Machine-learning-assisted DDoS attack detection with P4 language

While Software Defined Networking (SDN) provides well-known advantages in terms of network automation, flexibility and resources utilization, it has been observed that SDN controllers may represent critical points of failure for the entire network infrastructure, especially when they are targeted by malicious cyber attacks such as Distributed Denial of Service (DDoS). To address this issue, in this paper we exploit stateful data planes, as enabled by P4 programming language, where switches maintain persistent memory of handled packets to perform attack detection directly at the data plane, with only marginal involvement of the SDN controllers. As machine learning (ML) is recognized as primary anomaly detection methodology, we perform DDoS attack detection using a ML-based classification and compare different ML algorithms in terms of classification accuracy and train/test duration. Moreover, we combine ML and P4-enabled stateful data planes to design a real-time DDoS attack detection module, which we evaluate in terms of latency required for the detection. Three real-time scenarios are considered, where P4-enabled switches elaborate the received packets in different ways, namely, packet mirroring, header mirroring, and P4-metadata extraction. Numerical results show significant latency reduction when P4 is adopted.