Cloud computing is a rapidly advancing technology with numerous benefits, such as increased availability, scalability, and flexibility. Relocating computing infrastructure to a network simplifies hardware and software resource monitoring in the cloud. Software-Defined Networking (SDN)-based cloud networking improves cloud infrastructure efficiency by dynamically allocating and utilizing network resources. While SDN cloud networks offer numerous advantages, they are vulnerable to Distributed Denial-of-Service (DDoS) attacks. DDoS attacks try to stop genuine users from using services and drain network resources to reduce performance or shut down services. However, early-stage detection of DDoS attack patterns in cloud environments remains challenging. Current methods detect DDoS at the SDN controller level, which is often time-consuming. We recommend focusing on SDN switches for early detection. Due to the large volume of data from diverse sources, we recommend traffic clustering and traffic anomalies prediction which is of DDoS attacks at each switch. Furthermore, to consolidate the data from multiple clusters, event correlation is performed to understand network behavior and detect coordinated attack activities. Many existing techniques stay behind for early detection and integration of multiple techniques to detect DDoS attack patterns. In this paper, we introduce a more efficient and effectively integrated SDN framework that addresses a gap in previous DDoS solutions. Our framework enables early and accurate detection of DDoS traffic patterns within SDN-based cloud environments. In this framework, we use Recursive Feature Elimination (RFE), Density Based Spatial Clustering (DBSCAN), time series techniques like Auto Regressive Integrated Moving Average (ARIMA), Lyapunov exponent, exponential smoothing filter, dynamic threshold, and lastly, Rule-based classifier. We have evaluated the proposed RDAER model on the CICDDoS 2019 dataset, that achieved an accuracy level of 99.92% and a fast detection time of 20 s, outperforming existing methods.

中文翻译：

---

用于早期检测云计算中的 DDoS 攻击的集成 SDN 框架

云计算是一项快速发展的技术，具有许多优点，例如更高的可用性、可扩展性和灵活性。将计算基础设施重新定位到网络可以简化云中的硬件和软件资源监控。基于软件定义网络（SDN）的云网络通过动态分配和利用网络资源来提高云基础设施的效率。虽然 SDN 云网络具有众多优势，但它们很容易受到分布式拒绝服务 (DDoS) 攻击。DDoS 攻击试图阻止真正的用户使用服务并耗尽网络资源以降低性能或关闭服务。然而，云环境中 DDoS 攻击模式的早期检测仍然具有挑战性。当前的方法在 SDN 控制器级别检测 DDoS，这通常非常耗时。我们建议重点关注 SDN 交换机以进行早期检测。由于来自不同来源的大量数据，我们建议对每个交换机进行流量聚类和流量异常预测，即 DDoS 攻击。此外，为了整合来自多个集群的数据，执行事件关联以了解网络行为并检测协调的攻击活动。许多现有技术仍无法实现早期检测和集成多种技术来检测 DDoS 攻击模式。在本文中，我们介绍了一种更高效、更有效集成的 SDN 框架，该框架弥补了先前 DDoS 解决方案中的空白。我们的框架能够在基于 SDN 的云环境中及早准确地检测 DDoS 流量模式。在此框架中，我们使用递归特征消除（RFE）、基于密度的空间聚类（DBSCAN）、自回归积分移动平均（ARIMA）等时间序列技术、李雅普诺夫指数、指数平滑滤波器、动态阈值，最后，基于规则分类器。我们在 CICDDoS 2019 数据集上评估了所提出的 RDAER 模型，其准确率达到 99.92%，检测时间为 20 秒，优于现有方法。