A new class of link flooding attacks (LFA) can cut off internet connections of target links by employing legitimate flows to congest these without being detected. LFA is especially powerful in disrupting traffic in software-defined networks if the control channel is targeted. Most of the existing solutions work by conducting a deep packet-level inspection of the physical network links. Therefore these techniques incur a significant performance overhead, are reactive, and result in damage to the network before a delayed defense is mounted. Machine learning (ML) of captured network statistics is emerging as a promising, lightweight, and proactive solution to defend against LFA. In this paper, we propose a ML-based security framework, CyberPulse++, that utilizes a pretrained ML repository to test captured network statistics in real-time to detect abnormal path performance on network links. It effectively tackles several challenges faced by network security solutions such as the practicality of large-scale network-level monitoring and collection of network status information. The framework can use a wide variety of algorithms for training the ML repository and allows the analyst a birds-eye view by generating interactive graphs to investigate an attack in its ramp-up stage. An extensive evaluation demonstrates that the framework offers limited bandwidth and computational overhead in proactively detecting and defending against LFA in real-time.

中文翻译：

---

Cyber​​Pulse++：一种基于机器学习的安全框架，用于检测软件定义网络中的链路泛洪攻击

一类新的链路泛洪攻击 (LFA) 可以通过使用合法流在不被检测到的情况下拥塞这些链路来切断目标链路的互联网连接。如果以控制通道为目标，LFA 在中断软件定义网络中的流量方面尤其强大。大多数现有解决方案通过对物理网络链接进行深度数据包级检查来工作。因此，这些技术会导致显着的性能开销，是被动的，并在延迟防御安装之前导致网络损坏。捕获的网络统计数据的机器学习 (ML) 正在成为一种有前途的、轻量级的、主动的解决方案，以防御 LFA。在本文中，我们提出了一个基于 ML 的安全框架 Cyber​​Pulse++，它利用预训练的 ML 存储库实时测试捕获的网络统计数据，以检测网络链路上的异常路径性能。它有效地解决了网络安全解决方案面临的大规模网络级监控和网络状态信息收集的实用性等多项挑战。该框架可以使用多种算法来训练 ML 存储库，并通过生成交互式图形来让分析师鸟瞰图，以调查其上升阶段的攻击。广泛的评估表明，该框架在实时主动检测和防御 LFA 方面提供了有限的带宽和计算开销。它有效地解决了网络安全解决方案面临的大规模网络级监控和网络状态信息收集的实用性等多项挑战。该框架可以使用多种算法来训练 ML 存储库，并通过生成交互式图形来让分析师鸟瞰图，以调查其上升阶段的攻击。广泛的评估表明，该框架在实时主动检测和防御 LFA 方面提供了有限的带宽和计算开销。它有效地解决了网络安全解决方案面临的大规模网络级监控和网络状态信息收集的实用性等多项挑战。该框架可以使用多种算法来训练 ML 存储库，并通过生成交互式图形来让分析师鸟瞰图，以调查其上升阶段的攻击。广泛的评估表明，该框架在实时主动检测和防御 LFA 方面提供了有限的带宽和计算开销。