Keywords: SDN (architecture des réseaux d'ordinateurs), Réseaux à grande distance (informatique), Tests d Software-defined networking (Computer network technology), Wide area networks (Computer networks), Penetration testing (Computer security), Supervised learning (Machine learning), Blockchains DDoS, Entropy, Bayes Classifier, SDN, intra-domain mitigation, interdomain collaboration, Blockchain technology, Smart contracts DDoS, IDS, Federated Learning, SDN, inter-domain mitigation, Blockchain, SMPC, Smart contracts

La conception originale d'Internet n'a pas pris en compte les aspects de sécurité du réseau; l'objectif prioritaire était de faciliter le processus de communication. Par conséquent, de nombreux protocoles de l'infrastructure Internet exposent un ensemble de vulnérabilités. Ces dernières peuvent être exploitées par les attaquants afin de mener un ensemble d'attaques. Les attaques par déni de service distribué (Distributed Denial of Service ou DDoS) représentent une grande menace et l'une des attaques les plus dévastatrices causant des dommages collatéraux aux opérateurs de réseau ainsi qu'aux fournisseurs de services Internet.

Les réseaux programmables, dits Software-Defined Networking (SDN), ont émergé comme un nouveau paradigme promettant de résoudre les limitations de l'architecture réseau actuelle en découplant le plan de contrôle du plan de données. D'une part, cette séparation permet un meilleur contrôle du réseau et apporte de nouvelles capacités pour mitiger les attaques par déni de service distribué. D'autre part, cette séparation introduit de nouveaux défis en matière de sécurité du plan de contrôle.

L'enjeu de cette thèse est double. D'une part, étudier et explorer l'apport de SDN à la sécurité afin de concevoir des solutions efficaces qui vont mitiger plusieurs vecteurs d'attaques. D'autre part, protéger SDN contre ces attaques. À travers ce travail de recherche, nous contribuons à la mitigation des attaques par déni de service distribué sur deux niveaux (intra-domaine et inter-domaine), et nous contribuons au renforcement de l'aspect sécurité dans les réseaux programmables.

Liste des figures

Liste des sigles et des abréviations

Remerciements

Je tiens à remercier mes directeurs de recherche, le professeur Abdelhakim Senhaji Hafid et le professeur Lyes Khoukhi, pour leur grande disponibilité, leur confiance, et leur consignes précieuses. Leurs directives m'ont permis de mener à bien ce travail. J'aimerais également leur exprimer toute ma gratitude et ma reconnaissance pour leur contributions à ce travail.

Je remercie l'Université de Technologie de Troyes ainsi que l'Université de Montréal de m'avoir accueillie comme étudiant au doctorat. Je remercie également tous mes collègues au Laboratoire des Réseaux de Communications (LRC) et d'ERA. Je remercie tout particulièrement mes amis Hajar, Amir et Achraf pour leur encouragements tout au long de mes recherches doctorales.

Je tiens à présenter mon profond respect et remerciement aux membres du jury pour leur bienveillance à bien vouloir évaluer mon travail.

Enfin, je remercie mes parents, mon frère Younes et sa femme Salima, ma soeur Houda et ma tante Asma pour leur grand support, leur soutien, et leur encouragements.

À mon père Omar Abou El Houda, À ma mère Latifa Derraji, À toute ma famille.

Chapitre 1 Introduction

Avant d'entamer la réalisation de cette thèse, il est essentiel de la contextualiser afin d'avoir une vision claire sur le mécanisme de défense à mettre en place, les différents enjeux, ainsi que le paradigme SDN et sa puissance. C'est dans cette optique que s'inscrit ce chapitre qui sera abordé en plusieurs phases. Nous commençons d'abord par présenter le contexte generale de cette thèse. Par la suite, nous étudions les différents vecteurs d'attaques ainsi que les moyens disponibles pour contrer ces attaques. Nous aborderons les motivations et les objectifs de cette thèse. Nous présentons les contributions apportées par cette thèse. Enfin, nous présenterons l'organisation de cette thèse.

Contexte générale

Internet est un élément critique qui est devenu un réseau universel de communication. Il devient également la cible principale d'attaques. Il présente une sensibilité accrue à leurs impacts. Il ne se passe plus une semaine sans que l'on apprenne que tel organisme ou tel institut a subi de lourdes pertes financières en raison d'une déficience de la sécurité de son système d'informations. Par conséquent, les grands organismes ne peuvent plus ignorer ces risques et se croire à l'abri de telles menaces. Aujourd'hui, les attaques par déni de service distribué sont fréquentes, notamment du fait de la relative simplicité de leur mise en oeuvre. Elles sont efficaces contre des cibles non sécurisées. Ces attaques détériorent la qualité de service (QoS) du réseau visé, épuisent les ressources matérielles et peuvent engendrer des pertes financières importantes à cause de l'interruption de service. Pour cette raison, il est nécessaire d'anticiper cette menace, d'établir une modélisation de tous les chemins qui peuvent réussir ces attaques, et de prendre un certain nombre de mesures techniques et organisationnelles afin d'y faire face. Les travaux de cette thèse s'inscrivent dans les thématiques des réseaux logiciels, dits Software-Defined Networking (SDN). SDN rend les réseaux actuels programmables et fournit plusieurs avantages telles que la connaissance globale, la gestion centralisée et l'abstraction du réseau. SDN est un paradigme novateur qui permet de développer des nouveaux services de sécurité plus efficaces.

Dans cette section, nous introduisons le paradigme SDN. Par la suite, nous aborderons les avantages et les défis de cette approche. Et enfin, nous évoquons une brève présentation du protocole OpenFlow.

Réseaux programmables (Software-Defined Networking)

SDN est un nouveau paradigme qui sépare les fonctions de contrôle (control plane) et les fonctions de transfert de données du réseau (data plane), afin d'avoir une infrastructure physique exempte de tout service réseau. Il y a quatre composantes principales qui définissent l'architecture SDN: (1) la séparation du plan de contrôle du plan de données; (2) la programmabilité du réseau; (3) l'abstraction du réseau physique; et (4) la centralisation des fonctions de contrôle.

SDN se rapporte aux anciennes recherches sur les réseaux de futures. Par exemple, le réseau actif (active Networking (1990)) est un mode de communication permettant aux paquets circulant dans un réseau de modifier dynamiquement l'exploitation du réseau. Le réseau actif se compose: (1) un matériel actif, capable de faire le routage/la commutation; et (2) du code exécuté dans les paquets actifs. La différence principale entre le réseau actif et SDN est que le réseau actif met en place des calculs dans les paquets qui traversent le réseau, tandis que SDN découple le système qui prend les décisions du plan de données. Le réseau actif offre la possibilité d'effectuer des changements en temps réel dans le réseau. Cependant, il souffre de plusieurs problématiques: (1) pas d'application claire; (2) coût élevé du matériel; (3) problème de sécurité (code transporté en clair par les paquets); et (4) problème d'interopérabilité.

Avantages du SDN

Le découplage de plan de contrôle du plan de données permet de déployer des services de contrôle sur une plateforme dont les capacités sont plus grandes de celles des équipements de réseaux classiques (commutateurs, routeurs). Cette nouvelle architecture fournit: (1) la simplicité de l'architecture des réseaux en réduisant le nombre de plans de contrôle; (2) la flexibilité et la programmabilité (ajout de nouveaux services) grâce aux interfaces standards (protocole OpenFlow (OF)); (3) le traitement efficace de données; (4) le déploiement efficace de nouveaux services afin de pouvoir gérer la sécurité, la qualité de service, etc.; et (5) une innovation rapide. La programmation des équipements réseau nécessite sur ces derniers la capacité de recevoir des directives de l'extérieur. Pour cela des interfaces de programmation (API (Application Programming Interface)) sont nécessaires. Il existe de nombreuses API permettant d'agir sur les équipements du plan de données. Nous nous intéressons au protocole OpenFlow qui est le standard du SDN.

OpenFlow

OpenFlow est un protocole standardisé qui est utilisé par SDN; Il permet la programmation d'équipements de commutations par des règles OF (ensemble de règles appliquées). Ces règles sont injectées par le contrôleur dans le plan de données. La standardisation d'OpenFlow est définie par l'Open Networking Foundation (ONF). Les principaux composants d'OpenFlow sont: (1) des commutateurs compatibles avec le protocole OpenFlow; (2) des serveurs capables d'exécuter le processus du contrôleur; et (3) une base de données contenant une vue globale de la topologie du réseau. La composante principale des commutateurs compatibles avec le protocole OpenFlow est la table de flux. La table de flux se compose Le contrôleur SDN permet d'implémenter rapidement un changement sur le réseau à l'aide du protocole OpenFlow. Parmi les contrôleurs existants, on peut trouver: (1) Floodlight [1], un contrôleur développé par BigSwitch; (2) OpenDaylight [2], un projet open source pour SDN qui a été annoncé publiquement le 8 Avril 2013. C'est un projet de collaboration hébergé par la Fondation Linux. Il contient un contrôleur modulaire et souple; et (3) Ryu [3], un exemple d'un contrôleur SDN open source. Il est capable de configurer les équipements réseaux en utilisant OpenFlow et Netconf.

Vecteurs d'attaques

L'internet est soumis à des fortes variations de trafics, certaines légitimes et d'autres illégitimes. Afin de concevoir une meilleure méthodologie de préventions des attaques, nous devons analyser et prendre en compte ses caractéristiques (les moyens et les méthodes utilisés pour mener et effectuer des attaques). Les principaux vecteurs/types d'attaques sont présentées comme suit: (1) Déni de service (DoS) (voir 1.2.1); (2) Déni de service distribué (DDoS) (voir 1.2.2); (3) attaques par exploitation d'un protocole (voir 1.2.3); (4) attaques logiques (voir 1.2.4); et (5) attaques basées sur la réflexion (voir 1.2.5).

Déni de Service (DoS)

Déni de service (Denial of Service ou DoS) est une attaque réalisée dans le but de rendre indisponible, durant une certaine période, les services ou ressources d'une organisation; ces attaques sont fréquentes, notamment du fait de la relative simplicité de leur mise en oeuvre, et de leur efficacité contre une cible non préparée. Ces attaques peuvent engendrer des pertes financières non négligeables par l'interruption de service ou encore indirectement, par l'atteinte portée à l'image de la cible. Le but de ces attaques n'est pas d'altérer ou de supprimer des données mais de nuire au fonctionnement d'un service. La plupart de ces attaques exploitent des failles liées aux protocoles de la pile TCP/IP. Cette thèse se concentre sur les deux vecteurs d'attaques les plus critiques. Parmis ces attaques, nous trouvons DoS. Ce type consiste à submerger des machines légitimes, généralement des serveurs des entreprises, avec un ensemble massif de trafic illégitimes, afin qu'elles ne soient plus accessibles pour répondre aux requêtes des clients légitimes. Le principe est d'envoyer des paquets qui semblent valides, afin de provoquer une saturation ou un état instable des machines victimes. L'attaque les empêche ainsi d'assurer les services réseau qu'elles sont censées offrir. Dans certains cas extrêmes, ce type d'attaque peut conduire au crash des machines cibles; et (2) les attaques par exploitation des vulnérabilités, qui consistent à exploiter une faille d'un système. Le déni de service est un type d'attaque qui peut être coûteux à une organisation puisqu'il interrompt les services disponibles. Sachant qu'à l'heure actuelle, les enjeux des entreprises/organisations sont généralement énormes, cela peut poser de graves problèmes si une telle situation se produit pendant juste quelques secondes.

Déni de service distribué (DDoS)

Le déni de service distribué ou encore "Distributed Denial of Service" est un déni de service qui est provoqué par plusieurs machines. Le but recherché du déni de service distribué est le même que pour DoS, à la différence que plusieurs machines à la fois sont à l'origine de l'attaque, ce qui l'amplifie et rend difficile la localisation des attaquants.

L'attaquant constitue un réseau de machines; ce réseau se compose d'un maître (Master) et de nombreux hôtes distants (esclaves). Pendant le déroulement de l'attaque, l'attaquant se connecte au maître qui envoie un ordre à tous les hôtes distants. Ensuite, ceux-ci vont attaquer la cible suivant une technique choisie par l'attaquant.

Les attaques DDoS se sont démocratisées depuis quelques années. En effet, à leur début, ces attaques nécessitaient de bonnes connaissances de la part des attaquants. Mais aujourd'hui, il existe des outils pour organiser et mettre en place l'attaque. Ainsi le processus de recherche des hôtes secondaires (appelés aussi zombies) a été automatisé. En repérant certaines failles courantes sur les machines présentes sur Internet, l'attaquant prend leur contrôle. Ensuite, Il les utilises pour l'attaque secondaire et essaye également d'effacer ses traces. Il est essentiel de noter que les victimes dans ce type d'attaques ne sont pas seulement celles qui subissent le déni de service, tous les hôtes secondaires sont également des machines compromises jusqu'au plus haut niveau tout comme l'hôte maître.

Les attaques DDoS peuvent être lancées à partir de réseaux de machines compromises appelés botnets. De nombreux outils accessibles en ligne permettent d'utiliser des botnets. Au cours des dernières années, des services de DDoS en ligne, couramment appelés booter ou stresser (Botnet as-a-service), ont fait leurs apparitions. Ces services proposent des tarifs autorisant leur usage par des particuliers, et permettent à un utilisateur de lancer des attaques contre la cible de son choix. Par ailleurs, certains booter proposent de tester le service gratuitement pendant quelques minutes. La diversité des outils et services permettant de lancer des attaques par déni de service distribué contribue à l'augmentation du nombre de ces attaques.

Ce type d'attaque est très difficile à mitiger. En effet, cette attaque est très dévastatrice car elle provient d'un réseau tout entier. Étant donné que le nombre énorme de machines non sécurisées présentes sur Internet, on peut imaginer l'ampleur d'une telle attaque. Il n'est donc pas évident de s'en protéger étant donné que l'identité des attaquants change souvent, en utilisant les techniques de spoofing. En plus, le temps nécessaire pour mettre en place une protection adéquate est bien souvent supérieure au temps nécessaire pour surcharger la victime.

Attaques par exploitation d'un protocole

Une attaque volumétrique a pour objectif d'épuiser la bande passante réseau disponible afin de rendre un ou plusieurs services inaccessibles. Ce type d'attaque est souvent mené en exploitant les propriétés de certains protocoles (par exemple: DNS [4] et NTP [5]) afin de maximiser le volume de trafic généré.

Par ailleurs, les attaques volumétriques visent à générer un très grand nombre de paquets afin de saturer les ressources d'une cible (victime). Certains protocoles génèrent des réponses d'une taille très supérieure à celle de la requête (amplification). Le nombre de paquets induits par la réponse peut également être plus important que le nombre de paquets nécessaire à l'envoi de la requête.

La plupart du temps, les attaques volumétriques tirent parti de la réflexion et de l'amplification. Il existe un certain nombre de protocoles pouvant être exploités pour mener ce type d'attaques. Parmi ceux-ci, on peut notamment citer, DNS, NTP (Network Time Protocol), SNMP (Simple Network Management Protocol), ou encore CHARGEN (Character Generator protocole). L'attaque d'amplification DNS inonde la victime en envoyant un ensemble massif de réponses DNS de grandes tailles. Cette attaque tire parti des serveurs DNS récursifs qui acceptent et répondent aux requêtes de résolutions de n'importe qui sur Internet sans vérifier son identité. Les attaquants exploitent ces serveurs de noms récursifs pour amplifier l'attaque en utilisant l'usurpation de l'adresse IP de la victime. L'effet d'amplification dans cette attaque vient du fait que les petites requêtes peuvent générer des quantités massives de paquets UDP en réponse.

Attaques logiques

Dans les attaques logiques ou logicielles, un petit nombre de paquets malformés exploitent des bogues logiciels spécifiques connus dans le système d'exploitation ou dans une application du système cible. Cela peut potentiellement désactiver la machine de la victime en lui envoyant simplement un ou quelques paquets.

Attaques basées sur la réflexion

Certaines attaques utilisent des machines accessibles sur Internet et répondant à des requêtes émanant d'une source quelconque, il s'agit de réflecteurs. Une attaque par réflexion consiste à envoyer des paquets à des réflecteurs en utilisant l'adresse IP de la victime comme adresse IP source; on parle ainsi de l'usurpation d'identité. Les réponses de ces réflecteurs à la victime induisent la génération d'un trafic non sollicité à destination de cette dernière. Ce trafic peut être suffisamment important pour saturer les liens réseau de la victime, entraînant un déni de service distribué. Les attaques par réflexion impliquent souvent des protocoles reposant sur le protocole de transport UDP. En effet, le protocole UDP laisse à la couche application la tâche d'identification de la source, ce qui permet l'usurpation d'adresse IP. Par ailleurs, UDP ne nécessite pas l'établissement d'une session (contrairement au protocole TCP) préalablement à l'envoi de données. Cette particularité permet à un attaquant d'envoyer une requête à un service utilisant UDP au moyen d'un seul paquet, et de générer une réponse de la part du réflecteur. Les attaques par réflexion ne sont pas uniquement limitées au protocole de transport UDP. Par exemple, il est possible d'envoyer des paquets TCP SYN en usurpant l'adresse IP d'une victime pour générer des paquets SYN-ACK en réponse vers la cible.

Classification des mécanismes de défenses

Les mécanismes de défense contre les différent types d'attaques sont devenus l'un des défis les plus importants de la sécurité du réseau. Par conséquent, un grand nombre de classifications de défense et de taxonomies ont émergé. Nous présenterons les quatre grandes catégories et politiques. Le but de cette catégorisation est de mettre en évidence les principales caractéristiques de chaque catégorie de défense. (1) prévention de l'attaque: elle vise à arrêter les attaques avant qu'elles puissent atteindre la cible. Le pare-feu est un exemple de ce mécanisme de prévention; (2) la détection d'attaque: elle vise à détecter les anomalies en analysant le trafic entrant dans le réseau; (3) identification de l'origine de l'attaque: elle vise à localiser la source de l'attaque. Cependant, l'identification est difficile; Ceci est dû à deux aspects du protocole IP. D'une part, il est facile d'usurper les adresses IP sources. D'autre part, on ne peut pas connaitre le chemin complet de bout en bout d'un paquet. SDN peut se présenter comme une solution à ces lacunes grâce à sa vue globale du réseau. SDN permet d'organiser un ensemble de commutateurs OpenFlow à travers un contrôleur unique, permettant ainsi la centralisation du plan de contrôle du réseau. Grâce à cette centralisation, il est plus facile de tracer le chemin complet de bout en bout puisque le contrôleur a une vision globale sur le réseau.

Prévention de l'attaque

L'objectif est d'arrêter les attaques avant qu'elles ne causent réellement des dégâts. Ce type essaie de supprimer le trafic illégitime qui peut être reconnu comme malveillant. Le meilleur endroit pour déployer ces mécanismes est dans les routeurs et les hôtes; ceci implique de réparation toutes les vulnérabilités de tous les hôtes qui peuvent être mal utilisés pour une attaque. Certaines approches utiles pour prévenir les attaques DDoS sont: (1) filtrage: ce mécanisme vise à mettre en oeuvre des politiques de filtrages du trafic d'entré et de sortie sur tous les routeurs afin de protéger la cible contre les attaques arrivant de l'extérieur et empêcher le réseau lui-même d'être un intrus potentiel et empêcher un attaquant intérieur de mener des attaques vers l'extérieur; (2) pare-feu: avant qu'une attaque ne soit effectuée, un pare-feu pourrait être utile pour filtrer le trafic en fonction du protocole, des ports ou des adresses IP entrantes. Mais, le problème est que les pares-feux ne peuvent pas distinguer entre une attaque et un trafic légitime, et le blocage de tout le trafic pour un port ou protocole spécifique n'est pas une solution mais une génération d'attaque sur lui-même. Seulement dans les attaques dans lesquelles les modèles de signature sont connus, qu'on peut se protéger contre. Cependant, les attaques avec des nouvelles signatures peuvent empêcher l'attaque de ne pas être détecté; et (3) étudier les mécanismes d'attaques et les faiblesses de la conception des protocoles peut s'avérer très utiles pour protéger le réseau telle que DNS amplification attaque.

Détection d'attaque

Une fois le réseau est attaqué, un mécanisme de détection d'attaque doit effectivement mitiger les attaques. En outre, dans une situation d'attaque, le trafic légitime doit passer sans être bien bloqué. De plus, un mécanisme efficace de détection d'attaque doit maintenir l'équilibre entre les faux positifs et les faux négatifs.

Identification de l'origine de l'attaque

Une fois qu'une attaque est détectée, la meilleure solution est de bloquer le trafic d'attaque à sa source, dont l'objectif de localiser les sources d'attaques indépendamment du champ de l'adresse source du paquet qui peut être forgée. Cependant, il est difficile de localiser la vraie source des attaques. Ceci est dû à deux caractéristiques du protocole IP. La première est la facilité avec laquelle les adresses source IP peuvent être forgées. La seconde est la nature du routage IP qui est sans état, où les routeurs ne connaissent normalement que la prochaine étape pour transmettre un paquet, et non le chemin complet de bout en bout pris par chaque paquet. D'autre part, la séparation du plan de contrôle du plan de donnés introduit de nouveaux défis en matière de sécurité du plan de contrôle. La thèse explore cette direction de recherche en proposant des nouvelles méthodes de collectes et de gestion de données permettant de protéger les ressources du plan de contrôle. La thèse conçoit et implémente ces solutions sur une infrastructure SDN; nous utilisons la programmabilité apportée par SDN pour renforcer les politiques de sécurité. Nous proposons des mécanismes pour évaluer ces aspects de sécurité, de performance et de mitigation aux attaques par déni de service distribué et aussi pour déployer ces politiques dans un contexte de réseaux programmables. Dans cette thèse, nous allons aborder quatres problématiques:

Le premier problème est l'identification, la quantification des vulnérabilités du protocole DNS et la mitigation des attaques d'amplification en utilisant ce protocole (i.e., DNS amplification attaque); cette attaque est considérée comme la plus grande attaque DDoS de l'histoire, dépassant 1 Tbit/s [6]. Les attaques d'amplification DNS sont parmi les attaques DDoS les plus complexes et répandues aujourd'hui. En vogue, ces attaques deviennent de plus en plus puissantes et dévastatrices et causent des dégâts catastrophiques pour les organismes, les instituts, les opérateurs de réseaux, et les fournisseurs d'accès Internet. DNS est vulnérable aux attaques de déni de service distribuées parce que la majorité des échanges dans ce protocole sont basés sur le protocole UDP. Ces attaques sont difficiles à vaincre car les attaquants usurpent l'adresse IP de la victime (cible d'une attaque par amplification DNS) et l'inondent avec des réponses DNS valables provenant de serveurs DNS légitimes. Dans cette attaque, l'attaquant émet une requête DNS avec une adresse IP forgée (l'adresse IP de la victime) vers plusieurs résolveurs DNS ouverts (serveurs DNS accessibles au public); ces derniers se chargent de faire la résolution récursive et de répondre à ces requêtes par des réponses amplifiées envoyées à la victime. Avec de nombreuses fausses requêtes DNS envoyées par de nombreuses machines contrôlées par l'attaquant (botnet), et plusieurs résolveurs DNS qui répondent simultanément, le réseau de la victime se trouve submergé par le nombre des réponses DNS. Les solutions existantes dans la littérature proposent de resserrer la sécurité des serveurs DNS en bloquant les serveurs DNS de relais récursifs. Ils existent actuellement plus de 7.5 millions de serveurs de relais ouverts sur Internet [START_REF]DNS expertise[END_REF]. Il est très difficile voire impossible de les identifier et de tous les bloquer. En outre, si ces serveurs sont bloqués, ils ne seront plus utilisés pour faire la résolution des requêtes DNS légitimes. En conclusion, ces propositions sont impossibles à mettre en place dans un cas réel. Récemment, SDN a émergé comme un paradigme novateur qui apporte de nombreux avantages en découplant le plan de contrôle du plan de données; la gestion centralisée du SDN permet de développer de nouveaux mécanismes de sécurité afin de contrer les attaques d'amplification par DNS. Plusieurs solutions dans la littérature, en utilisant SDN, ont été proposées pour contrer ces attaques. Ces solutions proposent d'utiliser le plan de contrôles (le contrôleur SDN) pour analyser le trafic DNS. Ceci est fait comme suit: (1) le contrôleur SDN ordonne les équipements du plan de données de lui transférer le trafic DNS pendant un certain intervalle de temps; puis (2) le contrôleur SDN analyse et alerte s'il y une attaque d'amplification DNS. Ces solutions souffrent de plusieurs faiblesses. Tout d'abord, ce mécanisme réduit les performances du contrôleur puisqu'il reçoit tout le trafic suspecté d'être illicite et l'analyse; cette surcharge peut induire un DDoS sur le plan de contrôle. De ce fait, l'attaque n'est pas mitigée mais plutôt convertie en vecteur d'attaque contaminant plusieurs parties du réseau (plan de contrôle). En plus, ces solutions mettent l'hypothèse sur un seul cas d'attaque (attaquant externe ou bien attaquant interne/ serveur DNS externe ou bien interne). Cependant, il n'y aucune solution dans la littérature qui permet de résoudre la problématique en considérant tous les cas possibles d'attaques et en protégeant les ressources du plan de contrôle. Alors, cette thèse a comme première contribution de détecter et prévenir les attaques d'amplification DNS en reposant sur la puissance du SDN et son apport sur le contrôle global du réseau tout en protégeant les ressources du plan de contrôle et en considérant tous les cas possibles d'attaques.

Le deuxième problème est lié à l'identification et la quantification des caractéristiques communes des attaques de déni de service distribués (DDoS); cela permet l'amélioration de notre mécanisme de mitigation intra-domain afin de considérer n'importe quel type d'attaque DDoS et pas seulement l'attaque d'amplification DNS. Notre objective est de généraliser notre mécanisme pour qu'il détecte n'importe quel type d'attaque par déni de service distribué qui essaye d'inonder le réseau de la victime avec un ensemble massif de trafic illégitime. En plus de cette mitigation intra-domaine, nous abordons un mécanisme de mitigation inter-domaine permettant à plusieurs domaines SDN de collaborer en toute sécurité et de transférer les informations d'attaque de manière fiable, efficace et sécurisée. Les différentes solutions existantes dans la littérature sont confrontées à des obstacles en raison de leur faible flexibilité, de leur manque de ressources et de leur coût élevé; ces solutions de collaboration sont centralisées. Les solutions centralisées, par nature, constituent un goulot d'étranglement. Les nouvelles technologies émergentes, telles que la blockchain et les contrats intelligents, offrent de nouvelles opportunités permettant à plusieurs domaines de collaborer en toute sécurité et de transférer les informations d'attaque de manière flexible, fiable, efficace et décentralisée. Aucune solution dans la littérature n'a proposé de mitiger les attaques par déni de service distribué sur deux niveaux (intra-domaine et inter-domaine) en combinant SDN et la blockchain. L'utilisation du SDN et la blockchain permet d'assurer la sécurité, la flexibilité et l'efficacité d'une collaboration inter-domaine de manière décentralisée et automatisée. Les principaux avantages de l'utilisation de ces technologies sont: (1) le déploiement d'une infrastructure décentralisée déjà existante (Ethereum [8]) afin de collaborer et mitiger l'attaque. En effet, avec l'utilisation d'Ethereum, on peut éviter la complexité du développement de nouveaux protocoles et/ou la modification de protocoles existants. DOTS est l'une des solutions traditionnelles qui ont été proposées par l'IETF (Internet Engineering Task Force); cependant, il n'a pas été envisagé pour un déploiement à grande échelle en raison du coût élevé de son déploiement ainsi que la complexité de sa mise en oeuvre; (2) blockchain élimine la nécessité d'un tiers de confiance centralisé qui permet de maintenir la collaboration entre les domaines; les problèmes liés à l'utilisation de ce dernier sont nombreux (fiabilité et disponibilité des données de collaboration et les coûts élevés afin de maintenir et sécuriser ces données); ceci est assuré via les contrats intelligents; et Le quatrième problème est l'extension de notre mitigation inter-domaine élaboré dans la deuxième problématique en considérant des techniques d'apprentissage fédéré. L'absence d'ensembles de données d'entraînement contenant des caractéristiques (patterns) de nouvelles attaques rend les systèmes de détection d'attaques basés sur l'apprentissage automatique et/ou l'apprentissage profond inefficaces. La nature privée de ces ensembles de données et l'émergence de l'apprentissage automatique contradictoire/Réseaux antagonistes génératifs (Adversarial machine learning/Generative adversarial networks [10]) rendent difficile le partage les données d'attaques entre les organisations. L'apprentissage fédéré (FL) résout cette limitation en utilisant un entraînement distribué sans que les particiapnts, appelés collaborateurs, ne partagent leurs données. Cela permettra à notre mécanisme inter-domaine d'apprendre d'autres vecteurs d'attaques parmi un grand nombre de collaborateurs tout en préservant la confidentialité de chaque collaborateur. Plus précisément, nous proposons une nouvelle architecture distribuée qui permet à plusieurs domaines SDN de collaborer de manière sécurisée afin de contrer les attaques de type "zero-day" tout en préservant la confidentialité de chaque domaine SDN. Par la suite, nous utilisons un nouveau mécanisme de calcul multipartite sécurisé (Secure multi-party computation(SMPC)) pour agréger de manière sécurisée les mises à jour des modèles de chaque participant. Nous intégrons les contrats intelligents d'Ethereum pour maintenir la collaboration d'une manière totalement décentralisée, fiable, flexible et efficace. Nous menons des expérimentations approfondies pour évaluer la solution proposée en utilisant des données d'attaques réelles. Et enfin, nous comparons les résultats obtenus avec ceux de l'état de l'art.

Solutions et contributions

Dans cette thèse, nous étudions les attaques les plus critiques et les plus dévastatrices, nous analysons leurs vulnérabilités, et nous proposons des solutions pour mitiger ces attaques dans un environnement SDN. Notre solution est le premier travail qui: (1) permet de résoudre la problématique en considérant tous les cas possibles d'attaques; (2) mitige ces attaques sur deux niveaux (intra-domaine et inter-domaine) en combinant des algorithmes d'apprentissage automatique, des algorithmes d'apprentissage d'ensemble, des algorithmes d'apprentissage profond, des algorithmes d'apprentissage fédéré, SDN, et la blockchain. De plus, nous concevons, implémentons et évaluons notre solution dans un environnement SDN et blockchain afin de prouver sa flexibilité et son efficacité à détecter et mitiger ces attaques ainsi que son rapport coût-efficacité. Nous nous appuyons sur nos travaux de recherche dans cette thèse pour aborder les quatres problèmes mentionnés ci-dessus. Les solutions apportées par notre thèse mènent aux contributions suivantes:

Pour résoudre le problème 1, nous proposons une solution qui bénéficie de l'apport du SDN afin de contrer les attaques d'amplification DNS tout en protégeant les ressources du plan de contrôle et en considérant tous les cas possibles d'attaques. Nous proposons un mécanisme proactif pour filtrer les requêtes et les réponses illégitimes de l'ensemble du trafic DNS. Cela permet de créer le chemin qui ne laisse passer que les réponses légitimes et sans remonter tout le trafic au contrôleur; ceci permet de se prémunir des problèmes des attaues d'amplification DNS sur le plan de contrôle. Nous proposons un nouveau mécanisme de collecte des statistiques des flux de données afin d'extraire le vecteur représentant l'attaque. Nous proposons un mécanisme de détection en temps réel pour détecter automatiquement cette attaque en utilisant des algorithmes d'apprentissage automatique. Nous avons évalué les performances de notre première contribution en termes d'efficacité et de précision. Les résultats des simulations montrent que notre solution permet d'atténuer efficacement les attaques d'amplification DNS avec une précision élevée et moins de charges sur le plan de contrôle. Dans notre première contribution, nous proposons une mitigation intra-domaine permettant de protéger la victime de tous les cas possibles d'attaques. Cependant, une mitigation intra-domaine seule ne peut pas mitiger les attaques DDoS sur les chemins de la victime parce que les attaquants et la victime ne sont pas nécessairement dans le même système autonome (AS). Ainsi, Il est donc nécessaire de mettre en place une collaboration inter-domaine efficace afin de: (a) réduire efficacement la charge de transfert du trafic d'attaque amplifié, à travers plusieurs domaines; et (b) bloquer l'attaque près de sa source.

