Distributed Denial of Service (DDoS) attacks have been a serious cybercrime attack for decades and are one of the most disturbing areas of cyber security due to their disguising nature. Cisco predicted that attack frequency will be doubled from 7.9 million in 2018 to 15 million by 2023, and the financial hit of DDoS attacks on Information Technology (IT) services will cost from $300,000 to over $1,000,000 per hour. So, it is very important to handle DDoS attacks at the early stages. Various researchers focused on the problem of early detection of DDoS attacks in the SDN environment, but the performance of the actuators in the data plane was not discussed. Moreover, the deployment of the Intrusion Detection System (IDS) framework in high-speed networks reveals challenges concerning network monitoring issues and network security problems. This research begins with a qualitative analysis of various DDoS attacks, intending to present the best single feature for rapid DDoS detection based on a mathematical derivation. Then the study continues with qualitative analysis of the proposed feature by evaluating a framework consisting of a data generation module, various feature selection methods, various machine learning methods for binary classification of normal traffic and attack traffic, and a multi-label classification Artificial Neural Network (ANN) model for identifying different attacks through various extracted features.

Full text: IJEIR_2964_FINAL.pdf