论文标题
Oracle：数据和控制飞机的协作以检测DDOS攻击
ORACLE: Collaboration of Data and Control Planes to Detect DDoS Attacks
论文作者
论文摘要
由软件定义的网络（SDN）范式启用的控制和数据平面编程的可能性代表了可以充分探索新型操作和管理机制的肥沃场所，并根据机器学习技术的重点分布了拒绝服务（DDOS）攻击检测。为了进行检测，本文提出了Oracle：数据和控制平面以检测DDOS攻击的协作，DDOS攻击是一种促进控制和数据平面协调以检测网络攻击的体系结构。作为其第一个贡献，该体系结构将每个流量收集的流量信息的提取和处理委派给数据平面。这样做是为了简化攻击检测中使用的功能集的计算和分类，因为当它到达控制平面时，已经处理了所需的流程信息。此外，作为第二个贡献，该体系结构打破了计算某些在传统基于OpenFlow的环境中实现的功能的局限性。在评估Oracle时，我们使用K-Neartible邻居模型在测试阶段获得了多达96％的精度。
The possibility of programming the control and data planes, enabled by the Software-Defined Networking (SDN) paradigm, represents a fertile ground on top of which novel operation and management mechanisms can be fully explored, being Distributed Denial of Service (DDoS) attack detection based on machine learning techniques the focus of this work. To carry out the detection, this paper proposes ORACLE: cOllaboRation of dAta and Control pLanEs to detect DDoS attacks, an architecture that promotes the coordination of control and data planes to detect network attacks. As its first contribution, this architecture delegates to the data plane the extraction and processing of traffic information collected per flow. This is done in order to ease the calculation and classification of the feature set used in the attack detection, as the needed flow information is already processed when it arrives at the control plane. Besides, as the second contribution, this architecture breaks the limitations to calculate some features that are not possible to implement in a traditional OpenFlow-based environment. In the evaluation of ORACLE, we obtained up to 96% of accuracy in the testing phase, using a K-Nearest Neighbor model.
