Attack Detection and Prediction Using Machine Learning

Data plane and control plane are divided by Software Defined Networking (SDN). A centralized controller oversees and manages the entire network. With SDN, the network may be programmed and flow regulations can be created dynamically. Numerous benefits including adaptability, programmability, and centralized management are offered by this decoupling. However, SDN also creates new vulnerabilities as a result of desired data plane and control plane connectivity. Attacks on switch buffer overflows and control plane saturation are two examples of threats that exploit such flaws. The controller is vulnerable to Distributed Denial of Service (DDoS) attacks, which induce resource exhaustion and impair the controller's capacity to provide services. By flooding the control plane with TCP SYN packets from the data plane (i.e., switches), several attacks can be launched. SVM is the most popular and often used classifier, both for classification and regression, thanks to its high accuracy and low false positive rate. For DDoS detection, the SVM classifier is examined and contrasted with other classifiers. In order to identify anomalies, such as malicious traffic, and report them, Snort, an intrusion detection system, examines the traffic and packets. The entropy approach is used to assess the flow data's randomness. An IP address for the intended recipient and a few TCP flag attributes make up the entropy information. We implement it as an additional module in the Floodlight Controller and assess its viability and efficacy. We thoroughly evaluate how we have implemented things via Mininet, substantial emulation.