Pour résoudre le problème 2, nous étudions d'abord les caractéristiques communes des attaques de déni de service distribuées (DDoS) et retenons celles qui permettent d'avoir un taux de précision plus élevé. Nous concevons un système basé sur la blockchain qui utilise les contrats intelligents pour réaliser une collaboration décentralisée, sécurisée, flexible et à moindre coût, et cela entre plusieurs SDN domaines; il prend en charge deux niveaux de mitigation: intra-domaine et inter-domaine. Nous proposons un mécanisme intra-domaine de détection et de mitigation en temps réel afin de détecter automatiquement les attaques DDoS en se reposant sur des algorithmes d'apprentissage automatique. Nous proposons un mécanisme de collaboration inter-domaine efficace, sécurisé, de faible coût, facile à déployer et décentralisé. Il permet à plusieurs domaines basés sur SDN de collaborer en toute sécurité et de transférer les informations d'attaque d'une manière décentralisée reposant sur la blockchain et les contrats intelligents. Ainsi, en combinant notre approche d'atténuation intra-domaine basée sur SDN et le mécanisme de collaboration inter-domaine, nous sommes non seulement en mesure de mitiger efficacement les attaques DDoS dans le domaine de la victime, mais également de partager les informations d'attaque de manière entièrement décentralisée permettant en une prise de décision efficace, par plusieurs domaines, pour atténuer les attaques DDoS. Nous avons implémenté notre solution dans le réseau de test officiel d'Ethereum. Nous avons évalué les performances de notre deuxième contribution en termes de flexibilité, d'efficacité, de sécurité et de coût d'exécution. Les résultats des simulations Pour résoudre le problème 3, nous étendons la mitigation intra-domaine afin de permettre à notre mécanisme intra-domaine de mitiger d'autres vecteurs d'attaques (par exemple: R2L, Probe, U2R, etc.). Nous améliorons les performances de détection en utilisant des algorithmes d'apprentissage d'ensemble (Ensemble Learning (EL)). L'apprentissage d'ensemble (EL) est considéré comme un développement récent dans le domaine d'apprentissage automatique (Machine Learning (ML)) qui vise à combiner plusieurs ML modèles afin de construire des ML modèles plus flexibles (moins de biais) et moins sensibles aux données (moins de variance). Nous intégrons des mécanismes de prévention permettant de mitiger efficacement ces attaques. Nous avons évalué les performances de notre troisième contribution en utilisant des données d'attaques réelles provenant de deux ensembles de données publiques, à savoir le NSL-KDD [START_REF]NSL-KDD dataset[END_REF] et l'UNSW-NB15 [START_REF] Moustafa | UNSW-NB15: a comprehensive data set for network intrusion detection systems[END_REF]. Les résultats des simulations montrent que notre solution permet de mitiger efficacement les attaques avec une précision élevée et un faible taux de faux positifs surpassant les contributions de l'état de l'art avec une plus grande précision de 12%.

Pour résoudre le problème 4, nous étendons notre mitigation inter-domaine en considérant des techniques d'apprentissage fédéré. Nous proposons une nouvelle architecture distribuée qui permet à plusieurs domaines SDN de collaborer de manière sécurisée. Par la suite, nous utilisons un nouveau mécanisme de calcul multipartite sécurisé (Secure multiparty computation(SMPC)) pour agréger de manière sécurisée les mises à jour des modèles de chaque participant. Nous intégrons les contrats intelligents d'Ethereum pour maintenir la collaboration d'une manière totalement décentralisée, fiable, flexible, et efficace. Nous menons des expériences approfondies pour évaluer la solution proposée en utilisant des données d'attaques réelles, à savoir le NSL-KDD [START_REF]NSL-KDD dataset[END_REF], et en considérant plusieurs scénarios de test. Les résultats des simulations montrent que notre solution permet de mitiger efficacement les attaques tout en préservant la vie privée des collaborateurs.

Organisation de la thèse

Cette thèse est organisée comme suit (voir Figure 1.4). Le 2ème chapitre présente notre solution adoptée pour contrer les attaques par amplification DNS: "Bringing Intelligence to Software DefinedNetworks: Mitigating DDoS Attacks". Le 3ème chapitre présente notre mécanisme intra-domaine de détection et de mitigation en temps réel ainsi que notre mécanisme de collaboration inter-domaine: "Cochain-SC: An Intra and Inter-DomainDdos Mitigation Scheme Based on Blockchain Using SDN and Smart Contract". Le 4ème chapitre présente notre contribution améliorons les performances de détection intra-domain en utilisant des algorithmes d'apprentissage d'ensemble: "SDNBoost: An SDN-based BoostingEnsemble Learning Framework for Advanced Network Attack Mitigation". Le 5ème chapitre présente notre contribution améliorons les performances de collaboration inter-domain en utilisant des algorithmes d'apprentissage fédéré: "CoFed: A privacy preserving collaborativeDDoS Mitigation framework based on Federated Learning using SDN and blockchain". Finalement le chapitre 6 conclut la thèse et discute nos prochains travaux.

Liste des publications

Dans cette section, nous énumérons les articles produits dans le cadre de cette thèse:

1.7.1. Revues internationaux avec comité de lecture [1]

Introduction

DNS amplification attack is a popular form of DDoS attacks that relies on the use of Open Resolver (publically accessible DNS servers) to overwhelm the victim (i.e., target of DNS amplification attack) with amplified DNS traffic. This attack is based on a recursive function of DNS servers. Usually, the DNS server accepts and responds to resolution requests from anyone without verifying its identity. Thus, attackers can exploit recursive functions to amplify the attack by spoofing the victim's IP address. The spoofed queries (i.e., DNS requests) sent by the attacker are of type AN Y ; they include all known information about a DNS zone in a single request. The amplification impact of this attack comes from the fact that small queries can generate massive amounts of UDP packets in response. This category of attack can be divided in two types: (a) amplification with repeated DNS requests that have the same content; and (b) amplification with varied DNS requests that have different contents. The query can be of type AN Y that requests all records for a particular domain or different domains. The size of the response may be large to produce a high level of amplification. The amplification ratio, of a factor up to 4670 [START_REF] Rossow | Amplification hell: Revisiting network protocols for ddos abuse[END_REF], is calculated as the ratio between the response size and the request size. According to a recent study, there are about 7.5 million external DNS servers in the Internet; more than 75% of these servers allow recursive name service to the public [START_REF]DNS expertise[END_REF]. This can cause significant collateral damage on the victim, if attackers use many recursive servers to amplify and generate the attack. As example, on the 2 of October 2016, a huge attack was conducted against the servers of Dyn, a company that controls many Internets DNS servers. As a consequence, many popular Internet services, e.g., Amazon, Twitter, GitHub [START_REF] Sharwood | Github wobbles under ddos attack[END_REF], PayPal and others became unavailable for several hours [6]. This attack [6] is considered as the largest ever DDoS attack, exceeding a rate of 1 Tbit/s. Such incidents harm Internet service providers (ISPs) and cost millions of dollars of lost revenues for enterprises. DNS amplification attack consists of: (1) an attacker (e.g., bot master); (2) a large number of compromised devices (called zombies); and (3) reflectors (i.e., Open Resolvers). Each zombie is ordered by the bot master to send a large number of DNS requests, in which the source IP address is replaced with In this chapter, we propose an efficient, stateful, proactive and scalable solution in the context of SDN, called WisdomSDN. Recently, SDN has attracted tremendous attention from industry and academia as an emerging networking paradigm that facilitates network management and provides new approaches to manage and deploy networks dynamically [START_REF] Scott-Hayward | A survey of security in software defined networks[END_REF][START_REF] Huang | A survey on large-scale software defined networking (sdn) testbeds: Approaches and challenges[END_REF][START_REF] Rawat | Software defined networking architecture, security and energy efficiency: A survey[END_REF][START_REF] Kaljic | A survey on data plane flexibility and programmability in software-defined networking[END_REF]. SDN separates data and control planes; this separation allows for more control over the network and brings a new way to deal with various forms of DDoS attacks [START_REF] Mohammadi | Slicots: An sdn-based lightweight countermeasure for tcp syn flooding attacks[END_REF][START_REF] Wang | Design and implementation of an sdn-enabled dns security framework[END_REF][START_REF] Rashidi | A collaborative ddos defence framework using network function virtualization[END_REF][START_REF] Rashidi | A scalable and flexible ddos mitigation system using network function virtualization[END_REF][START_REF] Jakaria | Dynamic ddos defense resource allocation using network function virtualization[END_REF]. While SDN can protect the network from DDoS attacks [START_REF] Dargahi | A survey on the security of stateful sdn data planes[END_REF][START_REF] Abdou | Comparative analysis of control plane security of sdn and conventional networks[END_REF][START_REF] Farris | A survey on emerging sdn and nfv security mechanisms for iot systems[END_REF][START_REF] Zheng | Realtime ddos defense using cots sdn switches via adaptive correlation analysis[END_REF][START_REF] Fawcett | Tennison: A distributed sdn framework for scalable network security[END_REF][START_REF] Steadman | Dnsxd: Detecting data exfiltration over dns[END_REF], it can be a victim of these attacks [START_REF] Deng | Packet injection attack and its defense in software-defined networks[END_REF].

To address this problem, WisdomSDN promises to leverage the advantages of SDN to protect the victim from DNS amplification attack while maintaining the SDN secure i.e., protecting the resources of data plane (i.e., Ternary Content Addressable Memory (TCAM) of OF (OpenFlow) switches), the resources of control plane (i.e., the SDN controller resources) and the workload of OF channel. To this aim, WisdomSDN makes use of a novel proactive and stateful mapping scheme (PAS), based on in-OF switch (e.g., OpenvSwitch [START_REF]Openvswicth[END_REF]) processing capabilities, to mitigate DNS amplification attack and protect SDN controller. PAS adopts a proactive and stateful paradigm to perform one-to-one mapping between DNS requests and DNS responses; this can effectively offload the SDN controller resources and the OF channel. Each OF switch filters DNS traffic according to the header fields (i.e., MAC address, IP address and UDP port). PAS checks the legitimacy of each DNS response by comparing its MAC address, IP address and UDP Port with the corresponding DNS request and drops automatically illegitimate DNS responses. Thus, PAS allows: (1) OF switches to be smart enough to react proactively and quickly to mitigate illegitimate DNS responses, and not wait for a reactive rule from the SDN controller; and (2) to effectively offload the control plane (i.e., SDN controller). However, if each OF switch maintains the one-to-one mapping of all DNS requests that it receives it will be overwhelmed. To address this issue and protect TCAM of OF switches that is limited in size, WisdomSDN makes use of a robust machine learning DDoS detection module that aims to detect, in real-time, illegitimate DNS requests. This module consists of: (1) FSC, to gather the features of flows in an efficient and scalable way using sFlow protocol; (2) ECS, to measure the disorder/randomness of network traffic; and (3) BNF, to automatically detect illegitimate DNS requests. To evaluate the effectiveness of WisdomSDN, we conducted a set of experiments in Mininet [START_REF]Mininet[END_REF]. We launch the attack on a simulated SDN network environment in the context of 2 scenarios: (1) without WisdomSDN; and (2) with WisdomSDN. The results show that without WisdomSDN, the SDN controller and victim are flooded with illegitimate DNS traffic (DNS requests and DNS responses). However, with WisdomSDN, OF switches can effectively detect and mitigate illegitimate DNS requests and DNS responses. Also, we evaluated BNF through Receiver Operating Characteristic (ROC) curves and we compared it to the most prominent stateof-art schemes. The results show that BNF can effectively detect the attack with a high detection rate and low false positive rates. To the best of our knowledge, WisdomSDN is the first contribution that mitigates this attack considering all possible attacks setup while maintaining the SDN secure.

The main contributions of this chapter can be summarized as follows:

• We propose a novel proactive and stateful scheme (PAS) to perform one-to-one mapping between DNS requests and DNS responses. • We propose a flow statistics collection scheme (FSC) to gather the features of flows in an efficient way using sFlow protocol. • We introduce an entropy calculation scheme (ECS) to measure the disorder/randomness of network traffic. The rest of this chapter is organized as follows. Section 2.3 presents related works. Section 2.4 presents an overview of WisdomSDN. Section 2.5 introduces our system design. Section 2.6 presents PAS, our proactive and stateful scheme. Section 2.7 presents our machine learning DDoS detection module that consists of: FSC, ECS, and BNF. Section 2.8 describes DM. Section 2.9 evaluates WisdomSDN in terms of efficiency, scalability, detection rate and presents the simulation results. Finally, section 2.10 concludes the chapter and presents our future works.

Related Work

Several schemes have been proposed in the literature to mitigate DNS amplification attack. In the following: (1) we classify countermeasures into two groups; and (2) for each group, we present some of the most prominent works as well as their limitations.

Countermeasures in Legacy Networks

In [START_REF] Huistra | Detecting reflection attacks in dns flows[END_REF], Huistra proposed a scheme to detect malicious DNS traffic by detecting all IP addresses that cause the attack, based on collected dataset from NetFlow. The scheme consists of two phases: (1) detection of suspicious IP addresses based on the quantity of requests generated by this IP address and stored in the flow-record; and (2) detection of any IP address that receives suspicious DNS responses based on the huge amount of received responses. However, the execution of the two phases, in this scheme [START_REF] Huistra | Detecting reflection attacks in dns flows[END_REF], result in large response times. In [START_REF] Rozekrans | Defending against dns reflection amplification attacks[END_REF], Rozekrans et al. proposed a defense mechanism, called response rate limiting (RRL), to limit the amount of generated responses by dropping the ones that exceed a predefined threshold. This is performed by storing the requestor IP address when DNS server generates a response for a DNS request. When the number of responses exceeds the threshold, the server drops requests for this IP address. However, RRL only examines DNS responses and ignores the amount of incoming DNS requests. In [START_REF] Sun | Efficient and low-cost hardware defense against dns amplification attacks[END_REF], Sun et al. proposed a low-cost hardware based scheme to mitigate DNS amplification attack. The solution works well except that it is hardware-based, which makes it hard to update and extend. In [START_REF] Guo | Spoof detection for preventing dos attacks against dns servers[END_REF], Guo et al. proposed a scheme that deploys filters at the border of networks in order to block incoming source IP addresses that are not belong to their networks. However, this scheme has "neighborhood policy" that requires all ISPs to participate in order to provide the complete list of IP addresses that do not sent from the network; moreover, the effectiveness of this scheme depends on its global deployment across the Internet. In [START_REF] Kambourakis | A fair solution to dns amplification attacks[END_REF], Kambourakis et al. proposed a scheme that stores all incoming DNS requests and DNS responses. Once an illegitimate DNS response is detected, a counter is incremented until it reaches a threshold. When the threshold is reached, an alert is generated and the attack is assumed to have happened. This scheme did not scale for large scale networks because it needs to store all DNS requests and responses.

SDN-Based Countermeasures

Our previous works [START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using SDN[END_REF][START_REF] Houda | Brainchain -a machine learning approach for protecting blockchain applications using sdn[END_REF] did show their effectiveness in protecting permissioned blockchain from DNS amplification attack. In this chapter, we extend these works to protect any type of applications and not consider only blockchain applications. Moreover, we combine a proactive and stateful scheme with a machine learning algorithm (i.e., BNF) in order to: (1) distinguish between legitimate and illegitimate responses and systematically eliminate the amplified illegitimate DNS responses; and (2) decrease false positive rates while maintaining a high detection rate. In [START_REF] Braga | Lightweight ddos flooding attack detection using nox/openflow[END_REF], Rodrigo et al. proposed a flow-based intrusion detection scheme using OF protocol to gather network traffic features. This scheme [START_REF] Braga | Lightweight ddos flooding attack detection using nox/openflow[END_REF] focuses only on the attack in data plane without any analysis of the overhead to the control plane. Moreover, the performance analysis did not include the overall system performance. In [START_REF] Mehdi | Revisiting traffic anomaly detection using software defined networking[END_REF], Mehdi et al. proposed an anomaly detection scheme in the context of SDN using OF protocol. However, this scheme [START_REF] Mehdi | Revisiting traffic anomaly detection using software defined networking[END_REF] was designed only for small-scale setup; in largescale environment, a high rate traffic from data plane to control plane may overload the SDN controller. In [START_REF] Wang | An entropy-based distributed ddos detection mechanism in softwaredefined networking[END_REF], Wang et al. proposed an entropy scheme based on OF switches; it focuses only on detection, but it cannot find the victim or the illegitimate hosts. In [START_REF] Lim | A sdn-oriented ddos blocking scheme for botnet-based attacks[END_REF], Lim et al. proposed a DDoS attacks mitigation scheme for botnet-based attacks that runs on SDN controller. This scheme [START_REF] Lim | A sdn-oriented ddos blocking scheme for botnet-based attacks[END_REF] requires a large amount of communications between the SDN controller and OF switches in order to protect the victim; moreover, it not only generates DDoS attacks against the SDN controller but also requires high latency to cooperate with the SDN controller. In [START_REF] Zaalouk | Orchsec: An orchestrator-based architecture for enhancing network-security using network monitoring and sdn control functions[END_REF], Zaalouk et al. proposed a scheme based on SDN to mitigate DNS amplification attack; it uses sFlow protocol to monitor DNS traffic. When the attack is detected, the orchestrator commands one of the SDN controllers to forward suspicious traffic to it in order to analyze the size of DNS response packets and to compute their average size. If the average of responses size exceeds the value of a threshold, it proceeds to the second phase of detection. In this phase, the orchestrator calculates the entropy of destination IP address. If the entropy value is low, then it is assumed that there is a DNS amplification attack. In this case, it applies a set of rules to limit the responses rate. However, this scheme [START_REF] Zaalouk | Orchsec: An orchestrator-based architecture for enhancing network-security using network monitoring and sdn control functions[END_REF] did not distinguish between legitimate and illegitimate responses since all DNS responses are sent to SDN controller and may cause DDoS attack against control plane as well as orchestrator. In [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF], K. Giotis et al. proposed the use of sFlow protocol with OF protocol in order to detect DDoS attacks reducing the communication overhead between data plane and control plane. This scheme [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF] works well; however, it has high false positive rates.

To address the weaknesses of these existing schemes [START_REF] Huistra | Detecting reflection attacks in dns flows[END_REF][START_REF] Rozekrans | Defending against dns reflection amplification attacks[END_REF][START_REF] Sun | Efficient and low-cost hardware defense against dns amplification attacks[END_REF][START_REF] Guo | Spoof detection for preventing dos attacks against dns servers[END_REF][START_REF] Kambourakis | A fair solution to dns amplification attacks[END_REF][START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using SDN[END_REF][START_REF] Houda | Brainchain -a machine learning approach for protecting blockchain applications using sdn[END_REF][START_REF] Braga | Lightweight ddos flooding attack detection using nox/openflow[END_REF][START_REF] Mehdi | Revisiting traffic anomaly detection using software defined networking[END_REF][START_REF] Wang | An entropy-based distributed ddos detection mechanism in softwaredefined networking[END_REF][START_REF] Lim | A sdn-oriented ddos blocking scheme for botnet-based attacks[END_REF][START_REF] Zaalouk | Orchsec: An orchestrator-based architecture for enhancing network-security using network monitoring and sdn control functions[END_REF][START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF], we propose WisdomSDN, an efficient, stateful, proactive, and scalable solution to detect and mitigate DNS amplification attack. In WisdomSDN, we use: (1) PAS, to exclude the amplified DNS responses; (2) a machine learning DDoS detection module, to detect, in real-time, illegitimate DNS requests; and (3) DM, to effectively mitigate illegitimate DNS requests. WisdomSDN uses FSC to separate flow monitoring from the forwarding logic; this makes it much more scalable compared to existing native OF schemes [START_REF] Braga | Lightweight ddos flooding attack detection using nox/openflow[END_REF][START_REF] Mehdi | Revisiting traffic anomaly detection using software defined networking[END_REF][START_REF] Wang | An entropy-based distributed ddos detection mechanism in softwaredefined networking[END_REF][START_REF] Lim | A sdn-oriented ddos blocking scheme for botnet-based attacks[END_REF]. Using BNF, WisdomSDN is much accurate in comparison with the ones using sampling technology [START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using SDN[END_REF][START_REF] Zaalouk | Orchsec: An orchestrator-based architecture for enhancing network-security using network monitoring and sdn control functions[END_REF][START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF].

WisdomSDN: An Overview

In this section, we present an overview of WisdomSDN. More specifically, we explain how WisdomSDN can combine detection and mitigation of DNS amplification attack, allowing for a robust detection and an effective mitigation of this attack.

The majority of DNS requests use UDP as a transport protocol without providing any mechanism to verify the source IP address of DNS requests. Therefore, the network can be flooded with illegitimate DNS requests and amplified DNS responses. WisdomSDN is inspired from the techniques of Moving Target Defense [START_REF] Hong | Assessing the effectiveness of moving target defenses using security models[END_REF]. These techniques allow to contain the attack in the space of the real source of the request and avoid propagating DDoS attacks to the potential victim. Fig. 2.2 shows the flow diagram of WisdomSDN. When an OF switch receives a new packet, it first checks the type of incoming packet. If the packet is DNS request; then, WisdomSDN checks whether the maximum number of requests threshold per ingress port is reached. If the response is yes, it triggers, using sFlow protocol, an event to sFlow collector (i.e., sFlow-RT [START_REF]sflow-rt[END_REF]) in order to collect network traffic features using FSC. Afterwards, ECS extracts network traffic features from collected information and calculates entropy values. Based on this calculation, BNF detects automatically illegitimate flows. If the flow is classified as illegitimate, then a mitigation action is performed using DM scheme. Otherwise, OF switch: (1) learns the authorized response from ingress port of incoming DNS request; and (2) installs the rule that allows only the DNS response that matches the corresponding DNS request with a short timeout (i.e., idle timeout and hard timeout) in order to avoid the storage complexity to maintain the one-to-one mapping. Thus, any amplified illegitimate DNS response will not be sent to neither the victim nor the SDN controller; this excludes amplified illegitimate DNS responses and offload the SDN controller and the OF channel. Upon receipt of DNS response, OF switch checks whether there is any corresponding DNS request; if it is the case, it forwards the DNS response following the ingress port of incoming DNS request; otherwise, it drops the DNS response.

System Design

Design Overview

When designing WisdomSDN, we did consider the following objectives. First, Wis-domSDN should give a full protection from DNS amplification attack. Unlike existing schemes [START_REF] Huistra | Detecting reflection attacks in dns flows[END_REF][START_REF] Rozekrans | Defending against dns reflection amplification attacks[END_REF][START_REF] Sun | Efficient and low-cost hardware defense against dns amplification attacks[END_REF][START_REF] Guo | Spoof detection for preventing dos attacks against dns servers[END_REF][START_REF] Kambourakis | A fair solution to dns amplification attacks[END_REF][START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using SDN[END_REF][START_REF] Houda | Brainchain -a machine learning approach for protecting blockchain applications using sdn[END_REF][START_REF] Braga | Lightweight ddos flooding attack detection using nox/openflow[END_REF][START_REF] Mehdi | Revisiting traffic anomaly detection using software defined networking[END_REF][START_REF] Wang | An entropy-based distributed ddos detection mechanism in softwaredefined networking[END_REF][START_REF] Lim | A sdn-oriented ddos blocking scheme for botnet-based attacks[END_REF][START_REF] Zaalouk | Orchsec: An orchestrator-based architecture for enhancing network-security using network monitoring and sdn control functions[END_REF][START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF] that try to analyze the network state; then, detect the attack. Wisdom-SDN aims to act proactively, by maintaining one-to-one mapping between DNS requests and DNS responses, in order to avoid sending illegitimate DNS traffic to victim (i.e., target of the attack); this is ensured via PAS. To protect TCAM of OF switches which is limited in size, WisdomSDN makes use of a robust machine learning DDoS detection module that aims to detect, in real-time, illegitimate DNS requests. Finally, the attack should be effectively mitigated, using DM, and the whole system has to be as scalable as possible.

System Architecture

Fig. 2.3 shows the architecture of WisdomSDN. WisdomSDN has three phases: (1) PAS, a novel proactive and stateful scheme to perform one-to-one mapping between DNS requests and DNS responses; it operates proactively by sending only legitimate responses, excluding amplified illegitimate DNS responses. PAS is implemented in data plane (i.e., OF switch); (2) a machine learning DDoS detection module that aims to detect, in real-time, illegitimate DNS requests. This module is implemented on the top of the SDN controller (i.e., application plane) and consists of: (a) FSC, a novel Flow statistics collection scheme to monitor, using sFlow protocol, network traffic features in an efficient and scalable way; it defines the monitoring metrics (e.g., the attributes of flows aggregation and thresholds); (b) ECS, an entropy calculation scheme to measure disorder/randomness of network traffic; and (c) BNF, a real-time detection scheme, to classify, based on entropy values, illegitimate DNS requests; (3) DM, a DNS mitigation scheme to effectively mitigate illegitimate DNS requests enabling the network to recover quickly in short time. DM installs new OF rules into OF switches under attack in order to monitor the speed of illegitimate DNS requests. WisdomSDN separates flow monitoring from the forwarding logic; this makes it much scalable and more efficient than OF native schemes. The REST API [START_REF]Rest API[END_REF] is used in the process of detection/mitigation to offer the interoperability in order to manage any SDN controller (e.g., OpenDaylight [START_REF]Opendaylight[END_REF], Floodlight [START_REF]Floodlight[END_REF]).

Proactive And Stateful Scheme (PAS)

PAS is a novel proactive and stateful scheme that is inspired by the techniques of oneto-one mapping between DNS requests and DNS responses [START_REF] Sun | Efficient and low-cost hardware defense against dns amplification attacks[END_REF]. First, the SDN controller pushes the OF rules (see Algorithm 1) to OF switches in order to process proactively all DNS traffic (i.e., DNS requests and DNS responses). In PAS, a DNS response is considered as legitimate if it has the same reversed fields' values (i.e., M AC addresses, IP addresses, and U DP ports) of a pre-sent DNS request; otherwise, this DNS response will be considered as illegitimate and systematically eliminated. This allows OF switches to be smart enough to react quickly, to avoid any attempt of external DNS amplification attack that aims to flood the victim's network with amplified DNS traffic, and not wait for a reactive rule from the SDN controller. However, when an attacker is within the victim's network (see Figs.

2.4(c), and 2.4(d)), he can easily spoof the source IP address of the victim in order to direct the amplified DNS responses to that victim. To alleviate this issue, each DNS response received, by each OF switch, is forwarded to the original port (i.e., ingress port) from which the corresponding DNS request came. Then, if the attacker spoofed the source IP address in the prior DNS request, he will receive the returned amplified DNS traffic (see Figs. 2.5(b), 2.5(c), and 2.5(d)). Otherwise, legitimate sources will receive legitimate DNS responses. Thus, PAS totally ensures the protection of the victim from any external or internal DNS amplification attack. PAS uses short timeout (i.e., idle timeout and hard timeout) in order to avoid the storage complexity to maintain the one-to-one mapping. Algorithm 1 illustrates steps executed by each OF switch upon receipt of a packet. Fig. 2.5(a) shows that with WisdomSDN and since there is no DNS request that is sent from a host in the network, the default OF rule (Proto=UDP, port_src=53, prior=0, action=DROP) is triggered in order to drop illegitimate DNS responses; unlike without WisdomSDN, where the victim is flooded with illegitimate amplified DNS responses (see Fig. 2.4(a)). Figs. 2.5(b), 2.5(c) and 2.5 (d) show that PAS traces the real path of the DNS requests provenance, using the ingres port in the OF switch, and sends the corresponding responses using the same path as the requests. Thus, the attacker will receive the returned amplified DNS responses, and the victim will not receive any illegitimate DNS traffic; unlike without WisdomSDN, where the victim is flooded with illegitimate amplified DNS responses (see Figs. 2.4(a), 2.4(b), 2.4(c) and 2.4(d)). To protect TCAM of OF switches, which can be the target for attackers, from the huge amount of DNS requests, we propose a machine learning DDoS detection module that consists of FSC, ECS and BNF. In what follows, we investigate how this module can effectively detect illegitimate DNS requests.

Machine Learning DDoS Detection Module

This module aims to protect TCAM of OF switches while maintaining the SDN secure; it consists of the following: (1) FSC to gather network traffic features in an efficient and scalable way using sFlow protocol; (2) ECS to extract network traffic features; and (3) BNF to, based on ECS calculation, detect network anomalies.

Flow Statistics Collection scheme (FSC)

In SDN environment, two commonly approaches are used to collect network traffic features (e.g., count number of received packets). The first approach is based on OF protocol while the second one is based on flow sampling (e.g., sFlow). In OF based approach, collection of network traffic features can be initiated when the control plane (i.e., SDN controller) sends a state request (ofp_flow_stats_request) to data plane devices (i.e., OF switches); these latter respond with one or more reply messages (ofp_flow_stats_reply) by sending network traffic features. To this aim, each OF switch needs to maintain a large number of flow entries. However, this can exhaust TCAM in OF switches. Moreover, a large size of reply messages sent by OF switches to SDN controller can exhaust the bandwidth between data plane and control plane, congest the OF channel and generate a DDoS attack on control plane. Thus, OF based approach is not efficient to detect high rate attacks (i.e., DNS amplification attack). To address the issues of OF based approach, we decided to monitor DNS flows based on flow sampling approach using sFlow protocol. This is more scalable and efficient; moreover, it does neither overload the OF channel nor consume bandwidth between control plane and data plane. FSC performs flow aggregation which makes it more adequate to detect high rate DNS amplification attack. In FSC, at each monitoring interval ∆T , the sFlow collector (i.e., sFlow-RT) receives network traffic features from sFlow agents embedded in data plane (i.e., OF switches). Then, ECS computes the entropy values of network traffic. Table 2.1 shows the list of notations used to describe ECS. In this work, we define a

Notations Definition

M AC src

The M AC source address of a packet M AC dst

The M AC destination address of a packet IP src

The IP source address of a packet IP dst

The IP destination address of a packet P ort src

The P ort source of a packet P ort dst

The P ort destination of a packet IP proto

The transport protocol of a packet (TCP/UDP) S j

OF switch S j ∆T

The monitoring interval

F i,j
Flow f i at a local OF switch S j p i,j

The probability of flow f i over all flows at local OF switch S j N

The total number of flows at local OF switch S j R Set of real numbers I Set of positive integers flow as a seven tuple: {M AC src , M AC dst , IP src , IP dst , P ort src , P ort dst = 53, P roto = U DP }

Entropy Calculation Scheme (ECS)

The concept behind ECS comes from Shannon's information theory [START_REF] Shannon | Prediction and entropy of printed english[END_REF]. ECS is used to extract network traffic features and calculates entropy values of each flow. When the victim's network is under attack, the number of packets for a given flow that have the same source IP address, denoted IP src , will sharply increase causing a more concentrated distribution of source IP address; while normal state leads to a more dispersed probability distribution of source IP address. The higher entropy values, the more dispersed probability distribution of the source IP address, while low entropy values means the concentration of distribution of source IP address. If the source sends similar requests (e.g., requests from the same source IP address IP src ), then its entropy will be low; this means that we are very likely in the presence of illegitimate flow. Therefore, we use ECS to measure the changes of network traffic. A flow is characterized by a sequence of packets that have similar properties reaching the same OF switch S j during each monitoring interval ∆T . Let F i,j denotes flow f i at local OF switch S j ; it is defined as follows:

F i,j (IP src i ,S j ) = {< IP src i ,S j ,t > |S j ∈ S, i,j ∈ I, t ∈ R} (2.7.1)
where IP src i is the source IP address of f i , t is the current timestamp, and S = {S j , j ∈ I} are the set of OF switches.

Let |F i,j (IP src i ,S j ,t)| be the count number of packets of flow F i,j at time t. The variation of the number of packets for flow f i at local OF switch S j during ∆T is defined as follows:

N F i,j (IP src i ,S j ,t + ∆T ) = |F i,j (IP src i ,S j ,t + ∆T )| -|F i,j (IP src i ,S j ,t)| (2.7.2)
The probability p i,j of flow f i over all flows at local OF switch S j is expressed as follows:

p i,j (IP src i ,S j ) = N F i,j (IP src i ,S j ,t + ∆T ) N i=1 N F i,j (2.7.3)
where N i=1 p i,j (IP src i ,S j ) = 1. Let IP src be the random variable that represents the number of flows during time interval ∆T . We define the entropy of flows at a local OF switch S j as follows:

H(IP src ) = - N i=1 p i,j (IP src i ,S j ) log 2 p i,j (IP src i ,S j ) (2.7.4)
Lemma 1. The upper and lower bound of H(IP src ) are, respectively, 0 and log 2 N (see inequality (2.7.5)).

0 ≤ H(IP src ) ≤ log 2 N (2.7.5) Démonstration. Let f (x) = log 2 x, x ≥ 0. f (x) is a monotonically increasing concave function.
Let X be the random variable for flow distribution at an OF switch. Applying Jensen's inequality [START_REF] Briat | Convergence and equivalence results for the jensen's inequality-application to time-delay and sampled-data systems[END_REF] to f (x), we have Ef (X) ≤ f (EX). Let P (X) . = {p 1 , p 2 , ..., p n } be the distribution of flows at the OF switch. Then,

∀ p i , 0 ≤ p i ≤ 1, N i=1 p i f (x i ) ≤ f ( N i=1 p i x i ), where N i=1 p i = 1. Especially H(IP src ) = N i=1 p i log 2 ( 1 p i ) ≤ log 2 ( N i=1 p i 1 p i ) = log 2 N . Then, H(IP src ) ≤ log 2 N . Since log 2 1 p i ≥ 0, ∀ p i , 0 ≤ p i ≤ 1.
Then, H(IP src ) ≥ 0, and further Eq. (5.5.6) holds.

In order to normalize the entropy values, to have a measurement metric which is totally independent from the number of distinct entropy values, we divide them by the maximum value which is log 2 N , as is demonstrated in Eq. (5.5.6). Therefore, the normalized entropy values are in [0, 1] and are defined as follows:

H(IP src ) = H(IP src ) log 2 N (2.7.6)
Lemma 2. When the network is under DNS amplification attack, the upper bound of entropy variation at local OF switch S j decreases sharply in comparison to the normal, non-attack, case.

Démonstration. As we proved in Eq. (2.7.5), the entropy of flows reaches the upper bound, log 2 N , when the probability distribution of source IP address is almost even. The variation number of packets for each flow f i is almost stable, specifically, p 1 = p 2 = p 3 = ... = p N , and it reaches the lower bound, H(IP src ) = 0, when the probability distribution of source IP address is almost uneven. Especially,

p i = 1, 0 ≤ i ≤ N, p k = 0, ∀0 ≤ k ≤ N, k = i.
Since the entropy is a monotonic function [START_REF] Shannon | Prediction and entropy of printed english[END_REF]; therefore, when the victim's network is under DNS amplification attack, the distribution of source IP address moves toward the extreme unbalanced point. As result, the upper bound of the entropy variation decreases sharply.

