{"id":"https://openalex.org/W3081430061","doi":"https://doi.org/10.1109/access.2020.3019330","title":"A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning","display_name":"A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning","publication_year":2020,"publication_date":"2020-01-01","ids":{"openalex":"https://openalex.org/W3081430061","doi":"https://doi.org/10.1109/access.2020.3019330","mag":"3081430061"},"language":"en","primary_location":{"id":"doi:10.1109/access.2020.3019330","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.3019330","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09177002.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09177002.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5031091191","display_name":"Jes\u00fas Arturo P\u00e9rez-D\u00edaz","orcid":"https://orcid.org/0000-0002-7678-5487"},"institutions":[{"id":"https://openalex.org/I98461037","display_name":"Tecnol\u00f3gico de Monterrey","ror":"https://ror.org/03ayjn504","country_code":"MX","type":"education","lineage":["https://openalex.org/I98461037"]}],"countries":["MX"],"is_corresponding":false,"raw_author_name":"Jesus Arturo Perez-Diaz","raw_affiliation_strings":["Escuela de Ingenier\u00eda y Ciencias, Tecnologico de Monterrey, Monterrey, M\u00e9xico","Escuela de Ingenieria y Ciencias, Tecnologico de Monterrey, Monterrey, Mexico"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Escuela de Ingenier\u00eda y Ciencias, Tecnologico de Monterrey, Monterrey, M\u00e9xico","institution_ids":["https://openalex.org/I98461037"]},{"raw_affiliation_string":"Escuela de Ingenieria y Ciencias, Tecnologico de Monterrey, Monterrey, Mexico","institution_ids":["https://openalex.org/I98461037"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058211217","display_name":"Ismael Amezcua Valdovinos","orcid":"https://orcid.org/0000-0002-2661-513X"},"institutions":[{"id":"https://openalex.org/I916541031","display_name":"Universidad de Colima","ror":"https://ror.org/04znxe670","country_code":"MX","type":"education","lineage":["https://openalex.org/I916541031"]}],"countries":["MX"],"is_corresponding":false,"raw_author_name":"Ismael Amezcua Valdovinos","raw_affiliation_strings":["Facultad de Telem\u00e1tica, Universidad de Colima, Colima, M\u00e9xico","Facultad de Telem\u00e1tica, Universidad de Colima, Colima, Mexico"],"raw_orcid":"https://orcid.org/0000-0002-2661-513X","affiliations":[{"raw_affiliation_string":"Facultad de Telem\u00e1tica, Universidad de Colima, Colima, M\u00e9xico","institution_ids":["https://openalex.org/I916541031"]},{"raw_affiliation_string":"Facultad de Telem\u00e1tica, Universidad de Colima, Colima, Mexico","institution_ids":["https://openalex.org/I916541031"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001746807","display_name":"Kim\u2010Kwang Raymond Choo","orcid":"https://orcid.org/0000-0001-9208-5336"},"institutions":[{"id":"https://openalex.org/I45438204","display_name":"The University of Texas at San Antonio","ror":"https://ror.org/01kd65564","country_code":"US","type":"education","lineage":["https://openalex.org/I45438204"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kim-Kwang Raymond Choo","raw_affiliation_strings":["Department of Computer Science, The University of Texas at San Antonio, San Antonio, USA","Department of Information Systems and Cyber Security, The University of Texas at San Antonio, San Antonio, USA","Department of Information Systems and Cyber Security, The University of Texas at San Antonio, San Antonio, TX, USA#TAB#"],"raw_orcid":"https://orcid.org/0000-0001-9208-5336","affiliations":[{"raw_affiliation_string":"Department of Computer Science, The University of Texas at San Antonio, San Antonio, USA","institution_ids":["https://openalex.org/I45438204"]},{"raw_affiliation_string":"Department of Information Systems and Cyber Security, The University of Texas at San Antonio, San Antonio, USA","institution_ids":["https://openalex.org/I45438204"]},{"raw_affiliation_string":"Department of Information Systems and Cyber Security, The University of Texas at San Antonio, San Antonio, TX, USA#TAB#","institution_ids":["https://openalex.org/I45438204"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5012210223","display_name":"Dakai Zhu","orcid":"https://orcid.org/0000-0002-1938-9947"},"institutions":[{"id":"https://openalex.org/I45438204","display_name":"The University of Texas at San Antonio","ror":"https://ror.org/01kd65564","country_code":"US","type":"education","lineage":["https://openalex.org/I45438204"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dakai Zhu","raw_affiliation_strings":["Department of Computer Science, The University of Texas at San Antonio, San Antonio, USA","Dept. of Computer Science, The University of Texas at San Antonio, San