Abstract: Accurate and fast detection of distributed denial of service (DDoS) attacks is an important research topic in the security field. In order to improve the detection rate of DDoS attacks in Software-Defined Networking (SDN), XGBoost is used to model the traffic in the network. According to the traffic information when the attack occurs, this method can extract features and train a model, which can effectively detect DDoS attacks. In experiments, mininet and floodlight are used to build SDN environment, and HPing3 is used to generate abnormal network traffic results show that the average accuracy of this method is 95.34% when detecting DDoS attacks in SDN, which is higher than other machine learning methods, which proves the effectiveness of this method.

Key words: DDoS, software defined networking, XGBoost, machine learning;feature extraction

摘要： 准确且快速地检测分布式拒绝服务（DDoS）攻击是安全领域的一个重要研究课题，为了提高软件定义网络（SDN）中DDoS攻击的检测率，采用XGBoost算法来对网络中的流量进行建模．该方法根据攻击发生时的流量信息提取特征并进行训练，能够有效的检测DDoS攻击．在实验中，采用mininet和floodlight模拟平台搭建SDN环境，使用HPing3来生成不正常的网络流量．实验结果表明，在SDN中进行DDoS攻击检测时，该方法平均准确率为95.34%，与其他机器学习方法相比准确率更高，这证明了该方法的有效性．

关键词: 分布式拒绝服务攻击检测, 软件定义网络, XGBoost, 机器学习, 特征提取