High entropy values lead to a dispersed probability distribution of flows, whilst low entropy values indicate a concentrated probability distribution.

Démonstration. Let Ω(x) = x log 2 x, x ≥ 0. Ω(x) is a monotonically increasing convex function. Let X be the random variable for flow distribution at an OF switch S j . Applying Jensen's inequality to Ω(x), we have EΩ(X) ≥ Ω(EX). Let Ψ(X) . = {Ψ 1 , Ψ 2 , ..., Ψ n } be the distribution of flows at an OF switch S j , Ψ leg (X leg ) .

= {Ψ leg 1 , Ψ leg 2 , ..., Ψ leg n } be the distribution of normal case and Ψ illeg (X illeg ) . = {Ψ illeg 1 , Ψ illeg 2 , .
.., Ψ illeg n } be the distribution of attack case. As the network is stable in the normal case; therefore, H leg (IP src ) is also stable. Then, ∀i,

0 ≤ i ≤ N , Ψ leg i Ψ illeg i . More, EX leg EX illeg and Ω(EX leg ) Ω(EX illeg ). Therefore, E(Ω(X leg )) E(Ω(X illeg ))
. Hence, we have:

-N i=1 Ψ leg i log 2 Ψ leg i -N i=1 Ψ illeg i log 2 Ψ illeg i . Finally, the result is H leg (IP src ) H illeg (IP src ).
The attribute (i.e., header fields of the packet) used to aggregate incoming flows at a local OF switch S j depends on the scenario of the attack under consideration (e.g., DNS amplification attack). For example, many attackers sends multiple illegitimate DNS requests from the same UDP port source with the same DNS request type (e.g., AN Y ), as legitimate machines send legitimate DNS requests from random UDP port source with different DNS request types (e.g., A, MX, NS, etc.). Consequently, we use {IP src , P ort src and AN Y } as attributes to aggregate DNS flows. Similarly, we can also define the UDP port source entropy, H(P ort src ) and ANY entropy, H(AN Y ) . Finally, we represent the network traffic features at the k th time period as:

X k = {H(IP src ) k , H(P ort src ) k , H(AN Y ) k } (2.7.7)

Bayes Network based Filtering scheme (BNF)

BNF aims to detect illegitimate DNS requests that overload the network and may exhaust TCAM in OF switches. First, we describe the flow representation. Then, we discuss BNF criterion of classification. 2.7.3.1. Flow representation. We represent each sample in BNF by a vector x = (x 1 , x 2 , x 3 ) where x 1 , x 2 , x 3 are values taken, respectively, by random variables H(IP src ) , H(P ort src ) and H(AN Y ) . When the network suffers from DNS amplification attack, the number of DNS requests sent from the same IP src , with the same type (e.g., AN Y ) and from the same P ort src , will increase sharply. This leads to a significant decrease of entropy values of, respectively, H(IP src ) , H(P ort src ) and H(AN Y ) . Therefore, the vector X k can better represent the DNS amplification attack characteristics. Since p(leg|X k ) + p(illeg|X k ) = 1; thus, the selection criterion becomes:

X k is illegitimate iff p(illeg|X k ) ≥ 0.5 (2.7.8)
According to Bayes theorem [START_REF] Hoff | A First course in Bayesian statistical methods[END_REF], the probability of vector X k to belong to class c is defined as follows:

p(C = c|X = X k ) = p(C = c).p(X = X k |C = c) p(X = X k ) (2.7.9)
Using the total probability theorem, we conclude:

p(C = c|X = X k ) = p(C = c).p(X = X k |C = c) c∈{leg,illeg} p(C = c)p(X = X k |C = c) (2.7.10)
Therefore, the selection criterion can be expressed as follows: X k is illegitimate iff:

p(C = c|X = X k ) = p(C = c).p(X = X k |C = c) c∈{leg,illeg} p(C = c)p(X = X k |C = c) ≥ 0.5 (2.7.11)
H(IP src ) , H(P ort src ) and H(AN Y ) are conditionally independent variables given class c. Let p k (leg) and p k (illeg) denote, respectively, the conditional probabilities that vector X k is legitimate and illegitimate.

Using Eq. 2.7.11, the selection criterion becomes as follows: X k is illegitimate iff:

n k=1 p X k k (illeg)(1 -p k (illeg)) 1-X k p(illeg) n k=1 p X k k (illeg)(1 -p k (illeg)) 1-X k p(illeg) + n k=1 p X k k (leg)(1 -p k (leg)) 1-X k p(leg) ≥ 0.5
(2.7.12) When p(leg) = p(illeg), the selection criterion become as follows: X k is illegitimate iff:

n k=1 p X k k (illeg)(1 -p k (illeg)) 1-X k n k=1 p X k k (illeg)(1 -p k (illeg)) 1-X k + n k=1 p X k k (leg)(1 -p k (leg)) 1-X k ≥ 0.5 (2.7.13)
BNF is trained and then used to classify the k th vector X k as either legitimate or illegitimate. By combining ECS and BNF, WisdomSDN can accurately detect illegitimate DNS requests in real time with low false positive rates while maintaining a high detection rate.

Machine Learning DDoS Detection Algorithm

After having explained our machine learning DDoS detection Module, in this section we summarize this calculation via an algorithm (see Algorithm 2). This algorithm is implemented on the top of the SDN controller as a REST application and allows, using sFlow protocol, the monitoring of each incoming flow; it defines some monitoring metrics (e.g., address groups, attributes of flows aggregation, and thresholds) and commands the sFlow collector to deploy these monitoring metrics within the data plane using sFlow protocol. Using the collected data, the algorithm detects illegitimate flows.

DNS Mitigation Scheme (DM)

When BNF detects illegitimate DNS requests (i.e., illegitimate traffic features vector X k ), a mitigation rule is executed in order to protect TCAM of OF switches. DM installs new OF rules into OF switches under DNS amplification attack; these rules have a high priority to match illegitimate flows and monitor their speed. OF protocol was designed without any support to QoS features; however, OF 1.3 introduces meters [START_REF]Openflow switch specification[END_REF]

N F i,j (att i ,S j ,t + ∆T ) = |F i,j (att i ,S j ,t + ∆T )| -|F i,j (att i ,S j ,t)| 3 end 4 for i ←1 to N do 5 p i,j (att i ,S j ) = N F i,j (att i ,S j ,t+∆T ) N i=1 N F i,j H(IP src )+ = -p i,j (IP src i ,S j ) log 2 p i,j (IP src i ,S j ) H(P ort src )+ = -p i,j (P ort src i ,S j ) log 2 p i,j (P ort src i ,S j ) H(AN Y )+ = -p i,j (AN Y i ,S j ) log 2 p i,j (AN Y i ,S j ) 6 end 7 4

. Calculate the normalized entropy values as follows:

H(IP src ) = H(IPsrc)

log 2 N H(P ort src ) = H(P ortsrc) log 2 N H(AN Y ) = H(AN Y ) log 2 N
5. Calculate the network traffic features at the k th time period as:

X k = {H(IP src ) k , H(P ort src ) k , H(AN Y ) k } 6. if p(illeg |X k ) ≥ 0.

Evaluation of WisdomSDN

In this section, we present the evaluation of WisdomSDN. First, we introduce the experimental environment. Then, we evaluate the performance of WisdomSDN.

Experimental Environment

PAS is implemented in OF switch (i.e., OpenvSwitch); while Machine Learning DDoS Detection Module (i.e., FSC, ECS and BNF) and DM are implemented as applications on the top of the SDN controller. PAS systematically blocks amplified illegitimate DNS responses. Using FSC, ECS extracts network traffic features; then, BNF detects automatically illegitimate DNS requests. Finally, DM mitigates the illegitimate DNS requests. In order to emulate a real network environment, we use Mininet, a popular SDN emulation tool. Mininet uses Linux containers and virtual OF switches (e.g., OpenvSwitch) to allow realistic virtual networks of switches and hosts to be constructed using a virtual machine (VM). In our testing environment, the network monitor (i.e., sFlow-RT) and the SDN controller (i.e., Floodlight) are installed on the host-system. We run our experiments on a PC with CPU Intel Core i7-8750H-2.2 GHz and 16GB RAM. legitimate hosts. In order to test the scalability of WisdomSDN, we varied the rate of attack from 100 to 500 Mbps. Table 2.2 shows the parameter values for our experimentations.

For the attack script, Scapy's Python library [START_REF]Scapy[END_REF] module of Python that makes easy to forge, send, receive and manipulate network packets, is used to forge DNS request. No-deJs [START_REF]Nodejs[END_REF] is used to create the DNS server using dnsd package; in order to emulate a real DNS amplification attack, the DNS server is implemented to send amplified DNS responses. Tcpdump [START_REF]Tcpdump[END_REF], Wireshark [START_REF]Wireshark[END_REF] and Iperf [START_REF]Iperf[END_REF] are used to capture and analyzes the network traffic in real-time. For each scenario presented in Figs. the attacker will receive the illegitimate DNS response. Thus, the victim is totally protected and his network bandwidth is not used by the traffic generated by the attack (12Mbps of available bandwidth) even if the attack rate reaches 2000 pps. PAS not only saves the victim's network bandwidth, but also reduces the load of OF channel. Fig. 2.8(b) shows OF channel's workload variations with and without WisdomSDN. Without WisdomSDN, with the increase of attack rate, the load of OF channel increases sharply. With WisdomSDN, we use our proactive mechanism (i.e., PAS) and not a reactive one. In PAS, each OF switch makes filtering of illegitimate DNS responses from all DNS traffic without sending amplified traffic to SDN controller. Thus, saving the load of OF channel. Fig. 2.9(a) shows that, without WisdomSDN, the attack rate reaches more than 2000 DNS requests per second. Thus, even if the victim is protected using PAS, the OF switch can be overwhelmed. This occurs when the attacker is within the network of the victim and tries to overwhelm TCAM of OF switches with a large number of illegitimate DNS requests. However, when our machine Learning DDoS detection module is deployed, the traffic, generated by the attack. is effectively monitored using FSC; when ECS and BNF classify the flow as illegitimate, it is stopped and DM automatically mitigates the traffic attack (rate limit). Fig. 2.9(b) shows that the time taken to mitigate the attacks is less than 13 seconds. Thus, we can effectively and quickly recover the network in short time.

To examine the effectiveness of ECS, we set a simulation interval of 250s; then, we launch the attack during the interval of 150 -200s.

Performance Evaluation

The performance of BNF is measured using ROC curves. The ROC curve shows the True Positive Rate (TPR) called sensitivity or Detection Rate (DR) according to the False Positive Rate (FPR). To evaluate the detection rate of BNF in high traffic rate, we conducted two experiments (i.e., 100M bps and 500M bps) and we compared BNF in terms of detection rate and FPR with ChainSecure [START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using SDN[END_REF] and FlowEntropy [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF]. To measure the performance of BNF, we use confusion matrix (see Table 2.3); it provides several metrics that can help to study the performance of BNF. We also define DR and F P R as follows:

Se = DR = T P T P + F N , 1 -Sp = F P R = F P T N + F P
where, TP represent the illegitimate flows that are correctly classified as illegitimate, FN represent the illegitimate flows that are identified as legitimate, FP represent the legitimate flows that are classified as illegitimate, and TN represent the legitimate flows that are correctly identified as legitimate. Fig. 2.11(a) shows that WisdomSDN achieves around 100% detection rate for 100M bps case while it has just 23% of FPR, while [START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using SDN[END_REF] and [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF] achieve the same detection rate but with respectively 31% and 40% of FPR. Fig. 2.11(b) shows that WisdomSDN achieves around 100% detection rate for 500 Mbps case while it has just 21% of FPR, while [START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using SDN[END_REF] and [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF] achieve the same detection rate but with respectively 30% and 34% of FPR.

Conclusion

SDN is an emerging technology that brings numerous benefits by decoupling the control plane from data plane. On one hand, the separation of the control plane from the data plane allows for more control over the network and brings new capabilities to deal with large forms of DDoS attacks. On the other hand, this separation introduces new challenges regarding the security of the control plane. This chapter aims to deal with DNS amplification attack while maintaining the SDN secure (i.e., protecting the resources of data plane (i.e., Ternary Content Addressable Memory (TCAM) of OF switches). For this aim, first, we proposed PAS, a proactive and stateful scheme that performs a one-to-one mapping between DNS request and DNS response in order to: (1) protect the victim from DNS amplification attack; and (2) protect the resources of the SDN controller. Then, we proposed a machine learning DDoS detection module that consists of: FSC, ECS and BNF in order to detect illegitimate DNS requests and protect TCAM of OF switches. Finally, DM is designed to mitigate illegitimate DNS requests. In our simulations, we set a fixed idle and hard timeouts of flow rules. For large values, flow rules stay in OF table for a long time which can exhaust TCAM of OF switches, while too small values, may lead to the dropping of legitimate DNS responses. For future work, we intend to design a novel optimization algorithms to set dynamically those timeouts. This optimization can be based on the capacity of OF table, traffic rate and workload of both data plane and control plane. In the following chapter, we extend this work considering inter-domain mitigation based on a decentralized architecture (e.g., Blockchain) ensuring two levels of mitigation (i.e., intra-domain and inter-domain DDoS mitigation).

Chapitre 3

Cochain-SC: An Intra and Inter-Domain Ddos Mitigation Scheme Based on Blockchain

Using SDN and Smart Contract

Abstract

With the exponential growth in the number of insecure devices, the impact of Distributed Denial-of-Service (DDoS) attacks is growing rapidly. Existing DDoS mitigation schemes are facing obstacles due to low flexibility, lack of resources and high cost. The new emerging technologies, such as blockchain, introduce new opportunities for low-cost, efficient and flexible DDoS attacks mitigation across multiple domains. In this chapter, we propose a blockchain-based approach, called Cochain-SC, which combines two levels of mitigation, intra-domain and inter-domain DDoS mitigation. For intra-domain, we propose an effective DDoS mitigation method in the context of software defined networks (SDN); it consists of 3 schemes: (1) Intra Entropy-based scheme (I-ES) to measure, using sFlow, the randomness of data inside the domain; (2) Intra Bayes-based scheme (I-BS) to classify, based on entropy values, illegitimate flows; and (3) Intra-domain Mitigation (I-DM) scheme to effectively mitigate illegitimate flows inside the domain. For inter-domain, we propose a collaborative DDoS mitigation scheme based on blockchain; it uses the concept of smart contracts (i.e., Ethereum's smart contracts) to facilitate the collaboration among SDN-based domains (i.e., Autonomous System: AS) to mitigate DDoS attacks. For this aim, we design a novel and secure scheme that allows multiple SDN-based domains to securely collaborate and transfer attack information in a decentralized manner. Combining intra-domain and inter-domain DDoS mitigation, Cochain-SC allows an efficient mitigation along the path of an ongoing attack and an effective mitigation near the origin of the attack. This allows reducing the enormous cost of forwarding packets, across multiple domains, which consist mostly of useless amplified attack traffic. To the best of our knowledge, Cochain-SC is

Introduction

In recent years, security threats of DDoS attacks have been increasing causing severe collateral damage to network operators as well as Internet service providers (ISPs). Some recent dramatic incidents (e.g., DDoS attacks against US banks [START_REF]DDoS attacks against US banks[END_REF]) show that DDoS attacks are becoming powerful, devastating and more destructive plaguing network operators and ISPs in a stealthy way [START_REF] Zheng | Realtime ddos defense using cots sdn switches via adaptive correlation analysis[END_REF]. Indeed, the rapid growth in the number of insecure devices, with an estimated 75 billion devices by the end of 2025 [START_REF] Horwitz | The future of IoT miniguide: The burgeoning iot market continues[END_REF], can facilitate and enhance the capability of attacks. For example, on the 2 of October 2016, a huge and dramatic attack, exceeding a rate of 1 Tbit/s, was conducted against Dyn Domaine Name System (DNS) services. As a consequence, many popular Internet services, e.g., Amazon and GitHub [START_REF] Sharwood | Github wobbles under ddos attack[END_REF] became disconnected for several hours [6]. Such incidents damage ISPs and cost millions of dollars of lost revenues for enterprises [START_REF] Simpson | An inter-domain collaboration scheme to remedy ddos attacks in computer networks[END_REF].

Recently, SDN has attracted tremendous attention as a novel technology that facilitates network management and provides new capabilities to manage and deploy networks dynamically. SDN separates data and control planes; this separation allows for more control over the network and brings a new way to deal with various form of DDoS attacks.

To deal with DDoS attacks inside a domain (i.e., AS), we propose an effective DDoS mitigation method in the context of SDN; it consists of 3 schemes: (1) an intra Entropybased scheme (I-ES) to measure, using sFlow [START_REF]Sflow[END_REF], the randomness of data inside the SDN based domain; (2) an intra Bayes-based scheme (I-BS) to classify, based on entropy values, illegitimate flows; and (3) an intra-domain Mitigation (I-DM) scheme to effectively mitigate illegitimate flows inside the domain. However, an intra-domain DDoS mitigation alone cannot mitigate DDoS attacks on the paths to the victim because the attackers and the target are not necessarily in the same AS (see Fig. 3.1). Thus, there is a need to an efficient interdomain collaboration to: (a) effectively reduce the enormous cost of forwarding packets, across multiple domains, which are mostly useless amplified attack traffic; and (b) block the attack close to its source. Existing collaborative DDoS mitigation schemes suffer from low flexibility and high cost; more importantly, they are centralized. The centralized solution, by its nature, causes single-point-of-failure and is vulnerable to DDoS attacks that can make it difficult, or even infeasible, to share information, among ASs, and make effective decisions to mitigate the attacks.

The new emerging technologies, such as blockchain and smart contract, open new opportunities for low-cost, efficient and flexible collaboration across multiple ASs to mitigate DDoS attacks. Indeed, blockchain has been shown to provide a decentralized collaboration in trustless network environments. Blockchain technology (e.g., Bitcoin [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF], Ethereum [8] and Zcash [START_REF] Hopwood | Zcash protocol specification[END_REF]) has proven its effectiveness and success in achieving high level of security and transparency in financial field [START_REF]Blockchain for Financial Services[END_REF] as well as non-financial fields (e.g., Healthcare [START_REF] Houtan | A survey on blockchain-based self-sovereign patient identity in healthcare[END_REF], Decentralized IoT [START_REF] Moudoud | An iot blockchain architecture using oracles and smart contracts: the use-case of a food supply chain[END_REF], Decentralized Data Sharing [START_REF] Wang | A blockchain-based framework for data sharing with fine-grained access control in decentralized storage systems[END_REF], and online advertising [START_REF] Pärssinen | Is blockchain ready to revolutionize online advertising?[END_REF]). The inter-domain collaboration process may exploit the power of the decentralized approach by replicating data on each network's node, thus enforcing integrity and reliability of the whole ecosystem.

For inter-domain, we propose a collaborative DDoS mitigation scheme based on blockchain. This scheme uses the concept of smart contracts (i.e., Ethereum's smart contracts) to facilitate the collaboration among SDN-based domains (i.e., AS) to mitigate DDoS attacks. We design a novel and secure scheme that allows multiple SDN-based domains to securely collaborate and transfer attack information in a decentralized manner. This allows an SDN-based domain to effectively collaborate and inform its neighboring domains about ongoing DDoS attacks. Thus, by combining our scalable intra-domain mitigation approach based on SDN and inter-domain DDoS mitigation scheme, we are not only able to efficiently mitigate DDoS attacks within the target's domain, but also to share attack information in a fully decentralized manner resulting in effective decision making, by multiple domains, to mitigate against DDoS attacks.

This chapter presents the design, specification and implementation of a blockchain-based approach called Cochain-SC in which two levels of mitigation are combined (i.e., intradomain and inter-domain DDoS mitigation). Cochain-SC provides an efficient mitigation along the path of an ongoing attack and effective mitigation near of source of the attack. The implementation of Cochain-SC is deployed on Ethereum official test network Ropsten [START_REF] Etherscan | The Ethereum Block Explorer: Ropsten Testnet[END_REF], an open blockchain platform.

The main contributions of this chapter can be summarized as follows:

•

Background And Related Work

Several schemes have been proposed in the literature to mitigate DDoS attacks. In this section, we briefly introduce DDoS attacks. Then, we overview existing DDoS mitigation schemes that can be classified in two categories: (1) intra-domain DDoS mitigation schemes; and (2) inter-domain DDoS mitigation/collaboration schemes.

DDoS Attacks Techniques

DDoS attacks aim to overwhelm target's resources, such as network bandwidth and computer CPU, with illegitimate flows. To launch DDoS attacks, the attacker (e.g., bot master), generally, needs to control a large number of compromised devices (called zombies). Each zombie sends a huge volume of illegitimate traffic, to deny services, to legitimate users of the target (see Fig. 3.2). There are two major categories of DDoS attacks: real source IPbased attacks (typical DDoS attacks) and DRDoS (Distributed Reflection Denial of Service) attacks. In a typical DDoS attack, the bot master orders a large number of zombies to directly flood the target. DRDoS attacks consist of bot master, zombies and reflectors. Each zombie is ordered by the bot master to send a large number of packets, in which the source IP address is replaced with the victim's IP address, to other devices known as reflectors; upon receipt of these packets, the reflectors send the victim a huge volume of illegitimate traffic. In this chapter, we consider typical DDoS attacks. Also, we combine an intra-domain DDoS mitigation scheme using machine learning scheme (i.e., I-BS) to enhance the accuracy of the detection model. Also, we integrate an inter-domain DDoS collaboration scheme that allows for an efficient mitigation along the path of an ongoing attack and effective mitigation near to the origin of the attack.

Intra-Domain DDoS Mitigation Schemes

Several intra-domain DDoS mitigation schemes have been proposed; in the following, we present some of the most prominent as well as their limitations.

The BCP 38 standard [START_REF] Ferguson | Network ingress filtering: Defeating denial of service attacks which employ ip source address spoofing (bcp 38)[END_REF] proposes a filtering method that requires every ISP to: (a) verify that the packets from its network use valid prefixes (IP addresses); and (b) filter these packets that use forged source addresses that are outside its range of legitimate addresses. This type of solution has proven to be effective against IP-spoofing attacks. However, it does absolutely nothing to deal with real source IP-based attacks. In [START_REF] Braga | Lightweight ddos flooding attack detection using nox/openflow[END_REF], Rodrigo et al. proposed a flow-based intrusion detection scheme (i.e., Self Organizing Maps) using OpenFlow (OF) protocol to gather traffic flow statistics. This scheme [START_REF] Braga | Lightweight ddos flooding attack detection using nox/openflow[END_REF] did not consider the overhead to the control plane caused by the flow collecting process using OF protocol; moreover, performance analysis does not include the overall system performance. In [START_REF] Mehdi | Revisiting traffic anomaly detection using software defined networking[END_REF], Mehdi et al. proposed an anomaly detection scheme in the context of SDN using OF protocol. However, the scheme was focused only on the home environment (i.e., small-scale setup); in largescale environments, a high rate data traffic to SDN controller may overload the control plane. In [START_REF] Yu | Software defined traffic measurement with opensketch[END_REF], Yu et al. proposed OpenSketch, a software defined traffic measurement scheme. OpenSketch provides an efficient method to collect measurement data through a three-stage pipeline (hashing, filtering, and counting). However, OpenSketch sends all the counters to the SDN controller for analysis, which may overload the control plane. In [START_REF] Wang | An entropy-based distributed ddos detection mechanism in softwaredefined networking[END_REF], Wang et al. proposed an entropy-based scheme in OF switches; it focuses only on detection, but it cannot find the victim or the illegitimate hosts to, eventually, block them. In [START_REF] Lim | A sdn-oriented ddos blocking scheme for botnet-based attacks[END_REF], Lim et al. proposed a DDoS mitigation scheme for botnet-based attacks that runs on SDN controller; it requires a large amount of communications between the control plane and data plane to protect the victim. Moreover, this scheme [START_REF] Lim | A sdn-oriented ddos blocking scheme for botnet-based attacks[END_REF] not only makes the SDN controller vulnerable to DDoS attacks but also requires a high latency to cooperate with the SDN controller. In [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF], K. Giotis et al. combined sFlow protocol with OF protocol in order to detect DDoS attacks reducing the communication overhead between data plane and control plane. This scheme [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF] works well; however, it has high false positive rates.

To address the weaknesses of existing solutions [START_REF] Ferguson | Network ingress filtering: Defeating denial of service attacks which employ ip source address spoofing (bcp 38)[END_REF][START_REF] Braga | Lightweight ddos flooding attack detection using nox/openflow[END_REF][START_REF] Mehdi | Revisiting traffic anomaly detection using software defined networking[END_REF][START_REF] Yu | Software defined traffic measurement with opensketch[END_REF][START_REF] Wang | An entropy-based distributed ddos detection mechanism in softwaredefined networking[END_REF][START_REF] Lim | A sdn-oriented ddos blocking scheme for botnet-based attacks[END_REF][START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF], we propose an efficient and scalable intra-domain DDoS mitigation scheme to detect and mitigate DDoS attacks. In our scheme, we combine entropy calculation using sFlow with SDN functionalities to block illegitimate traffic. The proposed solution employs sFlow protocol to separate flow monitoring from the forwarding logic; this makes it much more scalable compared to existing native OF schemes [START_REF] Ferguson | Network ingress filtering: Defeating denial of service attacks which employ ip source address spoofing (bcp 38)[END_REF][START_REF] Braga | Lightweight ddos flooding attack detection using nox/openflow[END_REF][START_REF] Mehdi | Revisiting traffic anomaly detection using software defined networking[END_REF][START_REF] Yu | Software defined traffic measurement with opensketch[END_REF][START_REF] Wang | An entropy-based distributed ddos detection mechanism in softwaredefined networking[END_REF][START_REF] Lim | A sdn-oriented ddos blocking scheme for botnet-based attacks[END_REF][START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF]. And using machine learning scheme (i.e., I-BS), our intra-domain DDoS mitigation scheme is much accurate in comparison with the ones using sampling technology [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF].

Inter-Domain DDoS Mitigation Schemes

As DDoS attacks evolve rapidly and become more devastating, cooperation among several domains has become necessary to ensure sophisticated mitigation in order to cope with large scale DDoS attacks.

Several mitigation schemes have been proposed to effectively collaborate in order to deal with DDoS attacks. However, only a few of them have been considered for widespread deployment because of their implementation complexity and limited effectiveness. F. Guo et al. [START_REF] Guo | Spoof detection for preventing dos attacks against dns servers[END_REF] proposed a mechanism that deploys filters at the border of the network to block incoming packets with source IP addresses that do not belong to the network. However, the effectiveness of this method depends on global deployment across the Internet. This method has "neighborhood policy" that requires every ISP to participate in order to provide the list of IP addresses that does not belong to its network. In [START_REF] Nishizuka | Interorganization cooperative DDOS protection mechanism[END_REF], IETF (Internet Engineering Task Force) proposed the development of a new collaborative protocol called DOTS (DDoS Open Threat Signaling) in order to advertise DDoS attacks. The inter-domain collaboration scheme used in DOTS leverages the mitigation by sharing resources among organizations. DOTS protocol consists of customers (i.e., DOTS clients) and controller (i.e., DOTS server). When an attack is detected, the customer requests the mitigation service from the controller that is responsible for inter-domain communication and coordination. The implementation of the inter-domain DDoS mitigation can be either distributed or centralized. However, the effectiveness of DOTS depends on global deployment which may be disregarded due to implementation complexity. Moreover, the process of collaboration can be easily compromised. To counter this, digital certificates can be used; however, it is costly to setup and maintain certificates. In addition, if centralized implementation is used, it will cause single-point-of-failure.

In [START_REF] Steinberger | Collaborative ddos defense using flow-based security event information[END_REF], Steinberger et al. proposed a similar scheme to DOTS [START_REF] Nishizuka | Interorganization cooperative DDOS protection mechanism[END_REF]; it uses flow-based event exchange format to simplify the deployment and the collaboration between domains. This scheme [START_REF] Steinberger | Collaborative ddos defense using flow-based security event information[END_REF] also requires a secure public-key infrastructure (PKI). PKI-based systems are costly to setup and maintain [START_REF]Total cost of ownership (tco) for PKI -white paper[END_REF]. In [START_REF] Giotis | A reputation-based collaborative schema for the mitigation of distributed attacks in sdn domains[END_REF], Giotis et al. proposed a collaborative DDoS mitigation scheme across multiple SDN based domains. They extend Border Gateway Protocol (BGP) protocol to repost incidents as URIs in BGP signals. However, any modification to BGP is a challenging endeavor. Moreover, the incident report latency may be large given that domains do not report in real-time. More importantly, this scheme [START_REF] Giotis | A reputation-based collaborative schema for the mitigation of distributed attacks in sdn domains[END_REF] does not verify the authenticity of incident reports resulting in a scheme that is vulnerable to spoofed incident reports from illegitimate domains. In [START_REF] Rashidi | A collaborative ddos defence framework using network function virtualization[END_REF], Bahman et al. proposed CoFence, a DDoS defense mechanism that facilitates collaboration among network function virtualization (NFV) based domains. In CoFence, when a NFV-based domain is under attack, it redirects the traffic to other NFV-based domains to filter the packets. First, CoFence has a privacy issue since it redirects the traffic to other NFV-based domains. Moreover, this process of redirection will also increase incident report latency. Many other schemes have been proposed (e.g., [START_REF] Simpson | An inter-domain collaboration scheme to remedy ddos attacks in computer networks[END_REF][START_REF] Chen | Collaborative detection of ddos attacks over multiple network domains[END_REF]); however, the complexity of deployment and overhead, that is generated, remain challenging issues in these schemes. In [START_REF] Rodrigues | A blockchain-based architecture for collaborative ddos mitigation with smart contracts[END_REF], Rodrigues et al. proposed a scheme, which uses blockchain and smart contracts, to advertise blacklisted IP addresses. However, this scheme [START_REF] Rodrigues | A blockchain-based architecture for collaborative ddos mitigation with smart contracts[END_REF] requires a central entity to issue certificates of ownership of IP addresses, when calling (i.e., storing data) smart contracts. Moreover, it is concerned only with inter-domain DDoS mitigation and not with intra-domain DDoS mitigation. In [START_REF] Steichen | Chainguard-a firewall for blockchain applications using sdn with openflow[END_REF], Mathis et al. proposed an OpenFlow-based firewall to provide security to blockchain nodes. They implemented their solution as a module, in SDN controller, that uses SDN functionalities to filter network traffic; it provides access control functionality and protects blockchain nodes from DoS attacks. However, a very high packet rate from switches to SDN controller may overload the control plane.

To address the shortcomings of existing solutions [62, 79-81, 83-87], we propose an efficient, secure, low-cost, easy-to-deploy and decentralized inter-domain collaboration scheme; it allows multiple SDN based domains to securely collaborate and transfer attack information (i.e., suspicious IP addresses) in a decentralized manner based on blockchain using smart contract. The use of new technologies (e.g., SDN, blockchain and smart contract) introduces new opportunities for secure, efficient and flexible DDoS attacks collaboration across multiple SDN based domains. Indeed, with these technologies, one can avoid the complexity of developing new protocols and/or the modification of existing ones (e.g., [START_REF] Giotis | A reputation-based collaborative schema for the mitigation of distributed attacks in sdn domains[END_REF]); in addition, it removes the need to use a central entity in contrast to [START_REF] Rodrigues | A blockchain-based architecture for collaborative ddos mitigation with smart contracts[END_REF] and enforces permissions to participate in the collaboration.

Cochain-SC: An Overview

In this section, we present an overview of Cochain-SC. More specifically, we explain how Cochain-SC can combine two levels of mitigation, intra-domain and inter-domain DDoS mitigation, allowing for an efficient mitigation along the path of an ongoing attack and an effective mitigation near to the origin of attack. Inter-domain DDoS mitigation scheme assumes multiple SDN based domains (e.g., ASs: A, B, C, D, E and F) to collaborate as shown in Fig. 3.3. SDN based domains communicate with each other via our proposed inter-domain collaboration scheme based on blockchain using smart contract. First, the organization (i.e., owner of the smart contract) needs to create the collaboration contract. Then, it adds the authorized participants (i.e., collaborators). Therefore, when attackers, which are distributed across multiple domains, generate an attack towards the victim (e.g., hosted at AS C; see Fig. 3.3), our intra-domain DDoS mitigation scheme detects and mitigates the attack inside the domain; it also stores the suspicious IP address, denoted ip_address, in the smart contract. When the next block is mined, each of the authorized participants of the collaborative scheme will have access to the list of suspicious IP addresses to be blocked; this will allow for an efficient mitigation along the path of an ongoing attack and an effective mitigation near to the origin of attack. To report/receive attack informations, each SDN based domain runs an Ethereum client (e.g., geth client [START_REF][END_REF]). In the following, we describe Cochain-SC in more details. First, we describe our intra-domain DDoS mitigation scheme which is composed of 3 schemes (i.e., I-ES, I-BS and I-DM). Then, we describe our inter-domain DDoS mitigation scheme.

Intra-Domain DDoS Mitigation Scheme

Design Overview

When designing the our intra-domain DDoS mitigation scheme, we did consider the following objectives: (a) the scheme should ensure a full protection and should be accurate in detecting attacks inside the domain; this is ensured via a novel detection scheme (i.e., I-BS), based on an intra Entropy-based scheme (I-ES); (b) attacks should be effectively mitigated using our intra-Domain Mitigation (I-DM) scheme; and (c) the method should be scalable.

