Search papers, labs, and topics across Lattice.
This paper addresses the challenge of Distributed Denial-of-Service (DDoS) detection in multi-controller Software-Defined Networking (SDN) environments, where attack traffic can originate from multiple domains but target a single aggregation controller. The authors identify an aggregation bias that leads to excessive false positives during the post-attack transition phase, caused by the lag in OpenFlow statistics and dynamic-threshold drift. They propose a cross-domain confidence-fusion framework that effectively calibrates aggregation-controller decisions using lightweight edge-side messages, resulting in a significant reduction of false positives and an improved F1 score in experimental evaluations.
False positives in DDoS detection drop from 8.87% to 1.96% by leveraging edge-side messages for smarter aggregation in multi-controller SDN environments.
In multi-controller Software-Defined Networking (SDN), Distributed Denial-of-Service (DDoS) attacks exhibit a"dispersed source, concentrated target"pattern across domains, i.e., attack traffic originates from multiple edge-controller domains but converges on a victim in a single aggregation controller domain. While entropy-based DDoS detectors are effective in single-controller settings, their direct application in multi-controller SDN reveals a previously overlooked anomaly. Through systematic experiments, we identify an aggregation bias: during the post-attack transition phase, the aggregation controller continues to generate excessive false positives, while edge controllers have already returned to normal. We attribute this phenomenon to the coupled effects of OpenFlow statistics lag and unconstrained dynamic-threshold drift. To address this issue, we propose a cross-domain confidence-fusion framework that leverages lightweight edge-side messages to calibrate aggregation-controller decisions without sharing raw traffic data. The framework is non-intrusive, communication-efficient, and incrementally deployable. Experiments on a three-controller linear Mininet testbed with 24 hosts over 10 runs show that the method preserves edge-controller performance while reducing the aggregation false positive rate from 8.87% to 1.96% and increasing the F1 score from 89.04% to 96.89%.
