Sistema inteligente para identificar ataques de denegación de servicio (DoS/DDoS) y Man-in-the-Middle (MitM) para una red definida por software (SDN)

Abstract

Global trends in the adoption and implementation of Software-Defined Networking (SDN) have provided companies and organizations across various sectors with greater scalability, allowing them to quickly adjust network architecture and capacity to meet the evolving needs of their applications and services. They have also facilitated more centralized management of network resources, resulting in greater efficiency and cost savings [1]. However, it is important to note that SDN networks, like traditional networks, are susceptible to cyberattacks. These attacks not only aim to compromise, damage, or disrupt computer systems and services, causing unavailability, but can also steal, hijack, or destroy sensitive data. Given this scenario, the objective of this project was to develop an intelligent system capable of automatically detecting and identifying DoS (denial of service), DDoS (distributed denial of service), and MitM (man-in-the-middle) attacks in software-defined networks (SDN) by analyzing network traffic. As a solution, an SDN network based on Mininet and the Ryu controller was designed, enabling the simulation of various normal and anomalous traffic scenarios, as well as the collection of network behavior metrics. These metrics were preprocessed and used to train and evaluate supervised machine learning models for the classification of normal and anomalous traffic. The best-performing model, a deep neural network, was integrated with an Application Programming Interface (API) to evaluate its performance as an anomaly detection system within the simulation environment. In the validation process of the anomaly detection system, it was found that the evaluation metrics obtained, including precision, recall, F1-score, and support, had values ​​above 90%, indicating high performance of the proposed system. Additionally, the confusion matrix showed a high concentration of values ​​on the main diagonal, reflecting correct classification of most samples. Finally, when analyzing the impact of implementing this system, it was found that there were no significant variations in throughput, latency, and packet loss metrics when compared to the scenario without the anomaly detection system.