System Architecture

The architecture of intra-domain DDoS mitigation method consists of four main modules: (1) Intra Entropy-based Scheme (I-ES) to measure the randomness of data inside the domain using sFlow; (2) Intra Bayes-based Scheme (I-BS) to classify, using entropy values, illegitimate DDoS flows; (3) Intra-Domain Mitigation (I-DM) scheme to effectively mitigate illegitimate flows inside the domain; and (4) a blockchain layer, used in our inter-domain DDoS mitigation collaboration.

Intra-domain DDoS mitigation scheme has two main phases: (1) an intra-domain machine learning DDoS detection and mitigation module. This module has the objective to detect, in real-time, illegitimate flows; it consists of I-ES, I-BS and I-DM; and (2) a blockchain module, used in inter-domain DDoS mitigation. I-ES aims to measure the randomness of data inside the victim's domain (e.g., AS C; see Fig. 3.3) using network traffic flow features. I-BS has the objective to detect, in real-time, illegitimate flows based on stateful network traffic features calculation (I-ES calculation). This module is running as an application on the top of the SDN controller (i.e., application layer). Also, we use in our process of detection/mitigation, the REST API [START_REF]Rest API[END_REF] to manage any SDN controller and block illegitimate traffic. I-DM aims to effectively mitigate illegitimate traffic inside the domain. OF was not designed to support QoS features; however, OF 1.3 introduces meters [START_REF]Openflow switch specification[END_REF] to the OF protocol. Each flow entry specifies meter; meter entries with different Meter_id are deployed to monitor the speed of the classified illegitimate flows by I-BS; if the flow rate exceeds band (rate limiter), I-DM drops suspected flows.

Machine Learning DDoS Detection and Mitigation Module

In this section; first, we describe the details of our information collection method based on flow packet sampling using sFlow; then, we describe I-ES, to measure the randomness of data inside the domain and extract network features; finally, we descibe I-BS, to detect illegitimate flows.

Flow Statistics Collection

Scheme. There are two commonly methods for collecting information: the first method is based on OF protocol and the second method is based on flow monitoring. In this chapter, we choose to use flow monitoring methods based on sFlow protocol. In the following, we describe each of these methods and justify our choice. To detect DDoS attacks in SDN, most existing solutions [START_REF] Ferguson | Network ingress filtering: Defeating denial of service attacks which employ ip source address spoofing (bcp 38)[END_REF][START_REF] Braga | Lightweight ddos flooding attack detection using nox/openflow[END_REF][START_REF] Mehdi | Revisiting traffic anomaly detection using software defined networking[END_REF][START_REF] Yu | Software defined traffic measurement with opensketch[END_REF][START_REF] Wang | An entropy-based distributed ddos detection mechanism in softwaredefined networking[END_REF][START_REF] Lim | A sdn-oriented ddos blocking scheme for botnet-based attacks[END_REF][START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF] propose to collect and send, periodically, the features of the flows (e.g., number of received packets and duration of matched flows) to SDN controller using OF protocol. Collection of features, using OF protocol, can be initiated when the SDN controller sends a feature request (ofp_flow_stats_request) to OF switches which respond by sending the flow table content (ofp_flow_stats_reply). This method can collect the overall traffic of flow information passing through the data plane. However, this method can overload the control plane and exhausts the bandwidth between OF controller and OF switches; furthermore, it may exhaust Ternary Content Addressable Memory (TCAM) in OF switches. Therefore, OF based method is not adequate for detecting high rate DDoS attacks. To address the shortcomings of the method described above, we decided to monitor flows using flow monitoring method based on sFlow protocol. This is more efficient, scalable and does not consume bandwidth between SDN controller and OF switches. sFlow performs flow aggregation that is required during DDoS attacks when the number of flow entries is very high. The sFlow collector (sFlow-RT [START_REF]sflow-rt[END_REF]) receives periodically packet samples from each sFlow agent embedded in data plane (data plane devices) and updates the counters of each flow during the monitoring interval. Afterwards, periodically, I-ES calculates entropy values and I-BS detects automatically illegitimate flows.

3.5.3.2. Intra Entropy-based scheme (I-ES). The main idea behind I-ES comes from Shannon's information theory [START_REF] Shannon | Prediction and entropy of printed english[END_REF]. The entropy calculation measures the disorder/randomness of incoming data (i.e., the incoming flow for a given time period). I-ES runs as an application on the top of the controller and uses sFlow protocol; it collects traffic information and computes the entropy of each flow. When a victim's domain (e.g., AS C, see Fig. 3.3) is under DDoS attacks, the number of packets that have the same IP address destination, denoted IP dst (i.e., victim's IP address) increases resulting in a concentrated distribution of IP dst ; while the normal state of victim's network leads to a more dispersed probability distribution of IP dst . High entropy values mean highly dispersed probability distribution of IP dst , while low entropy values mean a concentration of IP dst . Therefore, we use I-ES to measure the changes of traffic information inside the victim's domain during monitoring interval ∆T . In this work, we define a flow as a seven tuple: {M AC src , M AC dst , IP src , IP dst , P ort src , P ort dst , P roto} Let F i,j denote flow f i at local OF switch S j ; it is defined as follows:

F i,j (IP dst i ,S j ) = {< IP dst i ,S j ,t > |S j ∈ S, i,j ∈ I, t ∈ R} (3.5.1)
where IP dst is the destination IP address of f i , t it the current timestamp, and S = {S j , j ∈ I} the set of OF switches.

Let |F i,j (IP dst i ,S j ,t)| be the count number of packets of flow F i,j at time t. The variation of the number of packets for flow f i at local OF switch S j during ∆T is defined as follows:

N F i,j (IP dst i ,S j ,t + ∆T ) = |F i,j (IP dst i ,S j ,t + ∆T )| -|F i,j (IP dst i ,S j ,t)| (3.5.2)
The probability p i,j of flow f i over all flows at local OF switch S j is expressed as follows:

p i,j (IP dst i ,S j ) = N F i,j (IP dst i ,S j ,t + ∆T ) N i=1 N F i,j (3.5.3)
where N i=1 p i,j (IP dst i ,S j ) = 1.

Let IP dst be a random variable that represents the number of flows during the time interval ∆T . We define the entropy of flow f i at local OF switch S j as follows:

H(IP dst ) = - N i=1 p i,j (IP dst i ,S j ) log 2 p i,j (IP dst i ,S j ) (3.5.4)
In order to have a measurement metric that is independent from the number of distinct values, we divide the entropy values by the upper bound value that is log 2 N . Therefore, the normalized entropy values are between [0, 1] and are defined as below:

H(IP dst ) = H(IP dst ) log 2 N (3.5.5)
The 3.5.3.3. Intra Bayes-based scheme (I-BS). I-BS is a binary classifier that uses I-ES calculation to classify the k th vector X k as either legitimate or illegitimate. I-BS receives vector X k and classifies it using the probability of illegitimacy. Once X k is classified as illegitimate, I-BS notifies I-DM to deploy the mitigation action against this illegitimate vector X k . In the following, we detail I-BS; first, we briefly describe the flow representation. Then, we discuss in more details the criterion classification of I-BS.

In I-BS, each sample is represented by a vector x = (x 1 , x 2 , x 3 ) where x 1 , x 2 , x 3 are values taken, respectively, by random variables H(IP dst ) , H(P ort src ) and H(P ort dst ) . Each of these random variables indicates, respectively, entropy values of destination IP address, UDP/TCP port source and UDP/TCP port destination. We have p(leg|X k ) + p(illeg|X k ) = 1; thus, the selection criterion is defined as follows:

X k is illegitimate iff: p(illeg|X k ) ≥ 0.5 (3.5.8)
Using Bayes theorem [START_REF] Hoff | A First course in Bayesian statistical methods[END_REF], the probability of vector X k to belong to class c is defined as follows:

p(C = c|X = X k ) = p(C = c).p(X = X k |C = c) p(X = X k ) (3.5.9)
According to the total probability theorem, we have:

p(C = c|X = X k ) = p(C = c).p(X = X k |C = c) c∈{leg,illeg} p(C = c)p(X = X k |C = c) (3.5.10)
Therefore, the selection criterion is equivalent to: X k is illegitimate iff

p(C = c|X = X k ) = p(C = c).p(X = X k |C = c) c∈{leg,illeg} p(C = c)p(X = X k |C = c) ≥ 0.5 (3.5.11)
H(IP dst ) , H(P ort src ) and H(P ort dst ) are conditionally independent variables given class c. Let p k (leg) and p k (illeg) denote the conditional probabilities that the k th vector X k is receptively legitimate and illegitimate.

Using Eq.(5.6.3), the selection criterion can be expressed as follows: X k is illegitimate iff :

n k=1 p X k k (illeg)(1 -p k (illeg)) 1-X k p(illeg) n k=1 p X k k (illeg)(1 -p k (illeg)) 1-X k p(illeg) + n k=1 p X k k (leg)(1 -p k (leg)) 1-X k p(leg)
≥ 0.5

(3.5.12) When p(leg) = p(illeg), the selection criterion becomes as follows: X k is illegitimate iff:

n k=1 p X k k (illeg)(1 -p k (illeg)) 1-X k n k=1 p X k k (illeg)(1 -p k (illeg)) 1-X k + n k=1 p X k k (leg)(1 -p k (leg)) 1-X k ≥ 0.5 (3.5.13)
I-BS is trained and then used to classify k th vector X k as either legitimate or illegitimate. By combining I-ES and I-BS, Cochain-SC can accurately detect the attack in real time with low false positive rates while maintaining a high detection rate.

Intra-Domain Mitigation (I-DM) Scheme

When I-BS detects DDoS attack, a mitigation action is performed to protect the victim. For this aim, new OF rules are installed, using the API of the SDN controller, into the OF switch under attack; these rules have a high priority to match suspicious packets and monitor their speed. I-DM has the purpose to effectively mitigate illegitimate traffic. A flow entry can specify a meter; meter entries with different Meter_id are deployed to monitor the speed of the classified illegitimate flows by I-BS; if the packet rate surpasses the band (rate limiter), then we drop suspected packets (see Fig. 3.4). In our simulations, we set an

Figure. 3.4. Table Model in OF switches

adaptive band; at the beginning the band is fixed to 1000 packets per second, then it can be adjusted based on the capacity of OF table, traffic rate and workload of both data and control plane.

Inter-Domain DDoS Mitigation Scheme

Overview

Cochain-SC has the objective to ensure sophisticated mitigation across multiple domains and cope with large scale DDoS attacks. Inter-domain DDoS mitigation assumes multiple SDN based domains to collaborate. Fig. 3.5 shows a high-level architecture of our interdomain DDoS mitigation scheme. ASs (SDN based domains) are classified into 3 types of network domains, source domain, intermediate network domains and destination domain. The source domain is the network (i.e., AS) in which the attacker starts the attack. Intermediate network domains forward illegitimate traffic. The destination domain is the domain where the victim is hosted. The SDN controller of each AS can either report or retrieve the list of illegitimate IPs (see Fig. 3.5). We have leveraged SDN and blockchain to both mitigate the attack inside the domain and effectively collaborate to: (a) reduce the enormous cost of forwarding packets, across multiple domains, that compose amplified attack traffic; and (b) block the attack close to its source.

Ethereum blockchain is a decentralized platform for developing smart contracts. The language to write these contracts is Turing complete (e.g., Solidity [START_REF]Solidity[END_REF]); this allows users to create and run smart contracts (of any complexity) on the blockchain. From the computing prospective, bitcoin network provides distributed data storage for managing transactions while the Ethereum network not only provides distributed data storage but also offers computing resources; each node of the Ethereum network executes the code (e.g., smart contract) that is deployed by participants using Ethereum Virtual Machine (EVM). Fig. 3.5 shows the main steps executed by the proposed approach: (1) Once our intra-domain DDoS mitigation scheme detects the attack, using I-ES and I-BS, it mitigates the attack inside the domain using I-DM and blocks the illegitimate traffic; (2) The SDN controller of the domain under the attack (Destination AS), sends a transaction, if it is authorized, to the smart contract in order to report suspicious IP adresses; (3) once the transaction is confirmed (i.e., the transaction is in the new block appended to the blockchain), an event is emmitted by the contract and is received by the registered/authorized collaborators of the smart contract (e.g., SDN controller of source and intermediate network domains); and (4) upon receipt of the event, the collaborators block the illegitimate traffic.

Cochain-sc's Smart Contract

3.6.2.1. Application scenario. We consider an organization (i.e., contract owner) that would like to manage a collaboration process between different ASs around the world. First, it creates Cochain-SC's smart contract and deploys it on the Ethereum blockchain. The use of blockchain in the collaboration process allows for transparency while maintaining "pseudonymity". Then, the organization adds, via the smart contract, the collaborators into the system. It includes the collaborator's address and some other information (e.g., collaborator notes). When a collaborator (e.g., victim's SDN controller) detects and mitigates an attack, it sends a transaction to the smart contract to add the suspicious IP address. The smart contract allows (1) the organization (owner of the contract) to add collaborators to the contract; (2) the organization to manage and modify the collaboration process in a transparent manner; (3) the organization to delete collaborators from the collaboration process if needed; (4) collaborators to report suspicious IP address in a secure and efficient manner; and (5) collaborators to delete the reported IP address from the contract if needed. In the following, we present the design of our smart contact.

3.6.2.2. Cochain-sc's design. The smart contract is programmed using solidity language. In our smart contract, we use the following global variables: now: the time passed in seconds since 1970; msg.sender: the msg object represents the transaction that is sent; and the msg.sender is the address of the user that sent the transaction to the smart contract. In Ethereum, there are two types of accounts: (1) Externally Owned Account (EOA): it has public and private keys; it can send transactions to transfer ether or to smart contracts and (2) contract account: it runs code and has no public/private key. The smart contract, called Collaboration contract, is deployed by the organization. In the following, we first describe the Collaboration Contract Initialization; then, we provide the functions of the Collaboration Contract.

Collaboration Contract Initialization: This process defines the state variables of the contract.

[1] The Collaboration Contract Owner of address types, which defines the address of organization responsible of the collaboration process. [2] The status of the Collaboration Contract: active or inactive. The contract owner is responsible for activating or deactivating the contract. [3] The name of the contract owner. [4] numberOfcollaborators: defines the number of collaborators. [5] numberOfrecords: defines the number of records (i.e., ip_addresses). [6] collaboratorsAdr: stores the addresses of the collaborators. The aim of this array is to reduce the cost of finding and removing a specific colloborator from the collaborators mapping (see variable 8).

[7] recordsAdr: stores the records of suspicious ip_address. The aim of recordsAdr is to reduce the cost of finding and removing a specific record from the records mapping (see variable 9). [8] collaborators: defines a mapping collection from the address of the collaborator to a corresponding Collaborator struct. [START_REF] Horwitz | The future of IoT miniguide: The burgeoning iot market continues[END_REF] Records: defines a mapping collection from the ip_address to a corresponding record struct. [10] OnlyOwner of modifier type. We applied this modifier to the function that (adds/removes) the collaborators (to/from) the smart contract and the function that either activates or deactivates the smart contract; thus, only the owner of the contract can invoke these functions (adds/removes) the colloborators or (activates/deactivates) the contract. [START_REF]NSL-KDD dataset[END_REF] OnlyCollaborators of modifier type. It takes as input the address of the caller and checks if the caller is authorized to exectue the function that the modifier is applied to it. We applied this modifier to the function that (adds/removes) the records (to/from) the smart contract; thus, only the collaborators (owner included) of the contract can invoke (adds/removes) the records.

The Collaboration Contract mainly provides the following functions where c denotes an instance of Collaborator and r an instance of record: isCollaborator(c.EOA): This function takes as input the Externally Owned Account (c.EOA) of a collaborator and returns true if the collaborator exists in the collaboration contract; otherwise, it returns false. This function will be invoked at the moment when the owner tries to add/ remove the collaborator to/from the collaboration contract. Algorithm 3 illustrates the logic of this function. isRecord(r.IP): This function takes as input ip_address of a record and returns true if the ip_address exists in the collaboration contract; otherwise, it returns false. This function will be invoked at the moment when one of the collaborators tries to add/remove the record to/from the collaboration contract. Algorithm 4 illustrates the logic of this function. addCollaborator(c.EOA, c.Infos): This function can only be invoked by the owner of the smart contract to add collaborators; it takes as input the Externally Owned Account (c.EOA) of the collaborator and the information about the collaborator (c.Infos) and adds the collaborator to smart contract (i.e., to collaboratorsAdr array (see variable 6 in the Initialization part)) as well as the timestamp of when the collaborator was added. This happens if the contract is activated and the colloborator' identity is authenticated. Algorithm 5 illustrates the logic of this function. removeCollaborator(c.EOA): This function can only be invoked by the owner of the smart contract to remove collaborators; it takes as input the Externally Owned Account (c.EOA) of the collaborator and removes the collaborator from the smart contract. Algorithm 6 illustrates the logic of this function. addRecord(r.IP): This function can only be invoked by either the owner of the smart contract or the collaborator that has already been added in the smart contract to report suspicious ip_address. It takes as input the suspicious ip_address and adds the record to the smart contract (i.e., to recordsAdr array (see variable 7 in the Initialization part)). Algorithm 7 illustrates the logic of this function. removeRecord(r.IP): This function can only be invoked by either the owner of the smart contract or the collaborator to remove records; it takes as input an IP address and removes the corresponding record, if it exists, from the smart contract. Algorithm 8 illustrates the logic of this function. ChangeStatus(bool status): This function can only be invoked by the owner of the smart generate DDoS flooding attack traffic from zombie hosts towards the victim as well as the simulated legitimate traffic. We use Hping3 [START_REF]Hping3[END_REF] command line to Simulate DDoS attacks (i.e., UDP/ICMP DDoS attacks).

Deployment of the Collaboration Contract

Once the smart contract is deployed, it can be self-executed without any human intervention. The deployment process is elaborated using truffle framework [START_REF] Truffle | [END_REF], a decentralized application development framework. First, we code the collaboration contract using the high-level language programming solidity. Then, we compile the contract into EVM byte code; once the contract gets compiled, it generates the EVM byte code and Application Binary Interface (ABI). Afterwards, we deploy the smart contract to the blockchain. Initially, we have deployed the smart contract on a private blockchain using Ganache [START_REF] Ganache | [END_REF], an Ethereum simulator used for testing the smart contract in a fast way. Then, we have deployed the smart contract on Ethereum official test network Ropsten. Fig 3.7 shows the contract lifecycle. Once deployed, the contract can be invoked using ABI definition and the address of the contract. If needed, the contract can be deleted (cannot be invoked anymore). We tested the implementation of Cochain-SC using both private (Ganache simulator) and public blockchain (Ethereum official test network Ropsten). Table 3.1 shows Cochain-SC creation transaction in Ropsten official test network. The details of a given transaction can be found using Ropsten Etherscan [START_REF]Ropsten[END_REF].

Cochain-SC: Experimental Results and Characteristics

Experimental Results

To test I-ES, we simulate the attack within an interval of 250 seconds. We launch the attack during the interval [START_REF] Khan | Federated learning for edge networks: Resource optimization and incentive mechanism[END_REF]200]; Fig. 3.8(a) shows that the normalized entropy decreases rapidly at the start of the interval. The time taken by Cochain-SC operations is smaller than 13 seconds (see Fig. 3.8(b)).

Performance Evaluation

To measure the performance of I-BS, we define the detection rate (DR) and false positive rate (FPR) as follows: and TN (True Negatives) represent the legitimate flows that are classified as legitimate. The performance of I-BS is evaluated using ROC curve. Moreover, we conducted two experiments (i.e., 100Mbps and 500Mbps) and we compared I-BS in terms of accuracy and FPR with ChainSecure [START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using SDN[END_REF] and one of the most prominent related schemes [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF]. Fig. 3.9(a) shows that Cochain-Sc achieves around 100% detection rate for 100 Mbps while it has just 26 % of FPR, while [START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using SDN[END_REF] and [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF] achieve the same detection rate but with respectively 31% and 40% of FPR. Fig. 3.9(b) shows that Cochain-Sc achieves around 100% detection rate for 500 Mbps while it has just 23% of FPR, while [START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using SDN[END_REF] and [START_REF] Giotis | Combining openflow and sflow for an effective and scalable anomaly detection and mitigation mechanism on sdn environments[END_REF] achieves the same detection rate but with respectively 30% and 34% of FPR.

DR = T P T P + F N , F P R = F P T N + F P

Characteristics

The main objective of Cochain-SC is to provide a secure, easy-to-deploy, low-cost, efficient and flexible DDoS attacks mitigation scheme based on Ethereum using smart contract. In this section, we answer the question: how does Cochain-SC provide these features? Note that efficiency of cochain-SC has been shown in the experiments presented above.

Flexibility/Easy_to_deploy. Cochain-SC provides two levels of flexibility: (1)

Cochain-SC provides the organization with the flexibility to easily add/remove collaborators to/from the system using addCollaborator()/removeCollaborator() functions. Similarly, collaborators can easily add/remove records to/from the system using addRecord()/removeRecord() functions; (2) Cochain-SC provides the organization (contract owner) with the flexibility to easily join or leave the system. To join the system, the organization needs to deploy the Collaboration contract. To leave the system, the organization can easily deactivate the contract using ChangeStatus() function. All these updates can be verified by anyone in the network (i.e., Ethereum). . This is achieved by Cochain-SC using modifiers. For example, the modifier "OnlyOwner" allows only the owner of the contract to execute the addCollaborator(), removeCollaborator() and changeStatus() functions. If a malicious/compromised user tries to execute these functions in order to either add illegitimtae collaborators to report fake IP or remove legitimate collaboartors, the execution will fail and no action will be recorded on the blockchain. The same restriction rule applies for the "OnlyCollaborators" modifier for the execution of addRecord() and removeRecord() functions; only collaborators (and also the contract owner) can add/remove the records.

Tableau 3.2. Cochain-SC creation and functions costs

Function

3.8.3.3. Low Cost. In this section, we estimate the cost of the creation of the collaboration contract as well as the execution of each function used in Cochain-SC. When we conducted the experiment, the gasPrice was set to 1Gwei, where 1Gwei = 10 9 wei = 10 -9 ether, and 1 ether was equal to 133.42 USD. Table 3.2 shows the cost of the execution of different functions in Cochain-SC. We observe that the highest cost corresponds to the creation of Cochain-SC at 0.296 USD. However, it is performed only once to setup the collaboration system. All functions, provided by the smart contract, have low costs. Thus, Cochain-SC is cost effective compared to exiting related schemes.

3.8.3.4. Analysis. First, Cochain-SC preserves pseudonymity and does not allow traceability of identities of collaborators (e.g., IP address of the collaborator). It is important to preserve the pseudonymity of collaborators; otherwise, they may be a target of DDoS attacks. Moreover, Cochain-SC does not suffer from single point of failure problem since it runs on Ethereum. Furthermore, it is decentralized scheme; thus, there is no need to a centralized authority (or a third party) to maintain the collaboration system; the reliability and availability of the records, recorded on the blockchain, are guaranteed. [START_REF] Rodrigues | A blockchain-based architecture for collaborative ddos mitigation with smart contracts[END_REF] is the only scheme that uses blockchain to advertise blacklisted IP addresses. However, this scheme [START_REF] Rodrigues | A blockchain-based architecture for collaborative ddos mitigation with smart contracts[END_REF] requires a central entity to issue certificates of ownership of IP addresses. Moreover, this scheme [START_REF] Rodrigues | A blockchain-based architecture for collaborative ddos mitigation with smart contracts[END_REF] is concerned only with inter-domain DDoS mitigation and not with intra-domain DDoS mitigation. However, Cochain-SC combines two levels of mitigation, intra-domain and inter-domain DDoS mitigation.

Conclusion

In this chapter, we proposed a blockchain-based framework called Cochain-SC which combines two levels of mitigation, intra-domain and inter-domain DDoS mitigation. For intra-domain, we combined I-ES with I-BS in order to detect in real-time illegitimate flows, and I-DM to effectively mitigate illegitimate flows inside the domain. For inter-domain, we proposed a smart contract-based framework that makes use of Ethereum's smart contract technology to facilitate the collaboration among SDN-based domain peers. The collaboration contract has been tested/evaluated and deployed on Ethereum official test network Ropsten; the appendix shows Cochain-SC address in Ropsten. Note that other blockchains, such EOS [START_REF]Eosio: The most powerful infrastructure for decentralized applications[END_REF], can be used to implement our scheme. We decided to use Ethereum because it is the most popular blockchain, that supports the concept of smart contract, with most devout developers and is the second largest in terms of market value.

Appendices

The collaboration contract was deployed on the Ropsten Testnet of Ethereum with the following address:

Organization Owner of account address: 0xa70836a9a115f774cb848134d0f8b2473e27d181 Cochain-SC address:0xCd0Df692D251B0a82E63e7FaFdA2c72aa6B0A8f9 Using this address, the transactions can be seen at: https://ropsten.etherscan.io/ Chapitre 4

SDNBoost: An SDN-based Boosting Ensemble Learning Framework for Advanced

Network Attack Mitigation

Abstract

Advanced threats continue to grow at a rapid rate plaguing individuals and Internet Service Providers (ISPs) in a stealthy way. Intrusion detection systems (IDSs) have become vital to ensure network security. However, traditional IDSs based on patternmatching/signature-filtering techniques are facing obstacles, due to lack of efficiency, making it difficult to protect against zero-day attacks. To alleviate this issue, several Machine/Deep learning (ML/DL)-based IDSs have been proposed to enhance the detection performance of traditional IDSs. However, they suffer from high bias and/or high variance. Ensemble learning (EL) is considered as a recent development in ML that aims to combine multiple ML models in order to build more flexible (i.e., less bias) and less data-sensitive (i.e., less variance) ML models. In this paper, we propose a scalable, efficient, and lightweight adaptive boosting EL framework, called SDNBoost, to effectively detect and mitigate network security threats in the context of software defined networks (SDN). SDNBoost consists of three modules. The first module is a novel data collection and optimized feature selection module that aims to reduce computational complexity while effectively improving detection performance. This module consists of (a) A Network Data flow Collection scheme (NDC) to gather the features of network data flow in a scalable and efficient way using sFlow protocol; (b) An optimized feature selection scheme that investigates using both of linear (i.e., Pearson Correlation-based Feature Selection (PCFS)) and non-linear measures (i.e., Tree-based Information gain Feature Selection (TIGFS) and Gradient Boosting Feature Selection (GBFS)); the objective is to select the most informative features to reduce training and testing time complexity; and (c) A hyperparameter optimization scheme to enhance the overall EL model's performance. The second module is an ensemble adaptive voting module that uses three boosting EL techniques, namely Adaptive Boosting (AdaBoost), Gradient Tree Based Boosting (GTBM), and eXtreme Gradient Boosting (XGBoost) to effectively detect network security threats. The thirs module is an attack mitigation module (AMM) to effectively mitigate network security threats. We conduct extensive experiments to evaluate SDNBoost using different real-world network security threats; the experimental results, using two well-known public network security datasets, namely NSL-KDD and UNSW-NB15, show that SDNBoost outperforms state-of-the-art contributions by 12% higher accuracy and F1 score while significantly reducing computational complexity.

Keywords

Introduction

Due to the recent technological developments and rapid digital adoption, Internet has become an essential element to individuals and organizations to build online businesses such as banking, online education, and electronic commerce. This era of digitization is improving human's ability to work and perform activities (e.g., Transaction Banking (TB), healthcare assistance, and online education) at any time and from anywhere. The increased dependency on the Internet is accompanied by numerous risks related to security and privacy issues e.g., theft of sensitive data and service disruption of some critical industry segments (e.g., finance and healthcare). These major network security threats have been increasing in sophistication and strength and are predicted to cost huge financial losses of about $20 Billion (USD) by 2021 [START_REF] Morgan | Global ransomware damage costs predicted to reach $20 billion (usd) by 2021[END_REF], for both educational and business organizations. Moreover, the emergence of Internet of Things (IoT) botnets such as Mirai, as well as the rapid growth in the number of insecure IoT devices, with an estimation of 75 billion connected devices by the end of 2025 [START_REF] Horwitz | The future of IoT miniguide: The burgeoning iot market continues[END_REF], can provide attackers with more sophisticated tools (e.g., botnet as-a-service) to conduct large scale attacks. Therefore, cyber-security mechanisms need to be carefully designed to cope with the new emerging network security threats ranging from phishing attacks to ransomware attacks to data leakage. To this end, ISPs deploy different security mechanisms such as encryption techniques, user authentication, access control mechanisms in addition to stateful/stateless firewalls to protect networks and end-users. However, it has been shown that these techniques are not sufficient to protect against the new emerging security threats (i.e., zero-day attacks).

Thus, there is a need for highly effective intrusion detection systems (IDSs) to secure networks from all kind of unauthorized activities that may cause damage to data confidentiality, data integrity, or data availability. IDSs play a key role in ensuring security of the network and are considered as the first line of defense. IDSs aim to effectively and timely detect network security threats with less false positive rates. In general, IDSs can be divided into two categories: (1) Signature Filtering-based Intrusion Detection Systems (Misuse-Based detection systems, SFIDSs) that try to detect network intrusions by using predefined attack patterns/signatures of well-known attacks; and (2) Anomaly-based Intrusion Detection Systems (A-IDSs) that try to learn normal behaviors and consider any deviation from established normal behaviors as intrusions. SFIDSs are vulnerable to zero-day attacks (i.e., unforeseen/unusual attacks) due to the lack of new/up-to-date attack patterns, while A-IDSs suffer from high false positive rates. In addition, a significant effort is required to continuously improve and evolve such IDSs.

The recent emergence of ML/DL techniques have revolutionized many areas and have achieved promising performances in many fields such as speech recognition and computer vision. IDSs also adopted these techniques to timely and effectively detect network security threats. With this adoption, ML/DL-based IDSs can effectively detect existing and new network security threats without continuously evolving/updating the patterns/signatures of traditional IDSs. However, most of state-of-the-art ML/DL-based IDSs use a single learning technique, such as neural networks and support vector machines, to classify/recognize network security threats. Despite achieving high detection performance in training data, these techniques fail to generalize and perform poorly on new/unseen data (i.e., test data). Also, they suffer from a high bias and/or a high variance leading, in most cases, to over-fitting and/or under-fitting.

Recently, Ensemble learning (EL) has emerged as a new sub-field of ML that aims to improve the generalization ability of a single learner by combining multiple ML models, referred to as base learners. In general, EL can be divided into two categories. The first category concerns homogeneous EL that uses the same type of base learners; it includes (a) bagging: A parallel EL method in which base learners are used in parallel (e.g., Random Forest); and (b) boosting: A sequential EL method in which the base learners are used in sequence (e.g., Adaboost). The second category concerns heterogeneous EL that uses different types of base learners, called stacked generalization.

In 1979, Dasarathy and Sheela [START_REF] Dasarathy | A composite classifier system design: Concepts and methodology[END_REF] proposed one of the earliest contributions on EL systems; their proposed scheme enhances the detection performance of a single learner through the use of a composite of classifiers (i.e., Nearest neighbor (NN) and Linear Model). In 1990, Hansen and Salamon [START_REF] Hansen | Neural network ensembles[END_REF] proposed a cross-validation method that improves neural networks generalization performance through the use of ensembles of similar networks. Schapire [START_REF] Schapire | The strength of weak learnability[END_REF] reported that a strong classifier can be generated by combining multiple weak learners through the use of boosting techniques. In 1992, Wolpert [START_REF] Wolpert | Stacked generalization[END_REF] proposed one of the earliest architectures that uses stacking techniques to minimize the generalization error of single learners. In 1993, Drucker and Schapire [101] proposed a boosting algorithm that uses a Probably Approximately Correct (PAC) learning model to construct a strong learner. They used neural networks (NNs) as a base learner to construct an ensemble of NNs that significantly improves detection performance in optical character recognition (OCR) domain. In 1996, Breiman [START_REF] Breiman | Bagging predictors[END_REF] proposed bagging, referred to as bootstrap aggregation, that uses bootstrap sampling techniques with voting aggregations to reduce the variance of single learners. In bagging, first a subset of training data is randomly selected with replacement from the entire dataset. Then, this subset is used to train a particular classifier. Finally, different classifiers are combined using a majority voting decision.

Since then, research in EL systems has been expanded and they have been widely applied in different fields. Also, it has been shown that EL techniques outperform single based learners in handling more complicated tasks [START_REF] Ferreira | Multiobjective reinforcement learning for cognitive satellite communications using deep neural network ensembles[END_REF][START_REF] Hussain | Ensemble hierarchical extreme learning machine for speech dereverberation[END_REF][START_REF] Bian | Ensemble pruning based on objection maximization with a general distributed framework[END_REF][START_REF] Yang | Auto-ensemble: An adaptive learning rate scheduling based deep learning model ensembling[END_REF][START_REF] Zhu | Geometric structural ensemble learning for imbalanced problems[END_REF]. The use of multiple learning models will certainly reduce the risk of a poor generalization that a single learner can have. Also, in some applications, the amount of generated data is too large to be handled by a single learner, and the use of only a single model in such applications can lead to over-fitting. Moreover, it has been shown that EL techniques are effective in the opposite problem i.e., having little data [START_REF] Polikar | Ensemble based systems in decision making[END_REF]. Re-sampling techniques can be used to select a random overlapping subset of the dataset, and use each subset to train a particular model. Then, one has to combine the results of each model, using a voting scheme, to produce a strong learner. Thus, EL becomes an ideal choice to build robust ML models that can effectively reduce variance and bias while improving detection/prediction performance. EL has the potential to greatly improve the efficiency of ML/DL-based IDSs to cope with the new emerging network security threats.

