DeepAD: Propose a new DNN activation function to improve DDoS attack detection in SDN

Abstract

Software-defined networks (SDNs) play a fundamental role in the core infrastructure of 5G networks. Therefore, the concern for SDN security has become critical, and DDoS attacks are one of the most significant threats to SDN as the attacker focuses on a single point, which is the controller, and thus leads to the failure of the entire network. In this study, we present Deep Attack Detection (DeepAD), a novel approach to detect DDoS attacks using a deep neural network with a novel activation function. The proposed activation function, SETAF, is based on the features of exponential and sigmoid functions as well as dynamic thresholding and thus adapts to traffic changes and is able to distinguish different DDoS attack patterns. The DeepAD model is implemented and tested on the CICIDS2017 dataset. In addition, the proposed model using SETAF activation function is compared with the standard sigmoid activation function and the loss function ratio is less than 0.01 with an accuracy of 0.99. On the other hand, the proposed DeepAD model was implemented on an SDN environment using Mininet emulator and POX controller, and the experimental results proved the effectiveness of the DeepAD approach in significantly improving the accuracy and speed of DDoS detection.