ERT-EDR: Online defense framework for TCP-targeted LDoS attacks in SDN

Low-rate denial of service (LDoS) attacks are a variant of denial of service (DoS) attacks that render target services unreachable for legitimate users at a lower cost. Unlike legacy networks, software-defined networking (SDN) separates the behavior of controlling and forwarding, providing excellent programmability to achieve real-time defense against LDoS attacks. Leveraging the potential of SDN's programmability, we propose a real-time anomaly defense framework tailored for SDN, named ERT-EDR. This framework is capable of detecting and mitigating TCP-targeted LDoS Attacks and comprises three modules: (1) The Information Collection Module. It periodically samples the traffic statistics for analysis. (2) The LDoS Attack Detection Module. It combines six features of traffic statistics and utilizes the Extremely Randomized Trees (ERT) algorithm to detect. (3) LDoS Attack Mitigation Module. It locates attacked ports with the Edit Distance on Real sequence (EDR) algorithm and installs flow table entries to filter attack traffic. Extensive experiments are conducted under various background traffic scenarios to validate the effectiveness and scalability of ERT-EDR. The results demonstrate that ERT-EDR can effectively detect TCP-targeted LDoS attacks with 96.4667% accuracy and 96.4977% F1score. Furthermore, it accurately identifies the attacked port and successfully mitigates attacks.