Boosting is considered as one of the most significant development of EL. Boosting techniques aim to transform weak learners, learners that slightly perform better than a random guessing, into a strong learner. In boosting, a sequence of weak learners are trained using a weighted version of the dataset in such a way that a high weight is given to previously misclassified samples. Thus, the model can give more attention to these misclassified data samples in the next round of training. Once the training is done, the output of each learner is combined through a weighted majority voting to construct a final strong learner. It has been shown that boosting techniques are robust against under-fitting issues, when only too little data is available and over-fitting issues, when too large data is available [START_REF] Polikar | Ensemble based systems in decision making[END_REF].

Software defined networks (SDN) is a novel paradigm that leverages network programmability to solve the limitations of conventional networks. SDN provides new capabilities, through a logically centralized component, to cope with the new emerging security threats ranging from DDoS attacks to poisoning attacks to data leakage.

In this context, we propose SDNBoost, a novel multi-module optimized EL framework that combines optimized feature selection schemes with advanced EL techniques (i.e., Boosting) to reduce computational complexity while effectively improving detection performance. In particular, SDNBoost consists of a robust adaptive voting module that combines three boosting EL techniques, namely Adaptive Boosting (AdaBoost), Gradient Tree Based Boosting (GTBM), and eXtreme Gradient Boosting (XGBoost), to effectively detect network security threats in SDN. Irrelevant network data flow features can cause long-term problems (e.g., slow down the process of ML model training and prevent ML models from making accurate classification). Thus, we integrate a scalable, lightweight and optimized feature selection module to reduce computational complexity (i.e., training and testing time complexity) and increase the overall detection performance (e.g., accuracy and F1 score). This module consists of (a) A Network Data flow Collection scheme (NDC) to gather the features of network data flow in a scalable and efficient way using sFlow protocol; (b) An optimized feature selection scheme that investigates using both of linear measures (i.e., Pearson Correlation-based Feature Selection (PCFS)) and non-linear (i.e., Tree-based Information gain Feature Selection (TIGFS) and Gradient Boosting Feature Selection (GBFS)); the objective is to select the most informative/relevant features from the collected network data flow to reduce training and testing time complexity; and (c) A hyperparameter optimization scheme to enhance the overall model's performance. Finally, we design an attack mitigation module (AMM) to effectively mitigate network security threats. To evaluate the effectiveness of SDNBoost, we conduct extensive experiments using a variety of real-world network security threats including DDoS attacks. The experimental results, using two well-known public network security datasets, namely NSL-KDD [START_REF]NSL-KDD dataset[END_REF] and UNSW-NB15 [START_REF] Moustafa | Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set)[END_REF][START_REF] Moustafa | Unsw-nb15[END_REF], show that SDNBoost achieves efficiency and high accuracy in detecting and mitigating the new emerging security threats. SDNBoost outperforms recent state-of-the-art contributions by 12% higher accuracy and F1 score while significantly reducing computational complexity, making it a promising framework to mitigate the new emerging network security threats in SDN.

The main contributions of this paper can be summarized as follows:

• We propose a novel multi-module optimized EL framework that combines optimized feature selection with advanced EL techniques using SDN. • We propose a novel network data flow collection scheme (NDC) to gather the features of network data flow in a scalable and efficient way using the sFlow protocol.

• We propose an optimized feature selection scheme that investigates using both of linear and non-linear measures to select the most informative/relevant features from the collected network data flow.

Related Work

The new emerging security threats continue to evolve and are becoming more devastating. Several state-of-the-art contributions have integrated ML/DL techniques to improve the efficiency of traditional IDSs. In the following, we overview the most representative ML/DL based IDSs and their security issues. Traditional IDSs use pattern-matching/attacksignatures filtering techniques to distinguish between normal and abnormal data samples. Traditional IDSs are limited by their need of new/up-to-date attack patterns, which make them vulnerable to zero-day attacks. The recent emergence of ML/DL techniques have revolutionized the security field; since then, several IDSs have adopted ML/DL to detect network intrusions. Lin et al. [111] proposed a new character-level intrusion detection system that uses convolutional neural networks (CharCNN-IDS) to detect network anomalies. CharCNN-IDS consists of (1) A data processing scheme that processes network data flow at the characterlevel using word embedding techniques; and (2) An optimized convolutional neural networks model that uses the output of the data processing scheme to classify network data flow samples as either normal or abnormal. They evaluated the effectiveness of CharCNN-IDS in binary and multi-class classification using the NSL-KDD dataset. Tang et al. [START_REF] Tang | Deep learning approach for network intrusion detection in software defined networking[END_REF] proposed a Deep Neural Network (DNN) model for anomaly detection in the context of SDN. They used a data preprocessing module to extract the most relevant features from the collected network data flow. They evaluated the effectiveness of their proposed model using the NSL-KDD dataset. Yin et al. [START_REF] Yin | A deep learning approach for intrusion detection using recurrent neural networks[END_REF] proposed the design and the implementation of a novel intrusion detection system that uses recurrent neural networks (RNN-IDS) to detect network anomalies. The authors have studied the performance of RNN-IDS in binary and multiclass classification using the NSL-KDD dataset. The experimental results did show that RNN-IDS outperforms shallow ML methods in terms of accuracy in both binary and multiclass classification. Wu et al. [START_REF] Wu | A novel intrusion detection model for a massive network using convolutional neural networks[END_REF] proposed a novel intrusion detection model that uses convolutional neural networks (CNNs). The authors used CNNs to automatically select network traffic features from the input data; to solve the issue of imbalanced classes in the used dataset, they set a coefficient (i.e., cost function weight) to each data sample based on its number. The proposed model reduces false positive rates as well as the calculation cost while improving the accuracy. Ambusaidi et al. [START_REF] Ambusaidi | Building an intrusion detection system using a filterbased feature selection algorithm[END_REF] proposed a novel intrusion detection model called Least Square Support Vector Machine based IDS (LSSVM-IDS). LSSVM-IDS has two stages. First it uses a Mutual Information (MI) scheme to study the linear and nonlinear dependence between data input features and data output classes. Then, it gives the most relevant features to the Least Squares SVM (LS-SVM) model for training and decision making (i.e., classification). They evaluated the effectiveness of LSSVM-IDS using three well-known public network security datasets, KDD'99, NSL-KDD, Kyoto 2006+. Ashfaq et al. [START_REF] Ashfaq | Fuzziness based semi-supervised learning approach for intrusion detection system[END_REF] proposed a novel fuzziness based Semi Supervised Learning (SSL) scheme that uses a single hidden layer feed-forward neural network (SLFN) along with a sample categorization scheme to detect network anomalies. Singh et al. [117] proposed a scalable peer-to-peer attack detection scheme that uses Random Forest to detect network anomalies. The proposed scheme consists of (1) A distributed framework for dynamic data network extraction; and (2) A classification module that uses RF model to detect, in real-time, network intrusions. The authors evaluated the performance of their proposed scheme using the CAIDA dataset.

To increase the detection performance of single ML/DL models, several contributions have combined supervised and unsupervised techniques to build an efficient intrusion detection model. Al-Qatf et al. [118] proposed an efficient DL framework, called self-taught learning (STL-IDS), that uses a sparse autoencoder (SAE) along with a support vector machines (SVM) method; the objective is to (1) Encode network data flow; and (2) Detect and mitigate network anomalies. STL-IDS uses a feature selection method and a dimensionality reduction scheme to reduce the training time complexity while improving the prediction accuracy using the SVM model. Ludwig [START_REF] Ludwig | Intrusion detection of multiple attack classes using a deep neural net ensemble[END_REF] designed a neural network (NN) ensemble model that uses deep belief neural network (DBN), DNN, and extreme learning machine models to detect the different attacks using the NSL-KDD dataset. He evaluated/tested the effectiveness of the network ensemble model, using the NSL-KDD dataset, in terms of detection rate, false alarm rate, and Area Under Curve (AUC). Shone et al. [START_REF] Shone | A deep learning approach to network intrusion detection[END_REF] proposed a novel deep neural networks model that combines a layer-wise unsupervised scheme with Random Forest (RF) classifier to detect anomalies in the network. The layer-wise unsupervised scheme consists of a stacked non-symmetric deep neural networks autoencoder (NDAEs) that allows to learn/extract more complex relationships between data input features. They implemented the proposed scheme on the top of Tensorflow framework and evaluated using the KDD'99 and the NSL-KDD datasets. Wang et al. [START_REF] Wang | Hast-ids: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[END_REF] proposed a novel hierarchical spatial-temporal feature-based intrusion detection system called HAST-IDS. HAST-IDS consists of (1) A deep CNN model to learn the low-level spatial features of network traffic; and (2) An LSTM (short-term memory networks) to learn high-level temporal features. They evaluated the effectiveness of HAST-IDS using two well-known public network security datasets (i.e., DARPA and ISCX2012). Gao et al. [START_REF] Gao | An adaptive ensemble machine learning model for intrusion detection[END_REF] proposed an adaptive ensemble learning method that combines common ML models (i.e., Decision Trees (DT), SVM, logical regression (LR), k-nearest neighbors (KNN), Adaboost, RF, and deep neural networks) to increase the detection rate of traditional ML models. Also, they have integrated an ensemble adaptive voting scheme. They tested and evaluated the effectiveness of the proposed framework using the NSL-KDD dataset. Ahmad et al. [START_REF] Ahmad | Performance comparison of support vector machine, random forest, and extreme learning machine for intrusion detection[END_REF] proposed an intrusion detection model that uses multiple ML techniques, namely, RF, SVM, and extreme learning machine (ELM). The authors evaluated the performance of each of these techniques using the NSL-KDD dataset. McDermott et al. [START_REF] Mcdermott | Investigation of computational intelligence techniques for intrusion detection in wireless sensor networks[END_REF] proposed a novel intrusion detection model that uses a feed-forward back propagation neural network and a support vector machine to detect anomalies in Wireless Sensor Networks (WSNs). The authors have compared the detection performance of the two techniques using the NSL-KDD dataset. Moustafa et al. [125] proposed a novel architecture that uses an Outlier Gaussian Mixture (OGM) scheme to detect web attacks. The proposed architecture consists of (1) A data pre-processing module that uses an Association Rule Mining (ARM) scheme to dynamically extract informative features; and (2) A classification module that uses an OGM scheme to detect network anomalies. The authors evaluated the effectiveness of OGM using two well-known public network security datasets (i.e., Web Attack and UNSW-NB15). Moustafa et al. [START_REF] Moustafa | A new threat intelligence scheme for safeguarding industry 4.0 systems[END_REF] proposed a new threat intelligence scheme that uses beta mixture-hidden Markov models (MHMMs) to detect network anomalies in the context of Industry 4.0. The proposed scheme consists of (1) A novel smart management module to handle/manage heterogeneous network data flow includes data from actuators and IoT sensors; and (2) A novel threat intelligence module that uses MHMMs to detect network anomalies. The authors evaluated the effectiveness of MHMMs using two well-known public network security datasets, CPS dataset of sensors and UNSW-NB15.

To allow for an efficient and easy to deploy ML/DL based IDSs, several contributions have used SDN. Ravi et al. [START_REF] Ravi | Balance: Link flooding attack detection and mitigation via hybrid-sdn[END_REF] proposed a novel mechanism to detect and mitigate Link Flooding Attacks (LFA) in SDN, called BALANCE. BALANCE consists of (1) A Service Based Hybrid SDN (SBHS) to collect network data flow features using OpenFlow (OF) protocol; (2) A detection scheme that is implemented in the SDN controller to detect LFA; and (3) an LFA bot mitigation scheme that is implemented in the SDN controller to mitigate LFA. The authors evaluated the effectiveness of BALANCE using the Mininet emulator. Ali et al. [START_REF] Ali | Novel three-tier intrusion detection and prevention system in software defined network[END_REF] proposed a three-tier intrusion detection and prevention system (IDPS) to detect Distributed Denial of Service (DDoS) attacks in SDN. The proposed IDPS includes packet validation, user validation, and flow validation. The authors evaluated the effectiveness of IDPS, using the OMNeT++ emulator, in terms of detection/failure rate, throughput, and delay. Chen et al. [START_REF] Chen | Xgboost classifier for ddos attack detection and analysis in sdn-based cloud[END_REF] proposed a new detection model that uses extreme gradient boosting (XGBoost) to detect network anomalies in SDN. The proposed model uses OF protocol to collect network data flow features. Then, the SDN controller (i.e., POX controller) uses these network data flow features to detect anomalies using XGBoost classifier. The authors evaluated the effectiveness of their proposed model using the KDD'99 dataset. To handle large size and high dimensional network data flow features, He et al. [START_REF] He | Software-defined-networking-enabled traffic anomaly detection and mitigation[END_REF] proposed two clustering-based schemes to detect network anomalies in SDN. The first scheme uses an unsupervised cluster technique to extract network data flow features. The second scheme uses a density-based clustering method to detect network anomalies using a reduced dimension dataset. The authors evaluated the performance of their proposed scheme using the KDD'99 dataset.

Based on our analysis of these existing contributions, we found that a number of these solutions [START_REF] Ravi | Balance: Link flooding attack detection and mitigation via hybrid-sdn[END_REF][START_REF] Ali | Novel three-tier intrusion detection and prevention system in software defined network[END_REF][START_REF] Chen | Xgboost classifier for ddos attack detection and analysis in sdn-based cloud[END_REF][START_REF] He | Software-defined-networking-enabled traffic anomaly detection and mitigation[END_REF] are computationally expensive. Also, most of them [111][START_REF] Tang | Deep learning approach for network intrusion detection in software defined networking[END_REF][START_REF] Yin | A deep learning approach for intrusion detection using recurrent neural networks[END_REF][START_REF] Wu | A novel intrusion detection model for a massive network using convolutional neural networks[END_REF][START_REF] Ambusaidi | Building an intrusion detection system using a filterbased feature selection algorithm[END_REF][START_REF] Ashfaq | Fuzziness based semi-supervised learning approach for intrusion detection system[END_REF][117][118][START_REF] Ludwig | Intrusion detection of multiple attack classes using a deep neural net ensemble[END_REF][START_REF] Shone | A deep learning approach to network intrusion detection[END_REF][START_REF] Wang | Hast-ids: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[END_REF][START_REF] Gao | An adaptive ensemble machine learning model for intrusion detection[END_REF][START_REF] Ahmad | Performance comparison of support vector machine, random forest, and extreme learning machine for intrusion detection[END_REF][START_REF] Mcdermott | Investigation of computational intelligence techniques for intrusion detection in wireless sensor networks[END_REF][125][START_REF] Moustafa | A new threat intelligence scheme for safeguarding industry 4.0 systems[END_REF][START_REF] Ravi | Balance: Link flooding attack detection and mitigation via hybrid-sdn[END_REF][START_REF] Ali | Novel three-tier intrusion detection and prevention system in software defined network[END_REF][START_REF] Chen | Xgboost classifier for ddos attack detection and analysis in sdn-based cloud[END_REF][START_REF] He | Software-defined-networking-enabled traffic anomaly detection and mitigation[END_REF] suffer from high bias and/or high variance; this usually results in inefficient intrusion detection models when encountering new attacks (i.e., zero-day attacks). To address the shortcomings of these existing solutions [111][START_REF] Tang | Deep learning approach for network intrusion detection in software defined networking[END_REF][START_REF] Yin | A deep learning approach for intrusion detection using recurrent neural networks[END_REF][START_REF] Wu | A novel intrusion detection model for a massive network using convolutional neural networks[END_REF][START_REF] Ambusaidi | Building an intrusion detection system using a filterbased feature selection algorithm[END_REF][START_REF] Ashfaq | Fuzziness based semi-supervised learning approach for intrusion detection system[END_REF][117][118][START_REF] Ludwig | Intrusion detection of multiple attack classes using a deep neural net ensemble[END_REF][START_REF] Shone | A deep learning approach to network intrusion detection[END_REF][START_REF] Wang | Hast-ids: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[END_REF][START_REF] Gao | An adaptive ensemble machine learning model for intrusion detection[END_REF][START_REF] Ahmad | Performance comparison of support vector machine, random forest, and extreme learning machine for intrusion detection[END_REF][START_REF] Mcdermott | Investigation of computational intelligence techniques for intrusion detection in wireless sensor networks[END_REF][125][START_REF] Moustafa | A new threat intelligence scheme for safeguarding industry 4.0 systems[END_REF][START_REF] Ravi | Balance: Link flooding attack detection and mitigation via hybrid-sdn[END_REF][START_REF] Ali | Novel three-tier intrusion detection and prevention system in software defined network[END_REF][START_REF] Chen | Xgboost classifier for ddos attack detection and analysis in sdn-based cloud[END_REF][START_REF] He | Software-defined-networking-enabled traffic anomaly detection and mitigation[END_REF], we propose a novel multi-module optimized EL framework that uses multiple boosting techniques to build more flexible (i.e., less bias) and less data-sensitive (i.e., less variance) ML/DL based IDSs. Moreover, we introduce a novel data collection and optimized feature selection module to gather network data flow feature in a scalable and efficient way and to reduce computational complexity while effectively improving detection performance. SDNBoost is much scalable and accurate in comparison with the ones that use OF schemes [START_REF] Ravi | Balance: Link flooding attack detection and mitigation via hybrid-sdn[END_REF][START_REF] Ali | Novel three-tier intrusion detection and prevention system in software defined network[END_REF][START_REF] Chen | Xgboost classifier for ddos attack detection and analysis in sdn-based cloud[END_REF][START_REF] He | Software-defined-networking-enabled traffic anomaly detection and mitigation[END_REF], and outperforms recent state-of-the-art contributions by 12% higher accuracy and F1 score while significantly reducing computational complexity.

. Design Overview

This section presents an overview of SDNBoost. More specifically, we explain how SDN-Boost ensures the detection and mitigation of the new emerging security threats, allowing for an accurate detection and an effective attack mitigation. When designing SDNBoost, we did consider the following goals/objectives. First, SDNBoost should ensure/guarantee a full protection from the new emerging security threats. Unlike existing ML/DL based IDSs [111][START_REF] Tang | Deep learning approach for network intrusion detection in software defined networking[END_REF][START_REF] Yin | A deep learning approach for intrusion detection using recurrent neural networks[END_REF][START_REF] Wu | A novel intrusion detection model for a massive network using convolutional neural networks[END_REF][START_REF] Ambusaidi | Building an intrusion detection system using a filterbased feature selection algorithm[END_REF][START_REF] Ashfaq | Fuzziness based semi-supervised learning approach for intrusion detection system[END_REF][117][118][START_REF] Ludwig | Intrusion detection of multiple attack classes using a deep neural net ensemble[END_REF][START_REF] Shone | A deep learning approach to network intrusion detection[END_REF][START_REF] Wang | Hast-ids: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[END_REF][START_REF] Gao | An adaptive ensemble machine learning model for intrusion detection[END_REF][START_REF] Ahmad | Performance comparison of support vector machine, random forest, and extreme learning machine for intrusion detection[END_REF][START_REF] Mcdermott | Investigation of computational intelligence techniques for intrusion detection in wireless sensor networks[END_REF][125][START_REF] Moustafa | A new threat intelligence scheme for safeguarding industry 4.0 systems[END_REF][START_REF] Ravi | Balance: Link flooding attack detection and mitigation via hybrid-sdn[END_REF][START_REF] Ali | Novel three-tier intrusion detection and prevention system in software defined network[END_REF][START_REF] Chen | Xgboost classifier for ddos attack detection and analysis in sdn-based cloud[END_REF][START_REF] He | Software-defined-networking-enabled traffic anomaly detection and mitigation[END_REF], that use a single learner to handle intrusion detection, SDNBoost uses EL techniques to to build more flexible and less data-sensitive ML/DL based IDSs. Also, SDN-Boost integrates a scalable, lightweight and optimized feature selection module to reduce computational complexity while improving the overall detection performance. Second, these anomalies/threats should be effectively and timely mitigated, using AMM, and the overall system has to be as secure/scalable as possible.

Fig. 4.1 shows our proposed multi-module optimized EL framework that combines optimized feature selection schemes with advanced EL techniques; it includes three modules. The first module is a novel data collection and optimized feature selection module that aims to reduce computational complexity and increase the overall detection performance. This module consists of (a) NDC to gather the features of network data flow in a scalable and efficient way using sFlow protocol; (b) An optimized feature selection scheme that uses PCFS, TIGFS, and GBFS measures, to select the most informative/relevant features; and (c) A hyperparameter optimization scheme to enhance the overall model performance. The second module is an ensemble adaptive voting module that uses AdaBoost, GTBM, and XGBoost to effectively detect network security threats. The third module is an attack mitigation module (AMM) that effectively mitigates network security threats.

System Architecture

In this section we introduce the SDNBoost architecture. More specifically, we explain how SDNBoost operates. Fig. 4.2 shows the system architecture of SDNBoost. SDNBoost consists of three planes. The first plane is the data plane that consists of multiple forwarding elements referred to as OpenFlow (OF) devices; each OF device uses the control rules, issued by the control plane (i.e., SDN controller) via southbound Application Programming Interfaces (API) such as OpenFlow protocol or Netconf [START_REF] Bjorklund | Network Configuration Protocol (NETCONF)[END_REF], to ensure the forwarding, monitoring, and processing of network data packets according to these control rules. The second plane is the control plane that consists of multiple control elements referred to as SDN controllers; each SDN controller manages a geographical distributed data plane through a southbound API and deploys the policies generated by the application plane, through a Northbound API such as Rest API [START_REF]Rest API[END_REF], into the data plane. The control plane provides an abstractions of lower-level data plane resources utilization (e.g., cpu usage, throughput, and latency) to the application plane. The third plane is the application plane that consists of multiple REST applications that generate security policies; it includes: (a) A scalable and efficient network data collection scheme to monitor, using sFlow protocol, the features of network data to obtain the global view of the network; (b) An optimized feature selection scheme that uses PCFS, TIGFS, and GBFS measures, to select the most informative/relevant features; (c) An ensemble adaptive voting module that uses AdaBoost, GTBM, and XGBoost to effectively detect network security threats; and (d) A security action and policy scheme (i.e., AMM) that effectively and timely mitigates network security threats. The Northbound API (i.e., REST API) is used in the detection/mitigation process to offer the inter-operability to use/manage any type of SDN controller (e.g., Ryu OpenFlow controller [3], Floodlight OpenFlow controller [START_REF]Floodlight[END_REF]).

In the following, first we introduce our data collection and optimized feature selection module. Then, we present our ensemble adaptive voting module. Finally, we present our attack mitigation module (AMM).

Data Collection and Optimized Feature Selection Module

Data Collection and Optimized Feature Selection module aims to reduce computational complexity while effectively improving detection performance; it consists of: (1) NDC to gather the features of network data flow in a scalable and efficient way using sFlow protocol;

(2) an optimized feature selection scheme that uses PCFS, TIGFS and GBFS to select the most informative/relevant features from the collected network data flow; and (3) an hyperparameter optimization scheme to enhance the overall model's performance.

Network data flow collection scheme (NDC)

Data collection is the first step of network security threats detection. In SDN, two commonly techniques are used to collect the features of network data flow (e.g., count number of bytes per flow and count number of packet per ingress port). The first technique uses OpenFlow protocol while the second one uses flow sampling techniques such as Sflow protocol. In OpenFlow based technique, the control plane (i.e., SDN controllers) periodically sends state requests (i.e., of p_f low_stats_request) to data plane elements (i.e., OF devices). Each OF device responds with one or multiple flow statistics reply messages (i.e., of p_f low_stats_reply) that contain network flow statistics. To this end, each OF device needs to maintain/store a large number of network data flow entries. However, this will exhaust the resources of OF devices (i.e., Ternary Content Addressable Memory (TCAM) of OF devices). Also, a large number of flow statistics reply messages sent by OF devices to SDN controllers may congest the bandwidth between OF devices and SDN controllers and exhaust the OF channel by the attack traffic. Furthermore, SDN controllers can not receive the flow statistics reply messages timely, making this technique (i.e., OF-based technique) not suitable to detect effectively high-rate attacks. To alleviate the issues of OF-based technique, NDC makes use of flow sampling techniques to gather the features of network data flow in a scalable and efficient way using sFlow protocol. NDC is more scalable and neither consumes excessive bandwidth between OF devices and SDN controllers nor exhaust the OF channel by the attack traffic. NDC defines the flow monitoring metrics, such as flow aggregation attributes and thresholds, and uses an sFlow collector (i.e., sFlow-RT [START_REF]sflow-rt[END_REF]) to deploy these metrics in network data plane elements. In NDC, the sFlow collector periodically, at each interval ∆T , sends state requests to sFlow agents embedded in OF devices. Each sFlow agent responds with a set of sFlow Datagrams (e.g., flow/counter samples) that are analyzed by our ensemble adaptive voting module to produce real-time and accurate decisions. NDC allows for high-speed traffic monitoring and is capable of monitoring networks at 100 Gbps and beyond, without impacting the performance of OF devices and without increasing the network load [132]. Once the network data flow is collected, we encode categorical features into a numeric values using a label encoder and one hot encoding technique. Then, we re-scale the values of the features values according to Eq. (4.5.1) using a standardization technique.

X stand = X i -µ σ (4.5.1)
where X i denotes the input feature, µ and σ denote, respectively, the mean and standard deviation values for each input feature value.

Optimized Feature Selection Scheme

Redundant/irrelevant network data flow features can slow down the process of training and prevent an EL model from making accurate decisions, especially when dealing with large-scale and high-dimensional data systems. SDNBoost investigates using both of linear and non-linear feature selection techniques, namely PCFS, TIGFS, and GBFS. SDNBoost selects the most informative features and explores their effect on EL model performance and training/testing time complexity.

Pearson Correlation-based Feature Selection (PCFS)

. PCFS measures the statistical relationship/association, referred to as linear correlation, between input features and the target class. PCFS uses a linear correlation coefficient to rank input features and selects the highest ones (i.e., the highest correlated features with the target class). For an input feature F with a value f and a target class Y with a value y, the PCFS measure is defined as follows:

P CF S(F,Y ) = Cov(F,Y ) ρ F ρ Y (4.5.2)
where cov is the covariance, ρ F is the standard deviation of F , and ρ Y is the standard deviation of Y . Thus, PCFS can be expressed as follows:

P CF S(F,Y ) = n j=1 (f j -f )(y j -ȳ) n j=1 (f j -f ) 2 n j=1 (y j -ȳ) 2 (4.5.3)
where n is the number of input features, f is the mean of f , and ȳ is the mean of y. A correlation coefficient close to 1, for a particular input feature f j with a target y j , indicates that f j is highly correlated with y j . A correlation coefficient close to 0, for a particular input feature f j with a target class y j , indicates that f j is highly uncorrelated with y j .

4.5.2.2. Tree-based Information gain Feature Selection (TIGFS). TIGFS uses entropy and mutual information concepts to select the most informative/relevant input features. TIGFS ranks input features based on entropy calculation. In particular, for an input feature F and a target class Y , TIGFS ranks F based on the amount of knowledge/information that can be gained about Y . In fact, if F and Y are independent, their TIGFS score (i.e., TIGFS(F ;Y )) is almost zero. Thus, F does not contain any knowledge/information about Y and it consists of an irrelevant feature that may prevent an EL model from making accurate decisions. The TIGFS measure is defined as follows:

T IGF S(F ; Y ) = H(F ) -H(F/Y ) (4.5.4)
where H(F ) is the entropy of an input feature F , H(F |Y ) is the conditional entropy of an input feature F given a target class Y . Thus, TIGFS can also be expressed as follows:

T IGF S(F ; Y ) = F Y p F,Y (F,Y )log p F,Y (F,Y ) p F (F )p Y (Y )
df dy (4.5.5)

where p F,Y (F,Y ) is the joint probability density function of input feature F and a target class Y , and p F (F ) (resp. p Y (Y )) are marginal density functions of F and (resp. Y ), respectively. 4.5.2.3. Gradient Boosting Feature Selection (GBFS). GBFS uses a feature importance metric to select the most informative/relevant input features. In GBFS, a forest of trees is constructed using multiple boosted decision trees; each boosted tree trains on a sub-set of data. To construct an optimal boosted tree, a random sub-set of features is selected. Then, we construct multiple splits using different features. In particular, GBFS uses Gini impurity function to select the best features that maximize the information/knowledge for a particular split in the boosting tree. GBFS ranks input features based on an importance score that indicates how valuable an input feature in making key decisions. The more an input feature is valuable in the construction of the optimal boosted trees, the higher its importance score. For a particular decision tree T , a measure of relevance for the k th input feature f k is defined as follows [START_REF] Friedman | Greedy function approximation: A gradient boostingmachine[END_REF]:

GBF S k (T ) = N -1 t=1 i 2 t I(f t = k) (4.5.6)
where N is the number of internal nodes of the boosted tree, i 2 is an estimated improvement in a loss error function (i.e., squared error risk), and f t is the splitting input feature that is associated with an internal node t. Then, the feature importance is averaged across all the boosting decision trees as follows:

GBF S k = 1 M M i=1 GBF S k (T i ) (4.5.7)
where M is the number of trees.

Hyperparameter Optimization Scheme

Hyperparameter Optimization, called also hyperparameter tuning, is an approach that searches for a set of well-performing/optimal hyperparameters that can be used to achieve the best detection performance for a ML model. To enhance the overall model's performance, we use random search (RS), as hyperparameter optimization scheme. RS uses a bounded space of hyperparameter values and select randomly combinations of these hyperparameters from that space. RS consists of finding hypparameters that minimize a cost function. We define RS optimization as follows:

min hyper∈R n f (hyper) (4.5.8)
where f is the cost function to be minimized and hyper ∈R n is a set of hyperparameters (i.e., candidate solutions) drawn from a space. It has been proven that RS is more efficient for hyper-parameter optimization than other approaches (e.g., Grid Search (GS), Manual Search (MS)) [START_REF] Bergstra | Random search for hyper-parameter optimization[END_REF]. Also, RS allows for a parallel optimization and reduces computational complexity.

Ensemble Adaptive Voting Module

This module aims to effectively detect network security threats in SDN; it consists of a robust adaptive boosting EL framework, that combines three boosting EL techniques, namely, Adaptive Boosting (AdaBoost), Gradient Tree Based Boosting (GTBM), and eXtreme Gradient Boosting (XGBoost).

Adaptive Boosting (AdaBoost)

AdaBoost stands for adapative boosting; it is a boosting EL technique that uses decision trees for classification. In AdaBoost, we fit a sequence of weak learners, called stumps (i.e., single layer decision trees), to a weighted version of the dataset in such a way that a high weight is given to previously misclassified data samples. Thus, the model can give more attention to these misclassified data samples in the next round of training. Once the training is done, the output of each learner is combined through a weighted majority voting to construct a final classification model.

AdaBoost begins with assigning, to each data sample in the training dataset, an equal weight as follows:

W (0) i = 1 N (4.6.1)
where N is the number of data samples (i.e.,{(x i ,y i )} N i=1 ). Afterwards, we train a first stump H 1 (x) using the weighted version of the dataset and we compute the total error at iteration t as follows:

E t = N i=1 W (t) i I[H t (x i ) = y i ] N i=1 W (t) i (4.6.2)
where E t denotes the normalized sum of the weights of misclassified data samples at iteration t. Then, we compute the amount/importance of say that this stump has in the final classification as follows:

α t = log( 1 -E t E t ) (4.6.3)
where α t denotes the amount/importance of say (i.e., weight) of a stump at iteration t.

The lower the total error (i.e., perfect stump), the higher the amount/importance of say the stump will have in the final classification. The higher the total error, the lower the amount/importance of say the stump will have in the final classification. Then, we update the weights of misclassified data samples as follows:

W (t+1) i = W (t) i exp{α t I[H t (x i ) = y i ]} (4.6.4)
The weights of misclassified data samples will be higher in the next iteration. Thus, the model can give more attention to these misclassified data samples in the next iteration of training. After this update, the weights of the data samples are normalized.

The final model for classification becomes as follows:

H(x) = sign[ T t=1 (α t H t (x))] (4.6.5)
where T is the number of stumps. The final model H(x) makes the final classification and chooses the class that receives the highest total vote. Algorithm 10 shows the pseudo-code of AdaBoost. This algorithm is implemented in the application layer (i.e., on the top of the SDN controller) as a REST application. Train a stump H t (x) using data samples weighted by

W (t-1) i Compute E t = N i=1 W (t) i I[Ht(x i ) =y i ] N i=1 W (t) i Evaluate α t = log( 1-Et Et ) Update weights W (t+1) i = W (t) i exp{α t I[H t (x i ) = y i ]} 4 end 5 Make final classifications: H(x) = sign[ T t=1 (α t H t (x))] 6

Gradient Tree Based Boosting (GTBM)

GTBM is another boosting EL model that uses gradient descent as an optimization algorithm to find optimal values that minimize a differentiable cost/loss function. More specifically, the objective is to find an approximation ŷ to a function H(x) that minimizes a cost/loss function. We used cross entropy loss function L as in Eq. (4.6.6) as a loss function.

