An SDN System for Intelligent Botnet Behavior Suppression

Abstract

In recent years, with the widespread application of the Internet of Things (IoT), its coverage has expanded to encompass numerous devices and communication entities. However, with the proliferation of these services, hackers resort to various means to infiltrate computer systems for the purpose of stealing valuable information or extortion, turning them into Botnet. Furthermore, hackers can utilize these botnets to launch Distributed Denial of Service (DDoS) attacks against target devices, depleting the resources of the target system, thereby rendering services unusable. Therefore, there is an urgent need to develop an effective mechanism to prevent such attacks. In our research, we introduce a DDoS detection model that is based on the ELK (Elasticsearch, Logstash, Kibana) system and incorporates the Federated Learning (FL) framework. The model is designed for internal traffic inspection, and ensuring data privacy through the utilization of FL, thereby eliminating the need for data sharing among different IoT devices during the training process. Following the identification and prevention of Botnet hosts and DDoS attacks, automated responses are executed via Software-Defined Networking (SDN) systems. This approach not only proposes a more efficient intelligent system but also alleviates the workload on network management personnel.