DDoS attacks based on SDN environment

Technological concepts & product/features discussed (DDoS in SDN)

DDoS overview / motivation

• DDoS (Distributed Denial of Service) is described as coordinating multiple machines/agents in different locations to send traffic toward one or more targets (e.g., websites, online services).
• Typical goals include:
  • Overwhelming bandwidth/resources so the victim service can’t respond
  • In some cases, causing broader network/system disruption

Why SDN is relevant (and risky)

The speaker frames Software-Defined Networking (SDN) as promising for addressing DDoS because it offers:

• Logical separation between the control plane and data plane
• Centralized/logic-based global visibility via a controller
• Traffic analysis/flow control capabilities

However, SDN can also be a target:

• SDN control components are part of the system, so securing the SDN architecture is important.

Example DDoS incidents referenced

• Feb 2020 (ABS site/service): a huge DDoS using “C… reflection” (likely DNS reflection/amplification or a similar reflection technique).
• 2016 (Mirai botnet era): Mirai referenced along with a large-scale attack on KrebsOnSecurity (described as ~120 Gbps with botnet size in the hundreds of thousands).
• 2012 (US banks): multiple banks affected; traffic generation described as coming via many compromised services. Even banks handling “some” scale may still be overwhelmed at higher rates.
• 2018 (GitHub/other platform referenced): DDoS frequency/rate around 1.35 Tbps, with amplification increasing attack traffic by ~51.2× (as stated).

---

DDoS mechanics (as components/attack flow)

DDoS system elements

Four elements are described:

1. Attacker / attacker control
2. Handler / manager controlling agents (described as “handle or mask…”)
3. Zombie / agent hosts executing the attack
4. Victim / target host

High-level steps of an attack

1. Select/choose the agent(s) that will run the DDoS
2. Scan/exploit a vulnerability on the target
3. Communicate status to the controlling handler
4. Issue the attack order and begin flooding

Classification of DDoS attacks

• Mentioned as a two-level classification:
  • First level: degree of automation, attackability/attack rate, and impact
  • Second level: specific characteristics within each category

---

SDN architecture (capabilities emphasized)

SDN definition

SDN is described as separating control plane vs. data plane to enable more flexible, intelligent traffic control.

Four-part SDN reference architecture (as described)

1. Data plane / separation role
2. Traffic detection/dissection
3. A logically centralized control entity (controller)
4. Network programming via software apps on top of the SDN platform

SDN advantages for defense

• Faster deployment/upgrade via decoupling application/equipment layers
• Simplified network abstraction and remote management
• Controller can obtain global network information to optimize detection and performance

---

SDN-based DDoS detection methods covered

The video lists mainstream detection/defense approaches for DDoS in SDN, including limitations and applicability.

1. Machine Learning-based detection

• Approaches using models such as decision trees / random forests are cited.
• Example framework described:
  • Traffic connection mode and DDoS identification mode
  • Controller-driven action: if attack traffic is identified, the controller drops packets; otherwise flows proceed normally.
• Another approach uses OpenFlow to help detection/prevention by controlling flows more effectively.

Stated limitation: ML performance depends on training data, so it’s more suitable for detecting abnormal behavior patterns.

2. Traffic-pattern (protocol analysis) approaches

• Traffic is analyzed using intrinsic message patterns and communication attributes.
• Mentions SDN traffic analysis architectures and experiments supporting scalable implementation.
• Requires assumptions about traffic structure/patterns.

3. Signature-rule IPS (Intrusion Prevention System)

• Uses Snort as an example open-source IPS.
• IPS behavior:
  • Rules define malicious activity
  • Generates alerts/logs and performs blocking
• Example described: multi-stage distributed detection/measurement/control using:
  • Snort + OpenFlow
  • To detect instructions/attacks and help prevent compromise of virtual machines in cloud/virtualized environments

4. Statistical measures / Entropy-based detection

• Entropy is used to capture randomness/uncertainty in packet attributes; abnormal entropy can indicate anomalous traffic.
• Mentions:
  • An entropy scoring system (“GSS”) to detect/mitigate DDoS
  • Entropy-based distributed detection using OpenFlow/SDN flow control
• Stated drawback: calculating entropy may lose some detailed information about traffic distribution.

---

Conclusion (structure of the write-up)

The speaker summarizes the project as:

• Discussing DDoS dangers
• Providing background on DDoS and SDN
• Explaining DDoS components and attack classification
• Discussing SDN advantages/disadvantages for DDoS defense
• Detailing SDN-based detection methods (ML, traffic pattern, IPS rules, entropy/statistics) and their limitations/applicability

Final claim: the research aims to support formulating reasonable control/defense measures for the community.

---

Main speakers/sources

Speaker/Source

• The main presenter is the author/creator of the project, speaking directly throughout the video (e.g., “I will introduce my project…”).

Referenced technologies/tools & sources mentioned

• OpenFlow, SDN controller
• Snort (IPS)
• Machine learning models (decision trees, random forests)
• Entropy-based scoring (an entropy scoring unit/system)
• Incidents referenced by context: Mirai botnet, an AWS-related incident, bank DDoS, a GitHub/other platform incident

Named external groups

• Mentions such as “in Young’s group”, “another group”, “in trans group”, “in K group” appear, but specific full names beyond “group” are not clearly provided in subtitles.