L = - 1 N N i=1 y i * log( ŷi ) (4.6.6)
where y i is the ground truth vector (i.e., observed/true value) for i th class, ŷi is the predicted value for i th class, and N is the number of data samples. GTBM begins with initializing the model with a constant value as follows:

H 0 (x) = arg min γ N i=1 L(y i ,γ) (4.6.7)
where N is the number of data samples (i.e.,{(x i ,y i )} N i=1 ) and γ is the predicted value. Then, we compute pseudo-residuals for i th data sample at iteration t as follows:

r it = -[ ∂L(y i ,H(x i )) ∂(H(x i )) ] H(x)=H t-1 (x) (4.6.8)
Afterwards, we fit a weak learner (e.g., decision tree) f t (x) to pseudo-residuals (i.e., train a decision tree learner on the new dataset that consists of {(x i ,r it )} N i=1 ). Then, for each leaf in the new decision tree, we compute an output value at iteration t as follows:

γ t = arg min γ N i=1 L(y i ,H t-1 (x i ) + γf t (x i )) (4.6.9)
The output value for each leaf is the value of γ that minimizes this summations. To find the optimal value of γ, we use a second-order Taylor polynomial approximation to optimize the loss function as follows:

L(y i ,H t-1 (x i ) + γf t (x i )) N i=1 [L(y i ,H t-1 (x i )) + g i γf t (x i ) + 1 2 h i γ 2 f t (x i )]
where

g i = ∂L(y i ,H(x i )) ∂(H(x i ))
and

h i = ∂ 2 L(y i ,H(x i )) ∂ 2 (H(x i ))
are first order (i.e., gradient) and second order (i.e., Hessian) gradient of the loss function.

Then, we compute the derivative of this loss function with respect to γ as follows:

∂L(y i ,H t-1 (x i ) + γf t (x i )) N i=1 [g i f t (x i ) + h i γf t (x i )] (4.6.10)
We compute the value of γ that optimizes the loss function at iteration t as follows:

γ t = - N i=1 g i f t (x i ) N i=1 h i f t (x i ) (4.6.11)
Finally, we update the final model at iteration t as follows:

H t (x) = H t-1 (x) + γ t f t (x i ) (4.6.12)
Algorithm 11 shows the pseudo-code of GTBM. This algorithm is implemented in the application layer (i.e., on the top of the SDN controller) as a REST application.

Algorithm 11: GTBM Algorithm 1 Input: Sequence of N data samples {(x i ,y i )}, i = 1,..., N A differentiable cost/loss function L(y,H(x)) Init the model with H 0 (x) = arg min γ N i=1 L(y i ,γ) for t ←1 to T do 2 Compute r it = -[ ∂L(y i ,H(x i )) ∂(H(x i )) ] H(x)=H t-1 (x) Fit a weak learner f t (x) to pseudo-residuals {(x i ,r it )} N i=1
Compute optimal γ t by solving:

γ t = arg min γ N i=1 L(y i ,H t-1 (x i ) + γf t (x i ))
Update the model as follows:

H t (x) = H t-1 (x) + γ t f t (x i ) 3 end 4 Output the final Model H T (x)

EXtreme Gradient Boosting (XGBoost)

XGBoost has minor improvements over gradient boosting in the regularization strategy. In XGBoost, we use a more sophisticated regularization to avoid over-fitting issues. Thus, the function to optimize at iterations t becomes:

L t N i=1 L(y i ,H t-1 (x i ) + f t (x i )) + Ω(f t ) (4.6.13)
where Ω(f t ) = 1 2 λ || ξ ||, λ is a regularization parameter and ξ is a leaf weight. To find the optimal value of ξ, we use a second-order Taylor polynomial approximation to optimize the loss function as follows:

L t N i=1 [L(y i ,H t-1 (x i )) + g i f t (x i ) + 1 2 h i f t (x i ) 2 ] + 1 2 λ T j=1 ξ 2 j
where g i = ∂L(y i ,H(x i )) and h i = ∂ 2 L(y i ,H(x i )) are first order and second order gradient of the loss function, while T is the number of leaves in the tree. Finally, we compute the optimal value of ξ that optimizes the loss function at iteration t as follows:

ξ t = - N i=1 g i N i=1 h i + λ (4.6.14)
In order to take advantage of the strength of each of these algorithms (i.e., AdaBoost, GTBM, and XGBoost), we propose a majority voting scheme that combines these 3 algorithms to form a stronger final EL model. This final EL model (i.e., inference model) is deployed in the application layer as a REST application.

Attack Mitigation Module (AMM)

When our ensemble adaptive voting module detects network security threats in SDN, a mitigation action is performed to protect network devices. AMM installs blocking OF rules into OF switches under attack; each OF rule (i.e., OF_DROP) has a high priority to match malicious data samples and drop them. For high attack traffic, AMM monitors the speed of incoming malicious data samples; if the packet rate surpasses a rate limiter, then, AMM systematically drops the malicious data samples. This is done using Meter table in OF 1.3 protocol [START_REF]Openflow switch specification[END_REF].

Evaluation of SDNBoost

In this section, we present the evaluation of SDNBoost. First, we introduce the experimental environment. Then, we present the experimental results. Finally, we evaluate the performance of SDNBoost.

Experimental environment

The implementation of SDNBoost is done using scikit-learn [135], an open source library that integrates a wide range of supervised and unsupervised machine learning techniques. The data collection and optimized feature selection module (i.e., PCFS, TIGFS, and GBFS), the ensemble adaptive voting module (i.e., AdaBoost, GTBM, and XGBoost), and AMM are implemented in the application layer (i.e., on the top of the SDN controller) as REST applications. To emulate a real network environment, we use Mininet [START_REF]Mininet[END_REF], a SDN emulation tool that uses containers and virtual OpenFlow switches (e.g., OpenVswitch [START_REF]Openvswicth[END_REF], OpenFlow Switch [136]) to create a realistic virtual network. Our test environment consists of (1) SDN controllers (i.e., Floodlight [START_REF]Floodlight[END_REF]) to install OF rules to block malicious data samples;

(2) Network monitors (i.e., sFlow-RT [START_REF]sflow-rt[END_REF]) to monitor/gather the features of network data flow in a scalable and efficient way; and (3) Multiple OF switches and multiple hosts are simulated to act as legitimate users. For the attack traffic, we leverage two well-known public network security datasets, namely NSL-KDD and UNSW-NB15. These datasets contain recent real-world network security threats. The first one is an improvement of the classic KDD'99 dataset [137] that was created by MIT Lincoln Laboratory for DARPA Intrusion Detection Evaluation Program. However, KDD'99 dataset suffered from the huge number of redundant records which may lead, when training on this dataset, to a biased learning

Experimental Results

The performance of SDNBoost is evaluated using NSL-KDD and UNSW-NB15.

NSL-KDD contains a reasonable number of data samples in the train set (i.e., N SL -KDDT rain + ) and in the test set (i.e., N SL -KDDT est + ). N SL -KDDT rain + contains 22 types of attacks, while N SL -KDDT est + contains 37 types of attacks; these additional attacks in the test dataset make the classification task more realistic and allow to test the generalization ability of the EL model. UNSW-NB15 includes 9 additional new types of attacks. Table 4.1 shows the total number of records in the NSL-KDD train and test sets. Table 4.2 and Table 4.3 shows the total number of records in UNSW-NB15.

NSL-KDD contains 41 input features, while UNSW-NB15 contains 49 input features. Three of the input features (i.e., 'protocol_type', 'service' and 'flag') of NSL-KDD are nonnumeric/categorical input features, while four of the input features (i.e., 'proto', 'state', where X i denotes the input feature (e.g., 'protocol_type'), M ean(X i ) and stdev(X i ) denote, respectively, the mean and standard deviation values for each input feature.

Once the preprocessing phase is done, we used our optimized feature selection module to select the most promising features and remove the redundant ones. Irrelevant features may slow down the process of training and prevent an EL model from making accurate decisions, especially when dealing with large-scale and high-dimensional data systems. SDNBoost uses linear and non-linear feature selection techniques, namely PCFS, TIGFS, and GBFS, to select the most informative features. We have applied PCFS on both datasets, Figs. 4.3(a) and 4.3(b) shows the highly correlated features with the target class (i.e., features with the highest PCFS scores) for the NSL-KDD and the UNSW-NB15 datasets, respectively. For the NSL-KDD dataset, we observe that the most relevant features are those that represent the percentage of the connections that have 'SYN' errors (i.e., 'serror_rate', 'srv_serror_rate', and 'host_serror_rate'). For the UNSW-NB15 dataset, we observe that the most relevant features are the time to live values (i.e., 'sttl' and 'ct_state_ttl'). than 70% of the 122 features of NSLKDD are not contributing to make accurate classifications/decisions, while more than 75% of the 49 features of UNSW-NB15 are not contributing to make accurate classifications/decisions. Figs. 4.6 and 4.7 show the GBFS score of features for NSLKDD and UNSW-NB15 datasets, respectively; they show the highest scoring features (i.e., the features that have gained the highest importance score) in a descending order. We observe that more than 80% of the 122 features of NSLKDD are not contributing to make accurate classifications/decisions, while more than 85% of the 49 features of UNSW-NB15 are not contributing to make accurate classifications/decisions. Our optimized feature selection module can greatly exclude the redundant/irrelevant features that can slow down the process of training and prevent an EL model from making accurate decisions. Thus, SDNBoost can significantly reduce computational complexity while maintaining/ensuring a high detection performance (i.e., higher accuracy and F1 score).

Performance Evaluation

We evaluate the performance of SDNBoost in terms of Accuracy, Precision, True Positive Rate (TPR) called Detection Rate (DR), Area Under the ROC Curve (AUC), and F1score. Also, we measure the performance of SDNBoost on both datasets using ROC curves. ROC curves shows TPR according TP False Positive Rate (FPR). Finally, we use confusion matrices to show the complete performance of SDNBoost (see Table 4.6).

TP (True Positives) represent abnormal data samples that are correctly classified as abnormal data samples, FN (False Negatives) represent abnormal data samples that are classified as normal data samples, FP (False Positives) represent normal data samples that are classified as abnormal data samples, while TN (True Negatives) represent normal data samples that are correctly classified as normal data samples.

Accuracy is the percentage of the number of correct classifications over the total number of classifications. Accuracy is defined as follows:

Accuracy = T P + T N T P + T N + F P + F N (4.8.2)
Precision is the percentage of the number of correct classifications of abnormal data samples over the total number of classified abnormal data samples. Precision is a good measure for imbalanced datasets; it evaluates specific class performance metrics. Precision is defined as follows:

P recision = T P T P + F P (4.8.3)

True Positive Rate (TPR) or Detection Rate (DR) is the percentage of the number of correct classification of abnormal data samples over the total number of presented abnormal data samples. TPR is defined as follows:

DR = T P R = T P T P + F N (4.8.4)
F1 score combines precision and detection rate metrics into a single metric; it is the harmonic mean of the precision and recall and it is defined as follows: We evaluate the performance of SDNBoost in both datasets i.e., the NSL-KDD and the UNSW-NB15. When training the EL model, we tried to minimize the loss (see Figs. 4.8(a) and 4.8(b)) and maximize the detection performance in terms of accuracy and F1-score while significantly reducing computational complexity. Figs. 4.9(a) and 4.9(b) show the confusion matrices on N SL -KDDT est + and UNSW-NB15 datasets, respectively. For N SL -KDDT est + , SDNBoost achieves 87%, 96%, 88%, 88% in accuracy, precision, recall, and F1 score, respectively, with only 4.35 seconds of training time. For UNSW-NB15, SDNBoost achieves 99%, 99%, 99%, 99% in accuracy, precision, recall, and F1 score, respectively, with only 58.08 seconds of training time. Table 4.7 shows the detailed performance of SDNBoost.

F 1 =
The ROC curves show TPR according to FPR. The area under the ROC Curve (AUC) measures the degree of separability between the output classes. The higher the AUC score (i.e., close to 1), the better the model in distinguishing between normal and abnormal data samples. Figs. 4.10(a) and 4.10(b) show the ROC curves on N SL-KDDT est + and UNSW-NB15 datasets, respectively. We obtain an AUC of 0.9 and 1 in N SL -KDDT est + and UNSW-NB15 datasets, respectively. The experiment results show that SDNBoost achieves promising results in both datasets. In the following, we compare our results with state-ofthe-art ML/DL models.

Comparative Analysis

In this section, we compare the results obtained by SDNBoost with the state-of-the-art ML/DL models in both datasets. For N SL -KDDT est + , Tavallaee et al. [START_REF] Tavallaee | A detailed analysis of the kdd cup 99 data set[END_REF] measured the accuracy of the following ML models: J48, Naive Bayes (NB), Random Forest (RF), Multi-layer Perceptron (MLP), and Support Vector Machine (SVM). We also compare SDNBoost with the following recent state-of-the-art DL models: Character-level Intrusion based on convolutional neural networks (CharCNN-IDS) [111], convolutional neural networks (ResNet50, GoogLeNet) [START_REF] Li | Intrusion detection using convolutional neural networks for representation learning[END_REF], Deep Neural Networks (DNN) [START_REF] Tang | Deep learning approach for network intrusion detection in software defined networking[END_REF], recurrent neural networks (RNN-IDS) [START_REF] Yin | A deep learning approach for intrusion detection using recurrent neural networks[END_REF], LSSVM-IDS [START_REF] Ambusaidi | Building an intrusion detection system using a filterbased feature selection algorithm[END_REF], combined Sparse Autoencoder with SVM (STL-IDS) [118], and an adaptive ensemble learning method (AdaMet) [START_REF] Gao | An adaptive ensemble machine learning model for intrusion detection[END_REF]. For UNSW-NB15, we compare SDNBoost with the following recent state-of-the-art ML/DL models: SSL [START_REF] Ashfaq | Fuzziness based semi-supervised learning approach for intrusion detection system[END_REF], RF [117], FeedWSN [START_REF] Mcdermott | Investigation of computational intelligence techniques for intrusion detection in wireless sensor networks[END_REF], OGM [125], and MHMM [START_REF] Moustafa | A new threat intelligence scheme for safeguarding industry 4.0 systems[END_REF]. Tables 4.8 and 4.9 show the values of the metrics of SDNBoost and the state-of-the-art ML/DL models in the NSL-KDD and the UNSW-NB15, respectively. We observe that, in N SL -KDDT est + , SDNBoost achieves the highest accuracy of 87% and the highest F1 score of 88% with only 4.35 seconds of training time. We also observe that, in UNSW-NB15, SDNBoost achieves the highest accuracy of 99% and the highest TPR of 99% with only 58.08 seconds of training time. The experimental results confirm that SDNBoost outperforms state-of-the-art contributions by 12% higher accuracy and F1 score while significantly reducing computational complexity. This makes SDNBoost a promising cyber-security framework that mitigates the new emerging security threats while significantly reducing the computational complexity.

conclusion

In this chapter, we proposed a novel multi-module optimized EL framework that combines optimized feature selection schemes with advanced EL techniques using SDN. First, we introduced a novel data collection and optimized feature selection module to reduce computational complexity while effectively improving detection performance. Then, we proposed an ensemble adaptive voting module that uses three boosting EL techniques, namely Adaptive Boosting (AdaBoost), Gradient Tree Based Boosting (GTBM), and eXtreme Gradient Boosting (XGBoost) to effectively detect network security threats. Finally, we designed AMM to effectively mitigate network security threats. The experimental results on two wellknown public network security datasets i.e., the NSL-KDD and the UNSW-NB15, showed that SDNBoost achieved high accuracy/F1 score in detecting new security threats while significantly reducing computational complexity, making it a promising framework to cope with the new emerging security threats in SDN.

Chapitre 5

CoFed: A privacy preserving collaborative DDoS Mitigation framework based on Federated Learning using SDN and blockchain

Abstract

Distributed denial-of-service (DDoS) attacks continue to grow at a rapid rate plaguing Internet service providers (ISPs) and network operators in a stealthy way. Thus, intrusion detection systems (IDSs) must evolve to cope with these increasingly sophisticated and challenging security threats. Traditional IDSs are prone to zero-day attacks since they are usually signature-based detection systems. The recent rise of machine learning (ML) and deep learning (DL) techniques can help strengthen these IDSs. However, the lack of up-to-date labeled training datasets makes these ML/DL based IDSs inefficient. The privacy nature of these datasets and widespread emergence of adversarial attacks make it difficult for major organizations to share their sensitive data. Federated Learning (FL) is gaining momentum from both academia and industry as a new sub-field of ML that aims to train a global statistical model across multiple distributed users, referred to as collaborators, without sharing their private data. Due to its privacy-preserving nature, FL has the potential to enable privacy-aware learning between a large number of collaborators. This chapter presents a novel framework, called CoFed, that allows multiple software defined networks (SDN) domains (i.e., collaborators) to collaboratively build a global intrusion detection model without sharing their sensitive private data. In particular, CoFed consists of: (1) a novel distributed architecture that allows multiple SDN domains to securely collaborate in order to cope with sophisticated security threats while preserving the privacy of each SDN domain; (2) a novel Secure Multiparty Computation (SMPC) scheme to

Introduction

Distributed Denial of Service (DDoS) attacks are considered as one of the top security threats and the most devastating cyber-attacks that are still bringing collateral damage to Internet service providers (ISPs) and network operators. Recent dramatic incidents that exceed a rate of 1 Tbit/s [6] of traffic attack showed that DDoS attacks have been increasing in strength and sophistication and becoming more destructive. These major security threats cost huge financial losses each year for both business and educational organizations. The proliferation of Internet of Things (IoT) botnets and the rapid growth in the number of insecure IoT devices, with an estimation of 75 billion connected IoT device by 2025 [START_REF] Horwitz | The future of IoT miniguide: The burgeoning iot market continues[END_REF], can give rise to large scale and devastating DDoS attacks. The emergence of new techniques in cyber-attacks (i.e., botnet as a service) provides attackers with more sophisticated tools to launch new attacks that may cause various types of damage e.g., theft of sensitive data, service disruption of some critical domains (e.g., healthcare and finance), and network intrusion. Therefore, there is a need for highly effective intrusion detection systems (IDSs) to secure networks from DDoS attacks and all kind of intrusive activities. IDSs play a vital role in ensuring network security and are considered as the first layer of defense against network security threats; IDSs aim to effectively and timely detect such security threats while having a low rate of false positives. However, traditional IDSs are patterns/signature-based detection systems which makes it difficult to detect zero-day attacks (i.e., unforeseen/unusual attacks). In addition, a significant effort is required in order to continuously improve and evolve such IDSs to detect zero-day attacks.

The recent advent of machine learning (ML) and deep learning (DL) techniques have revolutionized many fields such as vision and speech (e.g., image recognition and speech recognition). The results achieved with these techniques in some fields have surpassed the human performance. IDSs adopted ML/DL techniques to effectively detect intrusive activities and security threats of network traffic. With the adoption of ML/DL techniques, IDSs can detect both existing and new attacks without continuously updating the rules of traditional IDSs. However, the lack of balanced and up-to-date labeled training datasets makes these ML/DL based IDSs inefficient when encountering new emerging security threats (i.e., zero-day attacks). The privacy nature of these datasets as well as the widespread emergence of adversarial attacks [10], prevent major organizations from sharing their sensitive datasets with research communities in order to develop efficient and up-to-date ML/DL models that mitigate the new emerging security threats.

Recently, Federated learning (FL) has emerged as a new sub-field of ML that aims to train a global shared model across multiple distributed collaborators without centrally storing their sensitive data. In FL, instead of bringing sensitive data of each collaborator to a central server in order to train a ML model, each collaborator trains locally a shared global model using its local training data, and sends only the local model updates. FL can significantly reduce the privacy risks and the communication costs (e.g., network bandwidth consumption) since only small messages are communicated (i.e., model updates), in contrast to sending the entire raw training data over the network [START_REF] Li | Federated learning: Challenges, methods, and future directions[END_REF]. Moreover, it has been proven that FL is robust to the non-identically distributed (non-IID) and unbalanced data distributions [START_REF] Mcmahan | Communication-efficient learning of deep networks from decentralized data[END_REF].

FL has the potential to radically disrupt major privacy-sensitive domains such as healthcare and network security, in which the sensitivity constraints surround the data, with its promising key features of collaborative learning as well as privacy preserving. The adoption of FL in the context of collaborative intrusion detection will allow major cyber-security organizations such as Kaspersky [143] and McAfee [144] to collaboratively build an efficient and up-to-date intrusion detection model in a fully distributed manner. Thus, greatly improve the efficiency of traditional ML/DL based IDSs to cope with zero-day attacks while preserving the privacy of each collaborator (i.e., collaborator's sensitive data). More especially, FL enables a privacy-aware collaborative learning between multiple collaborators, making it an ideal candidate for such collaborative IDSs. FL has distinct privacy advantages in comparison with centralized training approaches that persist raw data; it has proven its effectiveness in major fields [START_REF] Brik | Federated learning for uavs-enabled wireless networks: Use cases, challenges, and open problems[END_REF][START_REF] Lim | Federated learning in mobile edge networks: A comprehensive survey[END_REF][START_REF] Preuveneers | Chained anomaly detection models for federated learning: An intrusion detection case study[END_REF][START_REF] Savazzi | Federated learning with cooperating devices: A consensus approach for massive iot networks[END_REF][START_REF] Martinez | Record and reward federated learning contributions with blockchain[END_REF][START_REF] Khan | Federated learning for edge networks: Resource optimization and incentive mechanism[END_REF][START_REF] Moghaddam | On data center demand response: A cloud federation approach[END_REF][START_REF] Samarakoon | Distributed federated learning for ultra-reliable low-latency vehicular communications[END_REF][START_REF] Wang | Learning in the air: Secure federated learning for uav-assisted crowdsensing[END_REF], since only minimal updates are necessary to train a particular model. However, FL is still vulnerable to reverse-engineering attacks; indeed, these attacks may extract sensitive information about the used training data only from the locally computed model updates sent by each collaborator. To alleviate this issue, we propose the use of a secure aggregation scheme, based on Secure Multiparty Computation (SMPC) approach, to securely aggregate the locally computed model updates from each collaborator in such a way that no one can see anyone's updates.

Recently, software defined network (SDN) has emerged as a novel technology that leverages network programmability to solve the limitations of conventional networks. SDN provides new capabilities through a logically centralized component, called SDN controller, to manage the network dynamically. SDN brings numerous benefits by decoupling the control plane from the data plane which allows for more control over networks and brings new capabilities to cope with security threats ranging from DDoS attacks to data leakage.

Based on our review of SDN and FL, we believe that their joint use will change the cybersecurity landscape. The recent rise of blockchain and smart contracts opens the door for a plethora of new decentralized applications that address the challenges faced by the current collaborative intrusion detection systems (e.g., centralized management) that suffer from single-point-of-failure. Blockchain has proven its success and effectiveness in achieving high level of trustworthiness and decentralization in major fields (e.g., Infrastructure-as-a-Service (IaaS) [START_REF] Pourvahab | Digital forensics architecture for evidence collection and provenance preservation in iaas cloud environment using sdn and blockchain technology[END_REF], Smart Grid [START_REF] Houda | Blockchain meets ami: Towards secure advanced metering infrastructures[END_REF], and healthcare [START_REF] Houtan | A survey on blockchain-based self-sovereign patient identity in healthcare[END_REF]). Blockchain technology allows to design secure, trustworthy, transparent, and decentralized collaboration systems. In this chapter, we exploit the decentralized nature of blockchain in order to design a collaborative intrusion detection system that makes use of Ethereum's smart contracts to maintain a collaboration between SDN domains that is fully decentralized, trustworthy, flexible, and efficient. Thus, ensuring integrity, transparency, and reliability of the whole system.

This chapter presents the design, specification, and implementation of a novel framework, called CoFed, that leverages FL, SMPC, SDN and blockchain technologies to cope with the new emerging security threats on a large scale. CoFed is a distributed, efficient, trustworthy, flexible, and privacy-preserving framework that manages DDoS collaboration process across multiple SDN domains. First, we implemented CoFed using pysyft [156], a generic framework for privacy preserving deep learning, and we deployed it on Ethereum official test network Ropsten [START_REF]Ropsten[END_REF], an open blockchain platform. Then, we evaluated CoFed using the well-known public network security dataset NSL-KDD [START_REF]NSL-KDD dataset[END_REF] that contains the main attack categories i.e., Distrusted Denial of Service (DDoS), User to Root (U2R), Probe (Probing) and Root to Local (R2L). The experimental results show that CoFed outperforms state-of-the-art ML/DL models in terms of accuracy and F1 score in both binary and multi-class classification while preserving the privacy of collaborators.

The main contributions of this chapter can be summarized as follows:

• We design a complete decentralized, efficient, and secure collaborative DDoS mitigation framework (CoFed) based on FL using blockchain and SDN. The rest of the chapter is organized as follows. Section 5.3 presents the background and related work. Section 5.4 presents an overview of CoFed. Section 5.5 describes the design and specification of CoFed. Section 5.6 presents the implementation and the performance evaluation of CoFed. Finally, Section 5.7 concludes the chapter.

Background And Related Work

Several schemes in the literature have integrated ML/DL techniques in IDSs to improve the efficiency of traditional IDSs. However, few of them consider the problem of the lack of balanced and up-to-date labeled datasets. In this section, we briefly describe attack categories considered in this work. Then, we overview the most prominent intrusion detection schemes as well as their security issues.

Categories of Attacks

In this work, we used the well-known public network security dataset NSL-KDD, which is an improvement of the classic KDD'99 dataset [137] that was created by MIT Lincoln Laboratory for DARPA Intrusion Detection Evaluation Program. KDD'99 records were collected over nine weeks during the International Knowledge Discovery and Data Mining Competition in a local area network (LAN) that simulates a typical United States Air Force LAN; it contains about five million connection records. However, KDD'99 dataset suffered from the huge number of redundant records which may lead, when training on this dataset, to a biased learning model. The NSL-KDD dataset is a revised and cleaned-up version of KDD'99 dataset in which all redundant records were removed. Therefore, a ML model, when trained on this dataset, will not be biased towards the redundant records. Moreover, the • Distributed Denial of Service (DDoS): is a type of attacks in which a large number of attackers try to flood a victim with massive number of illegitimate traffic in order to deny legitimate users' access to the victim's machine (e.g., DNS amplification attacks). • Probe (Probing): is a type of attacks in which the attacker tries to gather network's information in order to steal user's sensitive data (e.g., port scanning attacks). • User to Root Attack (U2R): is a type of attacks in which the attacker exploits the system's vulnerability to gain root privileges/access to that system. First, the attacker starts with an access to the system with a normal user account using some techniques like password sniffing or social engineering. Then, the attacker tries to gain access to the system as a root (e.g., buffer overflow attacks). • Remote to Local Attack (R2L): is a type of attacks in which the attacker exploits some vulnerabilities to gain local access to a remote machine (e.g., guessing password attacks).

The NSL-KDD dataset contains 41 features per record where 31 are continuous, 7 are discrete and 3 are categorical. The features of the NSL-KDD dataset can be classified into four categories (see Tables 5.11 and 5.12 in the appendix): (1) Intrinsic: it represents the features that are extracted from the header of network traffic flow; (2) Content: it represents the features that are extracted from the payload of network traffic flow, it contains information about the content of the flow traffic; (3) Time-based traffic: it represents the time-based features that contain information about the number of connections made to the same host over a two seconds window; and (4) Host-based traffic: it represents the features both binary and multi-class classification. Yin et al. [START_REF] Yin | A deep learning approach for intrusion detection using recurrent neural networks[END_REF] proposed the design and implementation of an intrusion detection system based on recurrent neural networks (RNN-IDS). The experimental results showed that RNN-IDS outperforms traditional ML models in terms of detection accuracy in both binary and multi-class classification.

In order to increase the detection rate of ML/DL models, several contributions have combined supervised and unsupervised approaches to build an efficient intrusion detection model. Teng et al. [START_REF] Teng | Svm-dt-based adaptive and collaborative intrusion detection[END_REF] proposed a self-adaptive and collaborative intrusion detection method based on decision trees (DTs) and SVM algorithms. They evaluated the effectiveness of the proposed framework using the KDD'99 dataset. The experimental results showed that the proposed method outperforms the use of only a single type of shallow ML models in terms of detection and recall rate. Majjed et al. [START_REF] Al-Qatf | Deep learning approach combining sparse autoencoder with svm for network intrusion detection[END_REF] developed a self-taught learning (STL-IDS) framework by combining a sparse autoencoder (SAE) and SVM. The use of SAE in the STL framework helped to effectively represent the raw data while SVM was used for the classification task. STL-IDS reduced considerably the time of training. Wang et al. [START_REF] Wang | Hast-ids: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[END_REF] proposed a novel intrusion detection system called hierarchical spatial-temporal feature-based intrusion detection system (HAST-IDS). HAST-IDS has two stages: (1) it uses deep convolutional neural networks (CNNs) to learn the low-level spatial features of network traffic; and (2) it uses the LSTM networks (short-term memory networks) to learn a high-level temporal feature. They evaluated the effectiveness of HAST-IDS using the standard DARPA and ISCX2012 datasets. Perez et al. [START_REF] Perez | Intrusion detection in computer networks using hybrid machine learning techniques[END_REF] proposed multiple hybrid ML models (i.e., supervised and unsupervised learning algorithms) for intrusion detection task. More specifically, they combined Neural Networks (NN) and SVM with radial kernel for supervised learning, and K-Means for unsupervised learning. Moreover, they used two other techniques (i.e., Gradual Feature Reduction (GFR) and Principal Component Analysis) for feature selection. Gao et al. [START_REF] Gao | An adaptive ensemble machine learning model for intrusion detection[END_REF] proposed an adaptive ensemble learning model based on common ML algorithms (i.e., Decision Trees (DT), SVM, logical regression (LR), k-nearest neighbors (KNN), Adaboost, random forests (RF), and deep neural networks) to increase the detection rate in traditional ML models.

Based on our analysis of existing ML/DL based IDSs works, we found that a number of these schemes [START_REF] Farahnakian | A deep auto-encoder based approach for intrusion detection system[END_REF][START_REF] Diro | Distributed attack detection scheme using deep learning approach for internet of things[END_REF][START_REF] Wang | Hast-ids: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[END_REF] are computationally expensive. Also, most of them [START_REF] Zhang | Random-forests-based network intrusion detection systems[END_REF][START_REF] Yang | Combined wireless network intrusion detection model based on deep learning[END_REF][START_REF] Tao | An improved intrusion detection algorithm based on ga and svm[END_REF][START_REF] Jan | Toward a lightweight intrusion detection system for the internet of things[END_REF][START_REF] Farahnakian | A deep auto-encoder based approach for intrusion detection system[END_REF][START_REF] Diro | Distributed attack detection scheme using deep learning approach for internet of things[END_REF][START_REF] Yin | A deep learning approach for intrusion detection using recurrent neural networks[END_REF][START_REF] Teng | Svm-dt-based adaptive and collaborative intrusion detection[END_REF][START_REF] Al-Qatf | Deep learning approach combining sparse autoencoder with svm for network intrusion detection[END_REF][START_REF] Wang | Hast-ids: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[END_REF][START_REF] Perez | Intrusion detection in computer networks using hybrid machine learning techniques[END_REF][START_REF] Gao | An adaptive ensemble machine learning model for intrusion detection[END_REF], are trained in some specific networks, on imbalanced and outdated datasets; this usually results in inefficient and inaccurate intrusion detection models when encountering zero-day attacks. The lack of new, balanced, and up-to-date datasets that contain sufficient data records of new attacks (i.e., zero-day attacks) is still an ongoing challenge making these new attacks successful. The privacy nature of these datasets as well as the widespread emergence of adversarial attacks prevent major organizations (e.g., network operators) from sharing their sensitive datasets with research communities to develop efficient and up-to-date ML/DL models.

More recently, attempts have been made to raise the issue of the lack of labeled data. Zhao et al. [START_REF] Zhao | Transfer learning for detecting unknown network attacks[END_REF] proposed the use of transfer learning approach to detect new attacks by transferring the knowledge of intrusion detection from a source model trained on a private dataset to a target model. Wu et al. [START_REF] Wu | A transfer learning approach for network intrusion detection[END_REF] proposed a knowledge-transfer based Convolution Neural Network (ConvNet) model, called TL-ConvNet, to detect unseen attacks based on a transfer learning approach. TL-ConvNet consists of: (1) a ConvNet architecture that holds the basic knowledge of network intrusions; and (2) a transfer learning approach that possesses the knowledge of the target attack model. However, these solutions may not be efficient to cope with zero-day attacks since they are mainly trained on some specific datasets of a specific user. There is no collaborative training in which users collaboratively build an efficient and up-to-date intrusion detection model that copes with the new emerging attacks. Moreover, these schemes [START_REF] Zhao | Transfer learning for detecting unknown network attacks[END_REF][START_REF] Wu | A transfer learning approach for network intrusion detection[END_REF] are not privacy preserving since the shared model may reveal the details of the user's private data during inference.

To address the shortcomings of these existing solutions [START_REF] Zhang | Random-forests-based network intrusion detection systems[END_REF][START_REF] Yang | Combined wireless network intrusion detection model based on deep learning[END_REF][START_REF] Tao | An improved intrusion detection algorithm based on ga and svm[END_REF][START_REF] Jan | Toward a lightweight intrusion detection system for the internet of things[END_REF][START_REF] Farahnakian | A deep auto-encoder based approach for intrusion detection system[END_REF][START_REF] Diro | Distributed attack detection scheme using deep learning approach for internet of things[END_REF][START_REF] Yin | A deep learning approach for intrusion detection using recurrent neural networks[END_REF][START_REF] Teng | Svm-dt-based adaptive and collaborative intrusion detection[END_REF][START_REF] Al-Qatf | Deep learning approach combining sparse autoencoder with svm for network intrusion detection[END_REF][START_REF] Wang | Hast-ids: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[END_REF][START_REF] Perez | Intrusion detection in computer networks using hybrid machine learning techniques[END_REF][START_REF] Gao | An adaptive ensemble machine learning model for intrusion detection[END_REF][START_REF] Zhao | Transfer learning for detecting unknown network attacks[END_REF][START_REF] Wu | A transfer learning approach for network intrusion detection[END_REF], we propose a distributed, efficient, and secure collaborative DDoS mitigation framework; it allows multiple SDN domains to collaboratively train and build a shared global intrusion detection model without sharing their sensitive private data; thus, preserving the privacy of collaborators. Moreover, we introduce a novel Secure Multiparty Computation (SMPC) scheme to securely aggregate local model updates from each collaborator. Finally, we propose a blockchain based scheme to maintain a collaboration that is fully decentralized, trustworthy, flexible, and efficient. The use of new technologies (i.e., FL, SMPC, SDN, blockchain and smart contracts) allows for a secure and efficient DDoS collaboration, making it a promising approach for major organizations to share their intrusion detection knowledge with other communities while preserving their privacy.

