
Deep learning
DDoS
Intrusion detection
INGENIERIA TELEMATICA
id ES_6dfd2989dfd6dd9a637dcc0be5abc963
oai_identifier_str oai:riunet.upv.es:10251/189732
network_acronym_str ES
network_name_str España
repository_id_str
spelling A GRU deep learning system against attacks in software defined networksAssis, Marcos V.O.Carvalho, Luiz F.Proença Jr, Mario L.Lloret, Jaime|||0000-0002-0862-0533Gated recurrent unitsSDNDeep learningDDoSIntrusion detectionINGENIERIA TELEMATICA[EN] The management of modern network environments is becoming more and more complex due to new requirements of devices' heterogeneity regarding the popularization of the Internet of Things (IoT), as well as the dynamic traffic required by next-generation applications and services. To address this problem, Software-defined Networking (SDN) emerges as a management paradigm able to handle these problems through a centralized high-level network approach. However, this centralized characteristic also creates a critical failure spot since the central controller may be targeted by malicious users aiming to impair the network operation. This paper proposes an SDN defense system based on the analysis of single IP flow records, which uses the Gated Recurrent Units (GRU) deep learning method to detect DDoS and intrusion attacks. This direct flow inspection enables faster mitigation responses, minimizing the attack's impact over the SDN. The proposed model is tested against several different machine learning approaches over two public datasets, the CICDDoS 2019 and the CICIDS 2018. Furthermore, a lightweight mitigation approach is presented and evaluated through performance tests regarding each detection method. Finally, a feasibility test is performed regarding the throughput of flows per second that each detection method can analyze. This test is accomplished through the use of real IP Flow data collected at a large-scale network. The results point out promising detection rates and an elevated amount of analyzed flows per second, which makes GRU a feasible approach for the proposed system.This study has been partially supported by the National Council for Scientific and Technological Development (CNPq) of Brazil under Grant of Project 310668/2019-0; by the "Ministerio de Economia y Competitividad" in the "Programa Estatal de Fomento de la Investigacion Cientifica y Tecnica de Excelencia, Subprograma Estatal de Generacion de Conocimiento" within the project under Grant TIN2017-84802-C2-1-P; and by the Coordenacao de Aperfeicoamento de Pessoal de Nivel Superior (CAPES) by the granting of a scholarship through the "Programa de Doutorado Sanduiche no Exterior (PDSE) 2019". Finally, this work was supported by Federal University of Parana (UFPR) under Project Banpesq/2014016797.ElsevierDepartamento de ComunicacionesEscuela Politécnica Superior de GandiaUniversidade Federal do ParanáAgencia Estatal de InvestigaciónCoordenaçao de Aperfeiçoamento de Pessoal de Nível Superior, BrasilConselho Nacional de Desenvolvimento Científico e Tecnológico, BrasilRepositorio Institucional de la Universitat Politècnica de València Riunet20212021-03-01journal articlehttp://purl.org/coar/resource_type/c_6501VoRhttp://purl.org/coar/version/c_970fb48d4fbd8a85info:eu-repo/semantics/articleapplication/pdfapplication/pdfhttps://riunet.upv.es/handle/10251/189732reponame:RiuNet. Repositorio Institucional de la Universitat Politécnica de Valénciainstname:Universitat Politècnica de València (UPV)InglésengAgencia Estatal de Investigación http://dx.doi.org/10.13039/501100011033 Plan Estatal de Investigación Científica y Técnica y de Innovación 2013-2016 TIN2017-84802-C2-1-P RED COGNITIVA DEFINIDA POR SOFTWARE PARA OPTIMIZAR Y SECURIZAR TRAFICO DE INTERNET DE LAS COSAS CON INFORMACION CRITICAConselho Nacional de Desenvolvimento Científico e Tecnológico, Brasil https://doi.org/10.13039/501100003593 310668%2F2019-0UFPR UFPR Banpesq%2F2014016797open accesshttp://purl.org/coar/access_right/c_abf2Reconocimiento - No comercial - Sin obra derivada (by-nc-nd) http://creativecommons.org/licenses/by-nc-nd/4.0/info:eu-repo/semantics/openAccessoai:riunet.upv.es:10251/1897322026-06-13T07:49:27Z
dc.title.none.fl_str_mv A GRU deep learning system against attacks in software defined networks
title A GRU deep learning system against attacks in software defined networks
spellingShingle A GRU deep learning system against attacks in software defined networks
Assis, Marcos V.O.
Gated recurrent units
SDN
Deep learning
DDoS
Intrusion detection
INGENIERIA TELEMATICA
title_short A GRU deep learning system against attacks in software defined networks
title_full A GRU deep learning system against attacks in software defined networks
title_fullStr A GRU deep learning system against attacks in software defined networks
title_full_unstemmed A GRU deep learning system against attacks in software defined networks
title_sort A GRU deep learning system against attacks in software defined networks
dc.creator.none.fl_str_mv Assis, Marcos V.O.
