Detection of distributed denial of service attacks in NFV environments using machine learning-based anomaly detection

Abstract

Objectives: The rise of Network Function Virtualization (NFV) has created a scalable, flexible alternative to traditional hardware-based networking infrastructures. However, due to the nature of NFV, there is a potential for an increased occurrence of Distributed Denial of Service (DDoS) attacks in a dynamic NFV environment and the need for adaptive security mechanisms capable of identifying DDoS attacks with high levels of accuracy. Through this research, the author intends to develop a machine learning (ML)-based anomaly detection framework that uses ML techniques to detect DDoS attacks accurately within an NFV environment.

Methodology: A ML model with the use of CICDDoS2019 (2020): Data (a dataset) includes data preprocessing, feature scaling, and principal component analysis (PCA), which are techniques for reducing the dimensions of the dataset and maintaining important features for analysis of traffic on the network in this article. Five ML models were developed from the training dataset: Isolation Forest, Autoencoder, One-Class Support Vector Machine (SVM), Random Forest (RF) and XGBoost (XG). An ensemble approach was also created to improve detection performance by combining three or more of these (or other) ML techniques. Findings from this research demonstrate that PCA can facilitate a reduction in dimensionality from 29 unique features to 24 unique principal components while preserving almost 95% of the variability in the original feature set. In addition, RF and XG were identified as the two highest-performing modeling algorithms, with each scoring a perfect “100” on all measures of performance (including accuracy, precision, recall, and F1) calculated. One-Class Support Vector Machine (OSVM) scored an average of 96%, and the composite of all three models (ensemble model) averaged 93% with a very limited ability to detect each of the different types of DDoS attacks with the same degree of confidence. Therefore, the results of this study support the use of the developed system for detection purposes for both previously known and unknown forms of DDoS attacks as well as increasing the overall level of reliability and resiliency against attacks targeting NFV infrastructure.

Novelty: This research presents a novel hybrid framework for anomaly detection in NFV by integrating supervised, unsupervised, and semi-supervised ML methods within a single NFV security architecture. In addition, the proposed method employs PCA for dimensionality reduction and ensemble learning to improve detection accuracy, adaptation to evolving attack patterns, and computational efficiency of detected anomalies, thereby providing a more effective means of defeating DDoS attacks within virtualized network environments.