CoFed: An Overview

This section presents an overview of CoFed. More specifically, we explain how CoFed ensures: (1) a distributed collaborative learning between multiple SDN domains to build a joint global model by exchanging only encrypted model updates; and (2) a secure aggregation scheme to securely aggregate the locally computed model updates from each collaborator. Fig. 5.1 shows the system architecture of CoFed. CoFed allows multiple SDN domains to collaborate in a secure manner. First, the organization creates a collaboration smart contract in the blockchain. Then, it adds the authorized collaborators to the smart contract. Therefore, the organization enables the process of collaborative learning with only authenticated collaborators. The use of blockchain will ensure the integrity, transparency, availability, and the reliability of the collaboration system. Once done, the organization can start the training of a global model across these authenticated collaborators. First, the organization initializes These aggregators aggregate local encrypted updates sent from each collaborator and send the aggregated value to the organization. Last, the organization decrypts the aggregated values and sends the global model parameters to each collaborator. This process is repeated until a maximum round or a certain stop criterion is reached. In the following, we describe in more details our proposed framework. Then, we present the implementation as well as the evaluation of our proposed framework.

Design Of CoFed

CoFed'S Smart Contract

We consider an organization that would like to manage a privacy preserving collaborative learning process across multiple distributed SDN domains. First, the organization creates and deploys CoFed's smart contract in Ethereum's blockchain [8]. Then, it adds, via CoFed's smart contract, FL collaborators (i.e., SDN domains) into the collaboration system. It includes the collaborator's address, an initial credibility and other information (e.g., collaborator notes). CoFed's smart contract provides the organization (i.e., contract owner) with the flexibility to easily add/remove FL collaborators to/from the collaboration system and to manage the collaboration system in a fully decentralized, trustworthy, and transparent manner. CoFed's smart contract is programmed using solidity language [START_REF]Solidity[END_REF]. For the sake of simplicity, the following is restricted to two important functions of CoFed's smart contract; where Col denotes an instance of a collaborator; now is the time passed in seconds since 1970; msg.sender is the address of the FL collaborator that sent the transaction to the smart contract; and the Externally Owned Account (EOA): is an account controlled by a pair of public and private keys.

addFLCollaborator(Col.EOA, Col.Infos): this function can only be called by the organization to add a FL collaborator; it takes as input the collaborator's Externally Owned Account (Col.EOA) and other information (Col.Infos) and adds the FL collaborator to the collaboration system as well as the timestamp of when the FL collaborator was added. Algorithm 12 illustrates the logic of this function. removeFLCollaborator(col.EOA): this function can only be called by the organization to remove a FL collaborator from the collaboration system if needed; it takes as input the EOA of the FL collaborator (col.EOA) and removes him from the collaboration system. Algorithm 13 illustrates the logic of this function. The number of rounds S r

The number of secure aggregators at each round r

CoFed Framework

In this section, we describe the operation of CoFed; in particular, we describe how it enables a private learning between SDN domains by combining FL with a secure aggregation scheme. Table 5.2 shows the list of notations used to describe CoFed whereas Fig. 5.2 shows the flowchart that exhibits the interactions between our main components: the organization, secure aggregators and SDN domains (i.e., collaborators): ( 1 [START_REF] Mcmahan | Communication-efficient learning of deep networks from decentralized data[END_REF]; in addition, we make use of a security layer to protect the locally-computed updates from reverse-engineering attacks. We define the optimization of the non-convex neural network objective function as follows:

min wr∈R d f (w r ) where f (w r ) = 1 K K k=1 f k (w r ) (5.5.1)
where K is the number of collaborators and f k (w r ) is the local objective function for the k th collaborator; f k is parameterized by a high-dimensional vector w r ∈ R d . Local training consists of finding parameters w r , at each round r, that minimize the local loss function defined as follows:

∀k, f k (w r ) = 1 n k n k j k =1 f j k (w r ; x j k ,y j k ) (5.5.2)
where n k is the number of local samples (i.e., (x j k ,y j k )) of the k th collaborator.

For optimization, we use local stochastic gradient descent (SGD) with a fixed learning rate η on each collaborator. At the beginning of each round r, each collaborator independently computes the average gradient on its local data at the current model w r using local batch or mini-batch for one or more local epochs e:

g k r = ∇f k (W r ; b r ) (5.5.3)
Afterwards, each collaborator takes a step of local gradient descent on the current model using its local data as follows:

∀k, W k r ← W r -η∇f k (W r ; b) (5.5.4)
In order to protect these local model updates from reverse-engineering attacks, we use a secure multi-party computation scheme (SMPC). SMPC allows each collaborator k to split its secret (i.e., local model updates) into several shares given to secure aggregators, in such a way that each secure aggregator s = 1..S r has an encrypted value w c,k r,s and learns nothing about the secret (i.e., w k r ). This approach is known as secret sharing, a well-know field in in modern cryptography, that provides better performance in terms of computation in comparison with other cryptography primitives (i.e., Homomorphic encryption (HE)).

First, we set a fixed finite field i.e., from 0, 1,..., Q -1 for a prime Q in which all computations will take place. Each collaborator k encodes its local model updates w k r as integers, by scaling them with a fixed precision constant and computes the modulo of the result with the prime Q. Afterwards, each collaborator k splits its encoded value (i.e., secret) into S r shares. Each secure aggregator s, 1 <= s <= S r , receives one of the shares that represents the encrypted value of the locally computed model update w k,c r,s . Then, each secure aggregator s aggregates these encrypted gradients w k,c r,s and applies the following update:

∀s, W c r+1,s ← W c r,s -η 1 K K k=1 g k r,s
(5.5.5)

where 1 K K k=1 g k r,s =∇f (W c r,s ; b c r,s ). Since, for each collaborator k: ∀k, W c,k r+1 ← W c r -ηg k r (5.5.6)
The final model update for each secure aggregator s becomes as follows:

∀s, W c r+1,s ← 1 K K k=1 W c,k r+1,s
(5.5.7)

Finally, the organization reconstructs the secret by summing the final model updates from each aggregator s. Then, it decrypts the model parameters and sends the new global model to each authenticated collaborator. This process is repeated until a maximum round r max is reached. Algorithm 14 shows the pseudo-code of the operation of CoFed. Sample content type 0, tcp, ftp_data, SF, 491, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 2, 0, 0, 0, 0, 1, 0, 0, 150, 25, 0.17, 0.03, 0.17, 0, 0, 0, 0.05, 0 normal 0, tcp, private, REJ, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 229, 10, 0, 0, 1, 1, 0.04, 0.06, 0, 255, 10, 0.04, 0.06, 0, 0, 0, 0, 1, 1, neptune DoS 1, tcp, telnet, RSTO, 0, 15, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 8, 0.00, 0.12, 1.00, 0.50, 1.00, 0.00, 0.75, 29, 86, 0.31, 0.17, 0.03, 0.02, 0.00, 0.00, 0.83, 0.71, mscan Probe 0, tcp, telnet, SF, 129, 174, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1.00, 0, 0, 255, 255, 1, 0, 0, 0, 0.01, 0.01, 0.02, 0.02, guess_passwd R2L 8, tcp, ftp, SF, 220, 688, 0, 0, 0, 4, 0, 1, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 53, 27, 0.51, 0.08, 0.02, 0, 0, 0, 0, 0, buffer_overflow widely. Some of the features (e.g., 'src_bytes [0,1.37*10 9 ]' and 'dst_bytes [0,1.3*10 9 ]') of the NSL-KDD dataset have larger values than others (e.g., 'num_failed_logins [0,5]' and 'num_compromised [0,7479]') while some other features (e.g., 'duration [0,42908]') have large ranges between the maximum and the minimum values; this will impact the results as the global model will miss out important information in the features that have minimum values such as 'num_failed_logins'. Hence, we re-scale the values of the features values according to Eq. (5.6.1) using a standardization technique to have a mean of 0 and a standard deviation of 1 (unit variance). As the last step in this preprocessing phase, the output feature ('Label'), that contains name of attack, is changed to numerical values (see Table 5.5) to consider both binary and multi-class classification.

X i = X i -M ean(X i ) stdev(X i ) (5.6.1)
where X i denotes the input feature (e.g., duration), M ean(X i ) and stdev(X i ) denote, respectively, the mean and standard deviation values for each input feature. Our aim in this work is to test the effectiveness and feasibility of CoFed; thus, we constructed a global deep neural network with input layer of 122 neurons that corresponds to the dimension of the input sample of NSL-KDD dataset, two hidden layers with LeakyReLU [START_REF] Maas | Rectifier nonlinearities improve neural network acoustic models[END_REF] (Leaky Rectified Linear Unit) as activation function and an output layer of 5 dimensions in the case of multi-class classification and 2 dimensions in the case of binary classification

Performance Evaluation

We evaluate the performance of CoFed in terms of Accuracy, Precision, Recall called detection rate (DR) or TPR (True Positive Rate), and F1-score. The performance of CoFed is measured using the area under the ROC Curve (AUC). The ROC curve shows TPR according FPR. Finally, a confusion matrix is used to show the complete performance of CoFed (see Table 5.7). Accuracy is defined in Eq. 5.6.3 as the percentage of the number of correct predictions over the total number of predictions. When the class distribution is imbalanced, Accuracy may not be a good indicator. Therefore, we need to evaluate specific class performance metrics. Precision, one of such metrics, is defined in Eq. 5.6.4; it is the percentage of the number of correct predictions of intrusions over the total number of predicted intrusions.

P recision =

T P T P + F P (5.6.4)

Recall, called detection rate (DR) or TPR (True Positive Rate) is another important metric, that is defined in Eq. 5.6.5; it is the percentage of the number of correct predictions It is often convenient to combine precision and recall into a single metric called F1 score. F1 is the harmonic mean of the precision and recall; it is defined as follows: False positive rate (FPR) is defined in Eq. 5.6.7; it is the percentage of the number of intrusions incorrectly classified as normal input samples over the total number of negative samples (i.e., normal data).

F P R =

F P T N + F P (5.6.7) where TP (True Positives) represent intrusions that are correctly identified as intrusions, FN (False Negatives) represent intrusions that are classified as legitimate samples, FP (False Positives) represent legitimate samples that are identified as intrusions, and TN (True Negatives) represent legitimate samples that are classified as legitimate. A good model is a model that has high accuracy, detection rate and F1 score with a low false positive rate. We evaluate the performance of CoFed in both binary and multi-class classification using N SL -KDDT rain + and N SL -KDDT est + datasets. When training the global model, we tried to minimize the loss (see Figs. 5.4, 5.5, 5.6, and 5.7) and maximize the accuracy.

Figs. 5.8 and 5.9 show Accuracy on N SL -KDDT rain + and N SL -KDDT est + datasets, respectively, for 10 rounds, 25 rounds, and 50 rounds. We observe that the global model achieves an accuracy of 97%, 98%, and 99% on the N SL -KDDT rain + dataset for 10 rounds, 25 rounds, and 50 rounds, respectively; it also achieves an accuracy of 85%, 88%, and 89% on the N SL -KDDT est + dataset for 10 rounds, 25 rounds, and 50 rounds, respectively. Additionally, we used the precision, recall, and F1 score metrics to evaluate CoFed. Table 5.8 shows detailed performance of the global model of each evaluated scenario on the N SL -KDDT est + dataset. In addition, Figs. 5.10 and 5.11 show the confusion matrices on the N SL -KDDT est + dataset for scenario 1 and scenario 2, respectively. In scenario 1, CoFed achieves 89%, 90%, 89%, 89% in accuracy, precision, recall, and F1 score, respectively, for only 10 rounds of training (60,48 seconds) in binary classification. For multiclass classification, CoFed achieves 89%, 89%, 89%, 87% in accuracy, precision, recall, and F1 score, respectively, for 50 rounds of training (349,99 seconds). In scenario 2, CoFed achieves 86%, 88%, 86%, 86% in accuracy, precision, recall, and F1 score, respectively, for 50 rounds of training (629,79 seconds) in binary classification. For multi-class classification, CoFed achieves 83%, 86%, 83%, 80% in accuracy, precision, recall, and F1 score, respectively, for 50 rounds of training (639,56 seconds). The ROC curves show the True Positive Rate according to the False Positive Rate. The area under the ROC Curve (AUC) is a measurement metric that measures the degree of separability between the classes. The higher the AUC (i.e., value near to 1), the better the model is in distinguishing between normal and abnormal samples.

Comparative Analysis

In this section, we compare the results obtained by CoFed with the centralized ML schemes in both binary and multi-class classification using the N SL -KDDT est + dataset.

conclusion

In this chapter, we proposed a global cyber-security framework, called CoFed, where multiple SDN domains (i.e., collaborators) collaboratively train and build an efficient global intrusion detection model without sharing their private data. The experimental results on the well-known public network security dataset NSL-KDD showed that CoFed achieved efficiency and high accuracy in detecting sophisticated security threats in both binary and multi-class classification, making it a promising framework to mitigate large scale attacks in SDN environment.

Appendices

Chapitre 6 Conclusion

Le projet de cette thèse s'est focalisé sur la mise en place des solutions permettant: (1) la mitigation des attaques par déni de service distribué sur deux niveaux (intra-domaine et inter-domaine); et la (2) le renforcement des aspects sécurité dans les réseaux programmables. Les différentes études que nous avons effectuées ont donné lieu à une compréhension plus complète du projet. Cela nous a permis de bien déterminer les limitations des solutions existants et de démontrer les points forts apportés par nos contributions [START_REF] El Houda | Cochain-sc: An intra-and inter-domain ddos mitigation scheme based on blockchain using sdn and smart contract[END_REF][START_REF] El Houda | Bringing intelligence to software defined networks: Mitigating ddos attacks[END_REF][START_REF] El Houda | Sdnboost: An sdn based boosting ensemble learning framework for advanced attack mitigation[END_REF][180][START_REF] El Houda | Co-iot: A collaborative ddos mitigation scheme in iot environment based on blockchain using sdn[END_REF][START_REF] El Houda | Chainsecure -a scalable and proactive solution for protecting blockchain applications using sdn[END_REF][START_REF] Houda | Blockchain meets ami: Towards secure advanced metering infrastructures[END_REF][184][START_REF] El Houda | Blockchain-based reverse auction for v2v charging in smart grid environment[END_REF][START_REF] El Houda | A novel machine learning framework for advanced attack detection using sdnn[END_REF].

Par la suite, nous avons étendu la mitigation intra-domaine afin de mitiger d'autres vecteurs d'attaques (R2L, Probe, U2R, etc.). Nous avons amélioré les performances de détection en utilisant des algorithmes d'apprentissage d'ensemble (Ensemble Learning (EL)). Nous avons évalué les performances de notre troisième contribution en utilisant des données d'attaques réelles provenant de deux ensembles de données publiques, à savoir le NSL-KDD et l'UNSW-NB15. Les résultats des simulations ont montré que notre solution permet de mitiger efficacement les attaques avec une précision élevée et un faible taux de faux positifs. En fin, nous avons étendu notre mitigation inter-domaine en considérant des techniques d'apprentissage fédéré. Nous avons proposé une nouvelle architecture distribuée qui permet à plusieurs domaines SDN de collaborer de manière sécurisée. Par la suite, nous avons utilisé un nouveau mécanisme de calcul multipartite sécurisé (Secure multi-party computation(SMPC)) pour agréger de manière sécurisée les mises à jour des modèles de chaque participant. Nous avons intégré les contrats intelligents d'Ethereum pour maintenir la collaboration d'une manière totalement décentralisée, fiable, flexible et efficace. Les résultats des simulations ont montré que notre solution permet de mitiger efficacement les attaques tout en préservant la vie privée des collaborateurs.

Prochains travaux

Dans nos travaux, nous avons fixé un délai d'inactivité pour les règles OF. Pour des valeurs élevées, les règles OF restent dans la table OF pendant une longue période, ce qui peut épuiser la mémoire des commutateurs OF (TCAM), tandis que des valeurs trop faibles peuvent conduire à l'abandon de réponses légitimes. Les résultats obtenus sont très encourageants pour la suite des travaux. Pour les travaux futurs, nous allons concevoir un nouvel algorithme d'optimisation pour définir dynamiquement ces délais d'attente. Cette optimisation peut être basée sur la capacité de la table OF, le taux de trafic et la charge entre plan de données et du plan de contrôle. Aussi, nous allons utiliser l'apprentissage automatique contradictoire/Réseaux antagonistes génératifs (Adversarial machine learning/Generative adversarial networks) pour renforcer les aspects sécuritaires des systèmes de détection d'intrusion. Par la suite, nous allons etudier l'apport de l'apprentissage non supervisé, ou les données ne sont pas étiquetées, dans la détection d'intrusion. Nous développerons de nouveaux algorithmes d'apprentissage non supervisé afin d'extraire des classes présentant des caractéristiques communes de trafic légitime et par la suite bloquer le trafic de l'attaque tout en préservant un faible taux de faux positifs. D'autres part, nous proposerons de nouvelles mécanismes de collaborations entre un domaine sous l'attaque (domaine d'un client (Customer)) et un domaine (AS domaine) qui peut déployer des services de sécurité à travers le SDN dans ce domaine attaqué. Cette collaboration doit être sécurisée et fiable pour les deux parties. Ecole Doctorale "Sciences pour l'Ingénieur"

Renforcement de la sécurité à travers les réseaux programmables

Thèse réalisée en partenariat entre :

5. 9

 9 Performance metrics of CoFed and the centralized ML/DL models in binary classification on N SL -KDDT est + dataset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.10 Performance metrics of CoFed and the centralized ML/DL models in multi-class classification on N SL -KDDT est + dataset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.11 List of features in the NSL-KDD dataset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.12 List of features in the NSL-KDD dataset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2. 4

 4 Different attacks setup without WisdomSDN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5 Different attacks setup with WisdomSDN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6 Experimental Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.7 Capture on victim's network without and with wisdomSDN. . . . . . . . . . . . . . . . . . . . . 2.8 Performance evaluation of WisdomSDN in terms of: (a) bandwidth consumption; (b) OF channel workload. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.9 Performance evaluation of WisdomSDN in terms of: (a) DNS request's traffic before and after enabling WisdomSDN; and (b) Time of DM mitigation. . . . . . . . . 2.10 Normalized entropy values of: (a) source IP address (IP src ); (b) UDP port Source (P ort src ); and c) AN Y DNS requests.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.11 ROC curves for the: (a) 100 Mbps case; (b) 500 Mbps case. . . . . . . . . . . . . . . . . . . . . . 3.1 Concept of DDoS attacks across multiple SDN domains. . . . . . . . . . . . . . . . . . . . . . . . . 3.2 DDoS attacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Cochain-SC blockchain-based framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 Table Model in OF switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 High-level architecture of inter-domain DDoS mitigation scheme. . . . . . . . . . . . . . . . . 3.6 Experimental Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.10 Confusion matrices for scenario 1 on N SL -KDDT est + in: a) binary classification; and b) multi-class classification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.11 Confusion matrices for scenario 2 on N SL -KDDT est + in: a) binary classification; and b) multi-class classification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.12 ROC Curves of scenario 1 Binary classification on the N SL -KDDT est + dataset for: a) 10 rounds; b) 25 rounds; and c) 50 rounds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.13 ROC Curves of scenario 1 Multi-class classification on the N SL -KDDT est + dataset for: a) 10 rounds; b) 25 rounds; and c) 50 rounds. . . . . . . . . . . . . . . . . . . . . . . . 5.14 ROC Curves of scenario 2 Binary classification on the N SL -KDDT est + dataset for: a) 10 rounds; b) 25 rounds; and c) 50 rounds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.15 ROC Curves of scenario 2 Multi-class classification on the N SL -KDDT est + dataset for: a) 10 rounds; b) 25 rounds; and c) 50 rounds. . . . . . . . . . . . . . . . . . . . . . . . 5.16 Accuracy of CoFed and the centralized ML/DL models in binary and multi-class classification on the N SL -KDDT est + dataset.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure. 1 . 1 .

 11 Figure. 1.1. Architecture du SDN

Figure. 1 . 2 .Figure. 1 . 3 .

 1213 Figure. 1.2. Table de flux d'un commutateur OF

  (3) dans les systèmes traditionnels de communication inter-domaine, une infrastructure à clé publique (PKI) est nécessaire afin d'assurer l'intégrité des données partagées. Les systèmes basés sur PKI sont coûteux à installer et à maintenir. Blockchain permet une communication inter-domaine sécurisée tout en maintenant le système transparent, à moindre coût et flexible. Le troisième problème est lié à l'identification, la quantification et la mitigation d'autres vecteurs d'attaques afin de permettre à notre mécanisme intra-domaine élaborées dans les 2 premières problématiques de mitiger non seulement les attaques DDoS mais aussi d'autres vecteurs d'attaques. La différence principale entre ces vecteurs d'attaques et les attaques par dénis de service distribuées (DDoS) élaborées dans les 2 premières problématiques est que les attaques par DDoS tentent d'inonder le réseau de la victime avec un trafic amplifié afin d'arrêter complètement son service alors que ces nouveaux vecteurs d'attaques tentent d'infiltrer discrètement le système sans être détectés. Plus précisément, nous nous intéressons dans cette contribution aux attaques qui essayent de: (1) voler et manipuler leurs données sensibles; et (2) prendre le contrôle à distance et les utiliser pour créer des outils d'amplification pour les cyberattaques (botnet as-a-service) pour gagner de l'argent. La croissance rapide du nombre des objets connectés non sécurisés, avec un nombre estimé à 75 milliards d'appareils d'ici la fin de 2025 [9], peut améliorer et faciliter la capacité des attaques à grande échelle. Dans ce troisième problème, nous allons extraire les données d'attaques depuis des ensembles de données publiques. Parmis ces vecteurs d'attaques, nous trouvons: Remote to Local (R2L), Probe, et User to Root (U2R). R2L est un type d'attaque qui tente d'obtenir un accès local à des objets distants. Probe, est un type d'attaque qui essaye d'obtenir des informations sensibles d'un réseau (informations personnelles sur les clients et les informations bancaires). U2R est un type d'attaque où l'attaquant tente d'accéder au système/réseau en tant que super-utilisateur (root). L'attaquant tente d'exploiter les vulnérabilités d'un système pour obtenir les privilèges d'un super-utilisateur (root). Nous étudions d'abord les caractéristiques de chacune de ces attaques. Par la suite, nous utilisons des algorithmes d'apprentissage automatique (Machine Learning (ML)) et des algorithmes d'apprentissage d'ensemble (Ensemble Learning (EL)) pour détecter efficacement ces attaques. Nous menons des expérimentations approfondies pour évaluer la solution proposée. Et enfin, nous comparons les résultats obtenus avec ceux de l'état de l'art.

Figure. 1 . 4 .

 14 Figure. 1.4. Organisation de la thèse

Figure. 2 . 1 .

 21 Figure. 2.1. DNS amplification attack.

Figure. 2 . 2 .

 22 Figure. 2.2. Flow diagram of WisdomSDN.

Figure. 2 . 3 .

 23 Figure. 2.3. System Architecture.

Figure. 2 . 4 .Figure. 2 . 5 .

 2425 Figure. 2.4. Different attacks setup without WisdomSDN.

2. 7 . 3 . 2 .

 732 Criterion of classification. BNF is a binary classifier that consider two classes of DNS requests: (1) legitimate DNS requests, denoted by leg, and (2) illegitimate DNS requests, denoted by illeg. The class of X k , denoted by c, can be either leg or illeg and is defined as follows: c = arg max c∈{leg,illeg} p(c|X k )

Figure. 2 . 6 .

 26 Figure. 2.6. Experimental Environment.

  Fig. 2.6 shows the experimental environment (i.e., components of the testbed); it consists of: (a) SDN controller (i.e., Floodlight); (b) sFlow collector (i.e., sFlow-RT): to perform the monitoring of network traffic features (sFlow-RT can perform monitoring of 7500 switch ports in data center networks); (c) REST applications: it executes FSC, ECS, BNF and DM; and (d) 6 OF switches, that are connected together via 1 Gbps links. Each OF network contains more than 20 hosts; multiple hosts in our setup topology are simulated to act as Open Resolvers and send amplified DNS responses (we tested several attacks setup: when the attacker is external (see Figs. 2.4(a) and 2.4(b)), and then when it is internal (see Fig. 2.4(c) and 2.4(d)) and other hosts are

Tableau 2 . 2 .Figure. 2 . 7 .

 2227 Figure. 2.7. Capture on victim's network without and with wisdomSDN.

Figure. 2 . 8 .

 28 Figure. 2.8. Performance evaluation of WisdomSDN in terms of: (a) bandwidth consumption; (b) OF channel workload.

  Figs. 2.10(a), 2.10(b) and 2.10(c) show, respectively, the normalized entropy values of IP source address, UDP port source and ANY. These normalized entropy values decreases rapidly in the interval of attack 150-200s. Thus, ECS can better represents the attack and indicates that we are very likely in the presence of illegitimate flow. Therefore, BNF can detect the attack with a high detection rate and low false positive rates.

Figure. 2 . 9 .

 29 Figure. 2.9. Performance evaluation of WisdomSDN in terms of: (a) DNS request's traffic before and after enabling WisdomSDN; and (b) Time of DM mitigation.

Figure. 2 . 10 .

 210 Figure. 2.10. Normalized entropy values of: (a) source IP address (IP src ); (b) UDP port Source (P ort src ); and c) AN Y DNS requests.

Figure. 2 . 11 .

 211 Figure. 2.11. ROC curves for the: (a) 100 Mbps case; (b) 500 Mbps case.

Figure. 3 . 1 .

 31 Figure. 3.1. Concept of DDoS attacks across multiple SDN domains.

  We design a decentralized secure DDoS mitigation scheme (Cochain-SC) based on blockchain using smart contract; it supports two levels of mitigation: intra-domain and inter-domain DDoS mitigation. • We propose a smart contract-based scheme, that makes use of Ethereum's smart contract technology, to realize a decentralized, secure, flexible and low-cost collaboration, among multiple SDN-based domains, to mitigate DDoS attacks. • We propose an Intra Entropy-based scheme (I-ES), to measure the randomness of data inside the domain using sFlow. • We propose an Intra detection scheme, called Intra Bayes-based scheme (I-BS), to automatically detect network traffic anomalies inside the domain. • We propose an Intra-Domain Mitigation (I-DM) scheme to effectively mitigate illegitimate flows inside the domain. • We evaluate the performance of Cochain-SC in terms of flexibility, efficiency, security and cost effectiveness. The experiments results show that Cochain-SC can effectively mitigate the attack inside the domain with high accuracy, low false positive rates and a low overhead, and achieves the requirements of the new generation of flexible, secure, efficient, and low-cost inter-domain DDoS collaboration schemes.The rest of the chapter is organized as follows. Section 3.3 presents related work. Section 3.4 presents an overview of Cochain-SC. Section 3.5 presents our intra-Domain DDoS mitigation approach, which consists of an Intra Entropy-based scheme (I-ES), an intra Bayesbased scheme (I-BS) and an Intra-Domain Mitigation (I-DM) scheme. Section 3.6 presents

Figure. 3 . 2 .

 32 Figure. 3.2. DDoS attacks.

Figure. 3 . 3 .

 33 Figure. 3.3. Cochain-SC blockchain-based framework.

3. 5 . 3 . 4 .

 534 Criterion of classification. I-BS considers two classes of vectors: (1) legitimate vectors denoted by leg and (2) illegitimate vectors denoted by illeg. The class of k th vector X k , denoted by c, can be either leg or illeg and is represented as follows: c = arg max c∈{leg,illeg} p(c|X k ) (3.5.7)

Figure. 3 . 5 .

 35 Figure. 3.5. High-level architecture of inter-domain DDoS mitigation scheme.

4 if

 4 collaboratorsAdr[collaborators[c.EOA].index] == c.EOA then 5

Algorithm 4 : 2 return false; 3 else 4 if

 424 isRecord Input : r.IP Output: bool 1 if recordsAdr.length == 0 then recordsAdr[records[r.IP].index] == r.IP then 5

Figure. 3 . 7 .Figure. 3 . 8 .Figure. 3 . 9 .

 373839 Figure. 3.7. The contract lifecycle.

:

  IDS; Ensemble learning; gradient boosting, optimized feature selection; SDN. Status: This journal paper is Submitted. Z. Abou El Houda, A. S. Hafid and L. Khoukhi, "SDNBoost: An SDN-based Boosting Ensemble Learning Framework for Advanced Network Attack Mitigation," IEEE Transactions on Cognitive Communications and Networking, 2021.

Figure. 4 . 1 .

 41 Figure. 4.1. Proposed Multi-Module EL-based IDS Framework

Figure. 4 . 2 .

 42 Figure. 4.2. SDNBoost's System Architecture

Algorithm 10 :2) i to 1 N

 101 AdaBoost Algorithm 1 Input: Sequence of N data samples {(x i ,y i )}, i = 1,..., N Init data sample weights W (0for t ←1 to T do 3

5

 5

Figure. 4 . 3 .Figure. 4 . 4 .

 4344 Figure. 4.3. PCFS scores of features for: (a) the N SL -KDD dataset; and (b) the U N SW -N B15 dataset

Figure. 4 . 5 .Figure. 4 . 6 .Figure. 4 . 7 .Figure. 4 . 8 .

 45464748 Figure. 4.5. TIGFS Score of features for U N SW -N B15

  Figs

Figure. 4 . 9 .Tableau 4 . 6 .Figure. 4 . 10 .

 4946410 Figure. 4.9. Confusion matrices for (a) N SL -KDDT est + ; and (b) UNSW-NB15

Figure. 5 . 1 .

 51 Figure. 5.1. CoFed's System Architecture

r

  The global model parameters at round r W k The local model updates of collaborator k at round r W c,k r The encrypted local model updates of collaborator k at round r W c,k r,s The s th shares of the encrypted model update of collaborator k at round r η The learning rate B The local batch size E The local epoch K The number of collaborators n k The number of local training samples of collaborator k r max

  ) the organization initiates the collaborative learning by initializing the global model parameters with a set of weights W 0 . Then, it selects K authenticated collaborators. Afterwards, it sends the global model to each authenticated collaborator; (2) each collaborator k, 1 <= k <= K collaborators performs local updates and computes in parallel, based on the global model and its local training dataset, a new local model. Then, each collaborator encrypts its local model updates and split these updates into S r shares; (3) each secure aggregator s, 1 <= s <= S r receives one of the shares of each collaborator and updates the global model by aggregating the received encrypted local model updates and sends them to the organization; and (4) the organization decrypts the model parameters and starts new round. This process is repeated until a maximum round is reached. The use of SDN in this process allows each collaborator to obtain a global view of its local network to: (1) easily extract network traffic features to train the local model; and (2) easily deploy the global model to effectively and accurately cope with security threats (e.g., zero-day attacks) once the global training across multiple SDN domains is done. We formalize the problem of collaborative learning as a problem of federated optimization as proposed by McMahan et al.

Algorithm 14 : 2 for each Secure aggregator s in S r do 3 WW 8 WTableau 5 . 3 .

 1423853 CoFed Training 1 Initial Phase: the organization selects K authenticated collaborators (indexed by k) and initializes the global model parameters with a set of W 0 . Then, it sends the global model to each of the authenticated collaborators. S r ←subset of secure aggregators at round r for r ←1 to r max do c r+1,s ← SecureAggregation(r,s) r+1 ←decrypt(decode(W c r+1 )) Send W r+1 to each collaborator 6 end 7 SecureAggregation(r,s): //Each secure aggregator executes this function for each collaborator k in parallel do c,k r+1,s ← CollaboratorUpdate(k) to organization CollaboratorUpdate(k): // Each authenticated collaborator executes this function B ←Split local datasets into local batches of size B for each Local epoch e in E do 11 for batch b in B do 12 W k r ←W r -η∇f k (W r ; b) 13 end 14 end 15 W c,k r ←encrypt(encode(W k r )) Split W c,k r into S r shares return W k,c r,s to each secure aggregator s Samples of NSL-KDD dataset

Figure. 5 . 4 .

 54 Figure. 5.4. Model loss for scenario 1 binary classification for: a) 10 rounds; b) 25 rounds; and c) 50 rounds.

Figure. 5 . 5 .Figure. 5 . 6 .Figure. 5 . 7 .

 555657 Figure. 5.5. Model loss for scenario 1 Multi-class classification for: a) 10 rounds; b) 25 rounds; and c) 50 rounds.

Figure. 5 . 8 .Figure. 5 . 9 .

 5859 Figure. 5.8. Accuracies on the N SL-KDDT rain + dataset for: a) 10 rounds; b) 25 rounds; and c) 50 rounds.

Figure. 5 . 10 .

 510 Figure. 5.10. Confusion matrices for scenario 1 on N SL -KDDT est + in: a) binary classification; and b) multi-class classification.

