SrcTCAM-Def : A Source-based Detection System against Slow-Rate TCAM DDoS Attacks in SDN

Software Defined Networking (SDN) is widely used in diverse domains like 5G, IoT, and cloud computing. However, SDN suffers from TCAM (Ternary Content Addressable Memory) DDoS attacks. In such attacks, a malicious host installs the flow rules periodically in TCAM memory of switches, resulting in TCAM saturation. There are many solutions against this kind of attacks; most of them are based on flow level analysis. Such solutions analyse each flow rule if they are malicious by using flow-level features with Machine Learning (ML) or Deep Learning (DL) methods; consequently, these methods are both time and resource consuming. Exiting approaches also do not identify the source of attacks. To address these kind of challenges, we propose SrcTCAM-Def, a source-based lightweight detection system. The attacker uses its own IP address to conduct the attack. This is because an attacker needs a consistent bidirectional traffic flow to maintain the flow rules in the flow tables and avoid rule expiry by sending packets periodically. Once this is observed, the proposed solution keeps track of the activity of each host with respect to source IP utilizing the novel features such as packet rate per source IP, byte rate per source IP, proportion of flow entries with low packet counts per source IP, proportion of flow entries with long-lived per source IP, Port count growth per source IP, pattern of packet in rate per source IP. Our experiments demonstrate that SrcTCAM-Def improves detection accuracy by 5–6% when compared with existing solutions. In addition, due to the reduced number of source-IP-based records compared to flow-level records, CPU utilization and detection time are also improved by 10–12% and 7–8%, respectively.