Carvalho, Luiz F.
Proença Jr, Mario L.
Lloret, Jaime|||0000-0002-0862-0533
author Assis, Marcos V.O.
author_facet Assis, Marcos V.O.
Carvalho, Luiz F.
Proença Jr, Mario L.
Lloret, Jaime|||0000-0002-0862-0533
author_role author
author2 Carvalho, Luiz F.
Proença Jr, Mario L.
Lloret, Jaime|||0000-0002-0862-0533
author2_role author
author
author
dc.contributor.none.fl_str_mv Departamento de Comunicaciones
Escuela Politécnica Superior de Gandia
Universidade Federal do Paraná
Agencia Estatal de Investigación
Coordenaçao de Aperfeiçoamento de Pessoal de Nível Superior, Brasil
Conselho Nacional de Desenvolvimento Científico e Tecnológico, Brasil
Repositorio Institucional de la Universitat Politècnica de València Riunet
dc.subject.none.fl_str_mv Gated recurrent units
SDN
Deep learning
DDoS
Intrusion detection
INGENIERIA TELEMATICA
topic Gated recurrent units
SDN
Deep learning
DDoS
Intrusion detection
INGENIERIA TELEMATICA
description [EN] The management of modern network environments is becoming more and more complex due to new requirements of devices' heterogeneity regarding the popularization of the Internet of Things (IoT), as well as the dynamic traffic required by next-generation applications and services. To address this problem, Software-defined Networking (SDN) emerges as a management paradigm able to handle these problems through a centralized high-level network approach. However, this centralized characteristic also creates a critical failure spot since the central controller may be targeted by malicious users aiming to impair the network operation. This paper proposes an SDN defense system based on the analysis of single IP flow records, which uses the Gated Recurrent Units (GRU) deep learning method to detect DDoS and intrusion attacks. This direct flow inspection enables faster mitigation responses, minimizing the attack's impact over the SDN. The proposed model is tested against several different machine learning approaches over two public datasets, the CICDDoS 2019 and the CICIDS 2018. Furthermore, a lightweight mitigation approach is presented and evaluated through performance tests regarding each detection method. Finally, a feasibility test is performed regarding the throughput of flows per second that each detection method can analyze. This test is accomplished through the use of real IP Flow data collected at a large-scale network. The results point out promising detection rates and an elevated amount of analyzed flows per second, which makes GRU a feasible approach for the proposed system.
publishDate 2021
dc.date.none.fl_str_mv 2021
2021-03-01
dc.type.none.fl_str_mv journal article
http://purl.org/coar/resource_type/c_6501
VoR
http://purl.org/coar/version/c_970fb48d4fbd8a85
dc.type.openaire.fl_str_mv info:eu-repo/semantics/article
format article
dc.identifier.none.fl_str_mv https://riunet.upv.es/handle/10251/189732
url https://riunet.upv.es/handle/10251/189732
dc.language.none.fl_str_mv Inglés
eng
language_invalid_str_mv Inglés
language eng
dc.relation.none.fl_str_mv Agencia Estatal de Investigación http://dx.doi.org/10.13039/501100011033 Plan Estatal de Investigación Científica y Técnica y de Innovación 2013-2016 TIN2017-84802-C2-1-P RED COGNITIVA DEFINIDA POR SOFTWARE PARA OPTIMIZAR Y SECURIZAR TRAFICO DE INTERNET DE LAS COSAS CON INFORMACION CRITICA
Conselho Nacional de Desenvolvimento Científico e Tecnológico, Brasil https://doi.org/10.13039/501100003593 310668%2F2019-0
UFPR UFPR Banpesq%2F2014016797
dc.rights.none.fl_str_mv open access
http://purl.org/coar/access_right/c_abf2
Reconocimiento - No comercial - Sin obra derivada (by-nc-nd)
http://creativecommons.org/licenses/by-nc-nd/4.0/
dc.rights.openaire.fl_str_mv info:eu-repo/semantics/openAccess
rights_invalid_str_mv open access
http://purl.org/coar/access_right/c_abf2
Reconocimiento - No comercial - Sin obra derivada (by-nc-nd)
http://creativecommons.org/licenses/by-nc-nd/4.0/
eu_rights_str_mv openAccess
dc.format.none.fl_str_mv application/pdf
application/pdf
dc.publisher.none.fl_str_mv Elsevier
publisher.none.fl_str_mv Elsevier
dc.source.none.fl_str_mv reponame:RiuNet. Repositorio Institucional de la Universitat Politécnica de Valéncia
instname:Universitat Politècnica de València (UPV)
instname_str Universitat Politècnica de València (UPV)
reponame_str RiuNet. Repositorio Institucional de la Universitat Politécnica de Valéncia
collection RiuNet. Repositorio Institucional de la Universitat Politécnica de Valéncia
repository.name.fl_str_mv
repository.mail.fl_str_mv
_version_ 1869410392713723904
score 15.300724

Similares en LA Referencia