Figure. 5 . 11 .

 511 Figure. 5.11. Confusion matrices for scenario 2 on N SL -KDDT est + in: a) binary classification; and b) multi-class classification.

F 1 = 2 1 P recision + 1 Recall

 11

Figure. 5 . 12 .Figure. 5 . 13 .

 512513 Figure. 5.12. ROC Curves of scenario 1 Binary classification on the N SL -KDDT est + dataset for: a) 10 rounds; b) 25 rounds; and c) 50 rounds.

Figs. 5 .

 5 12 and 5.13 show the ROC curves of scenario 1 in binary and multi-class classification, respectively, on the N SL -KDDT est + dataset. Figs. 5.14 and 5.15 show ROC curves of scenario 2 in binary and multi-class classification, respectively, on the N SL -KDDT est + dataset. In scenario 1, we obtain an AUC of 0.91, 0,91, and 0.92 in 10 rounds, 25 rounds, and 50 rounds, respectively, in binary classification. For multi-class classification, we obtain an AUC of 0.91, 0,93, and 0.93 in 10 rounds, 25 rounds, and 50 rounds, respectively. In scenario 2, we obtain an AUC of 0.85, 0,86, and 0.90 in 10 rounds, 25 rounds, and 50 rounds, respectively, in binary classification. For multi-class classification, we obtain an AUC of 0.83, 0,88, and 0.89 in 10 rounds, 25 rounds, and 50 rounds, respectively. The experiment results show that CoFed achieves promising results in both binary and multi-class classification in both scenarios while preserving the privacy of each collaborator. In the following, we compare our results with baseline ML/DL models in centralized training architecture.

Figure. 5 . 14 .Figure. 5 . 15 .Tableau 5 . 9 .

 51451559 Figure. 5.14. ROC Curves of scenario 2 Binary classification on the N SL -KDDT est + dataset for: a) 10 rounds; b) 25 rounds; and c) 50 rounds.

Figure. 5 . 16 .

 516 Figure. 5.16. Accuracy of CoFed and the centralized ML/DL models in binary and multiclass classification on the N SL -KDDT est + dataset.

  La conception originale d'Internet n'a pas pris en compte les aspects de sécurité du réseau, l'objectif prioritaire était de faciliter le processus de communication. Par conséquent, de nombreux protocoles de l'infrastructure Internet exposent un ensemble de vulnérabilités. Ces dernières peuvent être exploitées par les attaquants afin de mener un ensemble d'attaques. Les attaques par déni de service distribué (DDoS) représentent une grande menace ; DDoS est l'une des attaques les plus dévastatrices causant des dommages collatéraux aux opérateurs de réseau ainsi qu'aux fournisseurs de services Internet. Les réseaux programmables (SDN) ont émergé comme un nouveau paradigme promettant de résoudre les limitations de l'architecture réseau actuelle en découplant le plan de contrôle du plan de données. D'une part, cette séparation permet un meilleur contrôle du réseau et apporte de nouvelles capacités pour mitiger les attaques par DDoS. D'autre part, cette séparation introduit de nouveaux défis en matière de sécurité du plan de contrôle. L'enjeu de cette thèse est double. D'une part, étudier et explorer l'apport du SDN à la sécurité afin de concevoir des solutions efficaces qui vont mitiger plusieurs vecteurs d'attaques. D'autre part, protéger le SDN contre ces attaques. À travers ce travail de recherche, nous contribuons à la mitigation des attaques par déni de service distribué sur deux niveaux (intra et inter-domaine), et nous contribuons au renforcement de la sécurité dans le SDN. Mots clés : SDN (architecture des réseaux d'ordinateurs) -réseaux à grande distance (informatique) -tests d'intrusion (informatique) -apprentissage supervisé (intelligence artificielle) -blockchains. of Internet did not take into consideration security aspects of the network; the priority was to facilitate the process of communication. Therefore, many of the protocols that are part of the Internet infrastructure expose a set of vulnerabilities that can be exploited by attackers to carry out a set of attacks. Distributed Denial-of-Service (DDoS) represents a big threat and one of the most devastating and destructive attacks plaguing network operators and Internet service providers (ISPs) in stealthy way. Software defined networks (SDN) is an emerging technology that promises to solve the limitations of the conventional network architecture by decoupling the control plane from the data plane. On one hand, the separation of the control plane from the data plane allows for more control over the network and brings new capabilities to deal with DDoS attacks. On the other hand, this separation introduces new challenges regarding the security of the control plane. This thesis aims to deal with DDoS attacks while protecting the resources of the control plane. In this thesis, we contribute to the mitigation of both intra-domain and inter-domain DDoS attacks, and we contribute to the reinforcement of security aspects in SDN. Keywords: software-defined networking (computer network technology) -wide area networks (computer networks) -penetration testing (computer security) -supervised learning (machine learning)blockchains (databases).

  1.1 Architecture du SDN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Table de flux d'un commutateur OF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1.3 Traitement d'un paquet dans un commutateur OpenFlow . . . . . . . . . . . . . . . . . . . . . . 1.4 Organisation de la thèse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1 DNS amplification attack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Flow diagram of WisdomSDN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 System Architecture.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  Trois types de ces vecteurs d'attaques sont les plus critiques: Remote to Local (R2L), Probe, et User to Root (U2R). R2L est un type d'attaque qui tente d'obtenir un accès local à des objets distants. Probe est un type d'attaque qui essaye d'obtenir des informations sensibles d'un réseau, informations personnelles sur les clients et les informations bancaires. U2R est un type d'attaque où l'attaquant tente d'accéder au système/réseau en tant que super-utilisateur (root); l'attaquant tente d'exploiter les vulnérabilités d'un système pour obtenir les privilèges d'un super-utilisateur (root).

Z. Abou El Houda, A. Senhaji Hafid and L. Khoukhi, "SDNBoost: An SDN-based Boosting Ensemble Learning Framework for Advanced Network Attack Mitigation," IEEE

	Transactions on Cognitive Communications and Networking,
	2021. Submitted.
	[2] Z. Abou El Houda, A. Senhaji Hafid and L. Khoukhi,

"CoFed: A privacy preser- ving collaborative DDoS Mitigation framework based on Federated Lear- ning using SDN and blockchain," IEEE

	Transactions on Network Science and
	Engineering, 2021. Submitted.
	[3] Z. Abou El Houda, L. Khoukhi and A. Senhaji Hafid,

"Bringing Intelligence to Software Defined Networks: Mitigating DDoS Attacks," IEEE

	Transactions
	on Network and Service Management, vol. 17, no. 4, pp. 2523-2535, Dec. 2020, doi:
	10.1109/TNSM.2020.3014870.

Chapitre 2 Bringing Intelligence to Software Defined Networks: Mitigating DDoS Attacks 2.1. Abstract

	promising solution to mitigate DNS amplification attack in a SDN environment.
	Keywords: DDoS; SDN; Entropy; Bayes Classifier.
	Status: This journal paper is published. Z. Abou El Houda, L. Khoukhi and A. Senhaji
	Hafid, "
	As one of the most devastating types of Distributed Denial of Service (DDoS) attacks,
	Domain Name System (DNS) amplification attack represents a big threat and one of the
	main Internet security problems to nowadays networks. Many protocols that form the
	Internet infrastructure expose a set of vulnerabilities that can be exploited by attackers
	to carry out a set of attacks. DNS, one of the most critical elements of the Internet,
	is among these protocols. It is vulnerable to DDoS attacks mainly because most of the
	exchanges in this protocol use User Datagram Protocol (UDP). These attacks are difficult
	to defeat because attackers spoof the IP address of the victim and flood him with valid
	DNS responses coming from legitimate DNS servers. In this chapter, we propose an efficient
	and scalable solution, called WisdomSDN, to effectively mitigate DNS amplification attack
	in the context of software defined networks (SDN). WisdomSDN covers both detection and
	mitigation of illegitimate DNS requests and responses. WisdomSDN consists of: (1) a novel
	proactive and stateful scheme (PAS) to perform one-to-one mapping between DNS requests
	and DNS responses; it operates proactively by sending only legitimate responses, excluding
	amplified illegitimate DNS responses; (2) a machine learning DDoS detection module to
	detect, in real-time, illegitimate DNS requests. This module consists of: (a) Flow statistics
	collection scheme (FSC) to gather the features of flows in an efficient and scalable way using
	sFlow protocol; (b) Entropy calculation scheme (ECS) to measure randomness of network
	traffic; and (c) Bayes Network based Filtering scheme (BNF) to classify, based on entropy
	values, illegitimate DNS requests; and (3) DNS Mitigation scheme (DM) to effectively
	mitigate illegitimate DNS requests. The experimental results show that, compared to
	state-of-the-art, WisdomSDN can effectively detect/mitigate DNS amplification attack
	quickly with a high detection rate, less false positive rates, and a low overhead making it a

Bringing Intelligence to Software Defined Networks: Mitigating DDoS Attacks," IEEE

	Transactions on Network and Service Management, vol. 17, no. 4, pp.
	2523-2535, Dec. 2020, doi: 10.1109/TNSM.2020.3014870.

12 end 13 else 14 return; 15 end 16 end 17 end

  Expect_solution.eth_src ←this.dns_packet.eth_dst Expect_solution.eth_dst←this.dns_packet.eth_src Expect_solution.ip_src←this.dns_packet.ip_dst Expect_solution.ip_dst←this.dns_packet.ip_src Expect_solution.udp_dst←this.dns_packet.udp_src Install rule that allows only this Expect_solution This.dns_packet::Forward_Routing_Policies()

	Algorithm 1: (PAS): Proactive And Stateful Scheme
		Input : DNS packet
		Output: Action to carry out
	1 for each DNS packet do
	2	Check Type of packet DNS;

3 if this.dns_packet.type==Request then 4 Expect_solution=new Packet() ; 5 6 else 7 if this.dns_packet.type==Response then 8 if Match(this.dns_packet)::In_Flow_Table then 9 This.dns_packet::Action(Output:IN_PORT); 10 else 11 This.dns_packet::ACTION(DROP);

Theorem 1 .

 1 We divide the state of the network into two segments: normal state (i.e., nonattack), and under DNS amplification attack. We denote H leg (IP src ) and H illeg (IP

src ) as, respectively, the entropy value of each flow at local OF switch S j in normal state and under attack. When the attacker starts an attack towards a specific victim (i.e., target of DNS amplification attack), the number of packets that have the same IP src will increase quickly, which leads to a significant decrease of entropy, especially, H leg (IP src )

H illeg (IP src ).

:

  to OF. DM specifies for each flow entry in OF table a meter; meter entries with different Meter_id are deployed to monitor the speed of the classified illegitimate traffic features vector X k by BNF; if the packet rate surpasses the band (i.e., rate limiter); then, DM systematically drops the illegitimate DNS requests. Machine Learning DDoS Detection Algorithm. Input : Aggregated DNS requests from OF Ingress port Output: legitimate or illegitimate 1 1. Define address groups, the attribute to aggregate flows denoted as att (i.e., IP src , P ort src , AN Y ) and initialize the monitoring interval ∆T . 2. Identify flow f i , ∀ 0 ≤ i ≤ N , and set the count number of packets for each flow f i to zero. 3. When the monitoring interval ∆T is over, the entropy values are calculated as follows: for each flow f i at a local OF switch S j do

	Algorithm 22

9 else 10 Go to step 2 11 end 12

  5 then

	8	notifies DM
		Go to step 2

  attribute (e.g., IP src , IP dst ) to aggregate flows depends on the attack (e.g., DRDoS, DDoS) under investigation. When the network suffers from DDoS attack, the number of the flows that have the same destination IP address IP dst (i.e., target of attack) increases sharply leading to a significant decrease of entropy values; while the source IP addresses entropy values are relatively concentrated. Attackers generates illegitimate traffic from the same UDP/TCP port source number, as legitimate users generate legitimate traffic from random UDP/TCP port source number; therefore, this attribute also can better represent the DDoS attack characteristics. Consequently, we use {IP dst , P ort src and P ort dst } as the attribute to aggregate flows. Finally, we represent the network traffic features at the k th time period as: X

k = {H(IP dst ) k , H(P ort src ) k , H(P ort dst ) k } (3.5.6)

•

  We propose a hyperparameter optimization scheme to enhance the overall model performance. • We propose a novel ensemble adaptive voting module that uses three boosting EL techniques, namely AdaBoost, GTBM, and XGBoost to effectively detect network security threats. • We propose an attack mitigation module (AMM) to effectively mitigate network security threats. • We evaluate the performance of SDNBoost in terms of accuracy, F1 score, and computational complexity. We compare the performance of SDNBoost with state-of-the-art contributions. The experiments results show that SDNBoost can effectively detect and mitigate attacks with high accuracy/F1 score while significantly reducing computational complexity.

The remainder of this chapter is organized as follows. In Section 4.3, we present a review of related work. Then, we present a general overview of SDNBoost in Section 4.4. In Section 4.5, we describe our data collection and optimized feature selection module. Section 4.6 presents our ensemble adaptive voting module. Section 4.7 presents AMM. In Section 4.8, we evaluate SDNBoost. Finally, Section 4.9 concludes the chapter.

  The NSL-KDD dataset is a revised and cleaned-up version of KDD'99 dataset in which all redundant records were removed. NSL-KDD contains the main attack categories

			Tableau 4.1. Details of NSL-KDD
	Dataset	Records	Normal	DoS	Probe	R2L U2R
	NSL-KDDTrain	125973		67343		45927	11656	995	52
	NSL-KDDTest	22544		9711		7558	2421	2754 200
			Tableau 4.2. Details of UNSW-NB15
	Records	Normal	Fuzzers	Analysis Backdoors
	2540044	2218761	24246		2677	2329
		Tableau 4.3. Details of UNSW-NB15 (Continued)
	DoS	Exploits	Generic	Reconnaissance Shellcode Worms
	16353	44525		215481	13987	1511	174
	model. raw network
	packets that includes a variety of simulated attacks including DDoS attacks. UNSW-NB15
	contains about three million connection records; it includes the following network attacks:
	analysis, fuzzers, DoS, backdoors, reconnaissance, generic, exploits, shellcode, and worms.
	We run our experiments on Google Colaboratory [138] using the Tesla T4 GPU on a PC
	with Intel Core i7-8750H-2.2 GHz, 16GB RAM, and GTX 1050 GPU.

i.e., Distributed Denial of Service (DDoS), User to Root (U2R), Probe (Probing) and Root to Local (R2L). The second one (i.e., UNSW-NB15) is a synthetic dataset from Cyber range Lab of the Australian Centre for cyber Security (ACCS); it contains 100 GB of

  2

		Tableau 4.7. Performance metrics of SDNBoost
	Dataset	Accuracy Precision Recall	F1	Time(s)
	NSL-KDDTest	87%	96%	88%	88%	4,35
	UNSW-NB15	99%	99%	99%	99%	58.08
	Tableau 4.8. Performance metrics of SDNBoost and state-of-the-art ML/DL models based
	on the available measures using N SL -KDDT est +
	Methods	Accuracy Precision Recall	F1	Time (se-
						cond)
	J48 [139]	0.81	N/A	N/A	N/A	N/A
	NB [139]	0.76	N/A	N/A	N/A	N/A
	RF [139]	0.80	N/A	N/A	N/A	N/A
	MLP [139]	0.77	N/A	N/A	N/A	N/A
	SVM [139]	0.70	N/A	N/A	N/A	N/A
	CharCNN-	0.85	0.91	0.81	0.86	N/A
	IDS [111]
	ResNet50 [140] 0.79	0.91	0.69	0.79	N/A
	GoogleNet [140] 0.77	0.91	0.65	0.76	N/A
	DNN [112]	0.75	0.83	0.75	0.74	N/A
	RNN-IDS [113] 0.83	N/A	0.83	N/A	5516
	LSSVM-	0.78	N/A	0.78	N/A	N/A
	IDS [115]
	STL-IDS [118]	0.84	0.96	0.76	0.85	673.031
	AdaMet [122]	0.85	0.86	0.85	0.84	N/A
	SDNBoost	0.87	0.96	0.88	0.88	4.35
	Tableau 4.9. Performance metrics of SDNBoost and state-of-the-art ML/DL models based
	on the available measures using UNSW-NB15
	Methods	Accuracy TPR	Time (se-
					cond)
	SSL [116]	0.86	0.85	N/A
	RF [117]	0.93	0.92	N/A
	FeedWSN [124] 0.92	0.91	N/A
	1 P recision + 1 OGM [125] 0.95 MHMM [126] 0.96 Recall False positive rate (FPR) is the percentage of the number of abnormal data samples = 2 * P recision * Recall P recision + Recall 0.94 N/A (4.8.5) 0.95 N/A SDNBoost 0.99 0,99 58.08
	incorrectly classified as normal data samples over the total number of normal samples. FPR
	is defined as follows:
			F P R =	F P T N + F P		(4.8.6)

•

  We propose a novel distributed architecture that allows multiple SDN domains to collaboratively build an efficient intrusion detection model that copes with new and sophisticated security threats while preserving the privacy of each SDN domain.• We propose a secure aggregation scheme that uses Secure Multiparty Computation (SMPC) approach to securely aggregate local model updates from each collaborator. • We propose a blockchain based scheme that makes use of Ethereum's smart contracts to maintain a collaboration that is fully decentralized, trustworthy, flexible, transparent, tamper-proof, and efficient. • We evaluate the performance of CoFed in terms of detection rate, accuracy, and efficiency. We compare the performance of CoFed with the centralized ML/DL methods.The experimental results show that CoFed achieves privacy, efficiency, and security making it a promising framework to mitigate large scale attacks in SDN.

  Tableau 5.1. Sub-classes of each attack category of NSL-KDD dataset reasonable number of records in each of train and test sets. Table5.1 shows the four major attack categories as well as the sub-classes of each attack category of the NSL-KDD dataset.

	Attack	Sub-classes
	catego-
	ries
	DDoS	back, land, pod, neptune, smurf, teardrop, mailbomb,
		apache2, processtable, udpstorm, worm
	Probe	ipsweep, nmap, portsweep, satan, mscan, saint
	U2R	buffer_overflow, perl, rootkit, sqlattack, ps, xterm
	R2L	ftp_write, guess_passwd, imap, multihop, phf, spy, wa-
		rezclient, warezmaster, sendmail, named, snmpgetat-
		tack, snmpguess, xlock, xsnoop, httptunnel
	dataset contains a

end 4 if status is not true then 5 throw; 6 end 7 if isFLCollaborator

  (col.EOA) == true then

	Algorithm 12: addFLCollaborator
		Input : col.EOA, col.Infos
		Output: null
	1 if msg.sender is not owner then
	2	throw;
	3 8	throw;
	9 else
	10	length ←FLColsAdr.push(col.EOA)
		FLCols[col.EOA]←FLCol(col.EOA,col.Infos, credibility, now, length-1)
		emit FLColAdded(col.EOA, col.Infos)
		numberOfFLCols++
	11 end

U2R Tableau 5.4.

  Details of NSL-KDD dataset

	Dataset	Records	Normal	DoS	Probe	R2L	U2R
	NSL-	125973	67343	45927	11656	995	52
	KDDTrain
	NSL-	22544	9711	7558	2421	2754	200
	KDDTest

  Tableau 5.8. Performance metrics for different scenarios on N SL -KDDT est + dataset

	Scenarios	Accuracy Precision Recall	F1	Time
	Sc1_binary_r=10	0.89	0.90	0.89	0.89	60,48
	Sc1_binary_r=25	0.89	0.90	0.89	0.89	120,02
	Sc1_binary_r=50	0.89	0.90	0.89	0.89	290,5
	Sc1_multi_r=10	0.86	0.86	0.86	0.84	69,39
	Sc1_multi_r=25	0.88	0.88	0.88	0.86	172.34
	Sc1_multi_r=50	0.89	0.89	0.89	0.87	349.99
	Sc2_binary_r=10	0.80	0.86	0.80	0.80	185.23
	Sc2_binary_r=25	0.82	0.85	0.82	0.81	371.65
	Sc2_binary_r=50	0.86	0.88	0.86	0.86	626.79
	Sc2_multi_r=10	0.72	0.73	0.72	0.66	64.93
	Sc2_multi_r=25	0.81	0.86	0.81	0.78	344.75
	Sc2_multi_r=50	0.83	0.86	0.83	0.80	639.56

  Performance metrics of CoFed and the centralized ML/DL models in multiclass classification on N SL -KDDT est + dataset

	Methods		Accuracy F1 score Time (second)
	DNN		0.75	0.74	-
	RNN-IDS		0.83	-	5516
	ResNet50		0.79	0.79	-
	GoogleNet		0.77	0.76	-
	CharCNN-IDS	0.85	0.86	-
	STL-IDS		0.84	0.85	673,031
	CoFed		0.89	0,89	60,48
	Tableau 5.10. Methods	Accuracy F1 score Time (second)
	DNN	0.75	0.74	-
	RNN-IDS	0.81	-	11444
	ResNet50	0.79	-	-
	GoogleNet	0.77	-	-
	CharCNN-IDS	0.79	-	-
	STL-IDS	0.8	0.79	61362.384
	CoFed	0.89	0,89	349,99

+ dataset

1.4. Motivations et objectifsSDN propose une architecture qui découple les fonctions de contrôle et les fonctions de transfert de données du réseau, au contraire de l'architecture de réseau actuelle où les périphériques réseau sont couplés avec un plan de contrôle spécialisé. Cela permet d'une part, de mieux reprogrammer et d'automatiser le réseau et d'offrir de nouvelles capacités pour mitiger les attaques par déni de service distribué. D'autre part, cette séparation introduit de nouveaux défis en matière de sécurité du plan de contrôle.L'enjeu de cette thèse est double. D'une part, étudier et explorer l'apport du SDN à la sécurité afin de concevoir des solutions efficaces qui vont détecter et mitiger les attaques par déni de service distribué. La thèse explore cette direction de recherche en appliquant les concepts des réseaux programmables permettant d'avoir une vision globale du réseau, des approches dites proactives permettant d'anticiper ces attaques; des algorithmes d'apprentissage automatique (Machine Learning (ML)), des algorithmes d'apprentissage d'ensemble (Ensemble Learning (EL)), des algorithmes d'apprentissage profond (Deep Learning (DL)), et des algorithmes d'apprentissage fédéré (Federate Learning) permettant de détecter efficacement ces attaques; et des mécanismes de prévention permettant de mitiger efficacement ces attaques. En plus de cette mitigation intra-domaine, la thèse propose un système de mitigation inter-domaine permettant à plusieurs domaines SDN de collaborer en toute sécurité et de transférer les informations d'attaque de manière fiable, efficace et sécurisée.

Contributions

Nous avons proposé une première contribution pour détecter et prévenir les attaques d'amplification DNS en se reposant sur le SDN et en considérant tous les cas possibles d'attaques. Nous avons proposé un mécanisme proactif pour filtrer les requêtes et les réponses illégitimes de l'ensemble du trafic DNS. Nous avons proposé un nouveau mécanisme de collecte des statistiques des flux de données afin d'extraire le vecteur représentant l'attaque. Nous avons proposé un mécanisme de détection en temps réel pour détecter automatiquement cette attaque en utilisant des algorithmes d'apprentissage automatique. Nous avons démontré l'efficacité de cette contribution dans un environnement SDN. Nous avons évalué les performances de notre première contribution en termes d'efficacité et de précision. Les résultats des simulations ont montré que notre solution permet d'atténuer efficacement les attaques d'amplification DNS avec une précision élevée et moins de charges sur le plan de contrôle. Puis, nous avons étendu ce système de détection et de mitigation au niveau de l'inter-domaine en utilisant un système de collaboration efficace, flexible, transparent, fiable, et sécurisé. Nous avons implémenté et évalué cette contribution dans un environnement SDN et blockchain afin de prouver sa flexibilité et son efficacité à détecter et mitiger ces attaques. Les résultats des simulations ont montré que notre solution permet d'atténuer efficacement les attaques DDoS avec une précision élevée, un faible taux de faux positifs, et un coût réduit de déploiement.

Implementation

In this section, we present the evaluation of our intra-domain DDoS mitigation scheme. Then, we describe the process of the implementation and deployment of the Collaboration Contract.

Experimentation validation of intra-domain DDoS Mitigation scheme

In the following, we describe the experimental environment of our intra-domain DDoS mitigation scheme. We implemented I-ES and I-BS as applications on the top of the SDN controller. Using sFlow protocol, I-ES extracts network traffic information and I-BS detects automatically illegitimate traffic inside the domain. To emulate a real network environment, we use mininet [START_REF]Mininet[END_REF], a popular SDN emulation tool. Mininet uses Linux containers and virtual OF-switches (e.g., OpenVswitch [START_REF]Openvswicth[END_REF]) to allow realistic virtual networks of hosts and switches to be constructed using a virtual machine. Mininet is installed on a VirtualBox [START_REF]Virtualbox[END_REF] VM; VM is connected to the Internet through Network Address Translation (NAT) (for software installation and updates), and a host-only adapter is configured on VM to enable it to communicate with the host-system. Additionally, Secure Shell (SSH) is used to allow access to the VM for running different software at the same time. In our testing environment, the network monitor (i.e., sFlow-RT) and the SDN controller (i.e., Floodlight [START_REF]Floodlight[END_REF]) are installed on the host-system and run Ethereum geth client (1.8.20-stable client). We run our experiments on a PC with CPU Intel Core i7-8750H-2.2 GHz and 16GB RAM. Fig. 3.6 shows that our intra-domain DDoS mitigation scheme is implemented in the victim network. In our experiment, we conduct a set of DDoS attacks towards a victim Each OF network contains more than 20 hosts; multiple hosts are simulated to launch the attack towards the victim hosted inside the domain. The rate of the attack varies from 100 to 500 Mbps; the objective is to test the scalability of the proposed solution. The sampling rate used in sFlow is 1/64. For the attack script, Scapy's Python library [START_REF]Scapy[END_REF]

that contain information about the number of connections made to the same host over a series of connections.

Intrusion detection Schemes

Security threats continue to evolve and are becoming more devastating; several intrusion detection schemes have been proposed in the literature to cope with these attacks by integrating ML/DL techniques. In the following, we overview some of the most representative schemes and their limitations. In traditional IDSs, a set of rules (i.e., attack signatures) are used to distinguish between normal and malicious behaviors; any activity that matches the predefined rules is classified as an attack. These IDSs are prone to zero-day attacks and need a continuous update to detect new attacks. The recent advent of ML and DL techniques have revolutionized the security field; several schemes have adopted these techniques to detect intrusions. Zhang et al. [START_REF] Zhang | Random-forests-based network intrusion detection systems[END_REF] proposed a new systematic framework that uses Random Forests (RF), sampling techniques, and a feature selection algorithm to detect network anomalies. In addition, they have employed a new unsupervised outlier detection scheme to improve the overall detection performance. The effectiveness of the proposed framework was evaluated using KDD'99 dataset. Yang et al. [START_REF] Yang | Combined wireless network intrusion detection model based on deep learning[END_REF] proposed a combined network intrusion detection model that uses a deep belief network (DBN), a multi-restricted Boltzmann machine (RBM), a back propagation (BP) network, and support vector machine (SVM) to detect anomalies in wireless networks. Their detection model consists of four modules: (1) a data acquisition module, to select the appropriate dataset from the wireless network; (2) a data pre-treatment module, to transform the dataset (i.e., digitization and normalization); (3) a data analysis module, to split train and test sets; and (4) a detection module, to perform the classification, handle anomalies and store them in a database.

Tao et al. [START_REF] Tao | An improved intrusion detection algorithm based on ga and svm[END_REF] proposed an intrusion detection scheme (FWP-SVM-GA) based on genetic algorithms (GA) and SVM. To improve the training speed of SVM, they used a GA population search strategy. Then, they proposed a new fitness function in order to decrease the SVM error rate while maintaining a high true positive rate. Jan et al. [START_REF] Jan | Toward a lightweight intrusion detection system for the internet of things[END_REF] proposed a lightweight intrusion detection system for anomaly detection in Internet of Things (IoT). They used a packet arrival rate as input to the SVM classifier to detect intrusions in the IoT network. Farahnakian et al. [START_REF] Farahnakian | A deep auto-encoder based approach for intrusion detection system[END_REF] proposed a Deep Auto-Encoder (DAE) approach for intrusion detection systems. To avoid overfitting and local optima, they trained their proposed DAE in a greedy layer wise fashion. They evaluated the effectiveness of DAE using the KDD'99 dataset; they studied the performance of DAE in both binary and multi-class classification. Diro et al. [START_REF] Diro | Distributed attack detection scheme using deep learning approach for internet of things[END_REF] proposed a distributed deep learning (DL) attack detection system in IoT at the fog level. The fog nodes are responsible for training and hosting DL models. They compared the performance of their DL model against shallow ML models in

Implementation

In this section, we present the evaluation of CoFed. First, we introduce the experimental environment. Then, we present the experimental results. Finally, we evaluate the performance of CoFed.

Experimental environment

The implementation of CoFed is done using Pysyft, a generic framework for privacy preserving deep learning, built on top of PyTorch [171]. The deployment of CoFed smart contract is done using truffle framework [START_REF] Truffle | [END_REF], a decentralized application development framework. First, we have coded CoFed smart contract using solidity, a high-level language programming. Afterwards, we have compiled CoFed smart contract into Ethereum Virtual Machine byte code. Once compiled, EVM byte code and Application Binary Interface (ABI) were generated. First, we have deployed CoFed smart contract on a private blockchain using Ganache simulator [START_REF] Ganache | [END_REF], an Ethereum simulator used for testing smart contracts. Afterwards, we have deployed it on Ethereum official test network Ropsten [START_REF]Ropsten[END_REF], an open blockchain platform. We run our experiments on Google Colaboratory [138] using the Tesla T4 GPU on a PC with Intel Core i7-8750H-2.2 GHz, 16GB RAM, and GTX 1050 GPU.

Experimental Results

The performance of CoFed is evaluated using NSL-KDD dataset; Table 5.3 shows some of the samples of this dataset. The 41 values of each sample corresponds to features described in Tables 5.11 and 5.12. Our aim is to build a global model that categorizes each sample as one of the five classes: normal, DoS, probe, R2L, or U2R. The NSL-KDD dataset covers the train set (i.e., N SL -KDDT rain + ) and the test set (i.e., N SL -KDDT est + ) and contains a reasonable number of records in each set. The training dataset contains 22 types of attacks while the test dataset contains 37 types of attacks; these additional new attacks in the test dataset make the detection task more realistic and allow to test if the trained global model can generalize the training data. Table 5.4 shows the total number of records in the train and test datasets and Figs. 5.3(a) and 5.3(b) show, respectively, the NSL-KDD training and testing data class distributions. The NSL-KDD dataset contains 41 features, three of them are categorical/non-numeric (i.e., 'protocol_type', 'service' and 'flag'); 'protocol_type' has three values (i.e., 'tcp', 'udp', and 'icmp') whereas 'service' and 'flag' have, respectively, 70 and 11 distinct values. We encoded 'protocol_type' feature into a numeric form using one hot encoding (i.e., (1,0,0) for 'tcp', (0,1,0) for 'udp', and (0,0,1) for 'icmp'). Similarly, we encoded the two other categorical features (i.e., 'service' and 'flag') into numeric features. Thus, the 41 initial dimensional features are mapped into 122-dimensional features after this transformation. The data distributions of input features of the NSL-KDD dataset vary 5.5). Dropout [START_REF] Srivastava | Dropout: a simple way to prevent neural networks from overfitting[END_REF] is used as regularization technique to prevent overfitting, cross entropy loss function L as in Eq. (5.6.2) is used as loss function; Adam (Adaptive Moment Estimation) [START_REF] Kingma | Adam: A method for stochastic optimization[END_REF], an algorithm for first-order gradient-based optimization, is used as optimizer to minimize the loss function L.

where y j is the ground truth vector for j th class, ŷj is the predicted value for j th class, and N is the number of samples in the batch.

To test CoFed, we defined two different scenarios while considering both multi-class classification and binary classification in each scenario: (1) Scenario 1: we divide the NSL-KDD train set between collaborators in such a way that each collaborator will have a subset of each attack type; and (2) Scenario 2: we divide the NSL-KDD train set between collaborators in such a way that each collaborator will have a type of attack; in this second scenario, we aim to test the effectiveness of our proposed solution when the distribution of classes is not uniform i.e., imbalanced dataset (see Fig. 5.3). In both scenarios, we randomly initialize global model parameters. Then, we send the global model to each of the four collaborators (i.e., SDN1, SDN2, SDN3, and SDN4 see Fig. 5

Host-based traffic features

Dst-hostcount

Continuous

The Feature Count for destination host. 33.

Dst-hostsrv-count

Continuous

The Feature Srv-count for destination host. 34.

Dst-hostsame-srv-rate

Continuous

The Feature Same-srv-rate for destination host.

35.

Dst-hostdiff-srv-rate

Continuous

The Feature Diff-srv-rate for destination host. 36.Dst-hostsame-src-portrate

Continuous

The Feature Same-src-port-rate for destination host.

37.

Dst-hostsrv-diff-hostrate

Continuous

The Feature Diff-host-rate for destination host.

Dst-hostserror-rate

Continuous

The Feature Serror-rate for destination host. 39.

Dst-hostsrv-serror-rate

Continuous

The Feature Srv-serror-rate for destination host. 40.

Dst-hostrerror-rate

Continuous

The Feature Rerror-rate for destination host. 41.

Dst-hostsrv-rerror-rate

Continuous

The Feature Srv-serror-rate for destination host.