Antonio, TX, USA"],"raw_orcid":"https://orcid.org/0000-0002-1938-9947","affiliations":[{"raw_affiliation_string":"Department of Computer Science, The University of Texas at San Antonio, San Antonio, USA","institution_ids":["https://openalex.org/I45438204"]},{"raw_affiliation_string":"Dept. of Computer Science, The University of Texas at San Antonio, San Antonio, TX, USA","institution_ids":["https://openalex.org/I45438204"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":25.6472,"has_fulltext":true,"cited_by_count":308,"citation_normalized_percentile":{"value":0.9976827,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":"8","issue":null,"first_page":"155859","last_page":"155872"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8707029819488525},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.8466449975967407},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6143465638160706},{"id":"https://openalex.org/keywords/software-defined-networking","display_name":"Software-defined networking","score":0.5941898226737976},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.5166652202606201},{"id":"https://openalex.org/keywords/application-layer-ddos-attack","display_name":"Application layer DDoS attack","score":0.5155722498893738},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.43582484126091003},{"id":"https://openalex.org/keywords/testbed","display_name":"Testbed","score":0.42678138613700867},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.42280739545822144},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.39067038893699646},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.37021586298942566},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.33097827434539795},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.27855777740478516},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.25353309512138367}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8707029819488525},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.8466449975967407},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6143465638160706},{"id":"https://openalex.org/C77270119","wikidata":"https://www.wikidata.org/wiki/Q1655198","display_name":"Software-defined networking","level":2,"score":0.5941898226737976},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.5166652202606201},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.5155722498893738},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.43582484126091003},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.42678138613700867},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.42280739545822144},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.39067038893699646},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.37021586298942566},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33097827434539795},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.27855777740478516},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.25353309512138367}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2020.3019330","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.3019330","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09177002.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:7606b3e3e34749edb7e8e747b5beae3f","is_oa":true,"landing_page_url":"https://doaj.org/article/7606b3e3e34749edb7e8e747b5beae3f","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 8, Pp 155859-155872 (2020)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2020.3019330","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2020.3019330","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8948470/09177002.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3711256975","display_name":null,"funder_award_id":"519RT0580","funder_id":"https://openalex.org/F4320325124","funder_display_name":"CYTED Ciencia y Tecnolog\u00eda para el Desarrollo"}],"funders":[{"id":"https://openalex.org/F4320310677","display_name":"University of Texas at San Antonio","ror":"https://ror.org/01kd65564"},{"id":"https://openalex.org/F4320323037","display_name":"Instituto Tecnol\u00f3gico y de Estudios Superiores de Monterrey","ror":"https://ror.org/03ayjn504"},{"id":"https://openalex.org/F4320325124","display_name":"CYTED Ciencia y Tecnolog\u00eda para el Desarrollo","ror":"https://ror.org/03myqtf56"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3081430061.pdf","grobid_xml":"https://content.openalex.org/works/W3081430061.grobid-xml"},"referenced_works_count":59,"referenced_works":["https://openalex.org/W1152223117","https://openalex.org/W1508882636","https://openalex.org/W1518702348","https://openalex.org/W1660261345","https://openalex.org/W1680354096","https://openalex.org/W1966809779","https://openalex.org/W1984922480","https://openalex.org/W2023253374","https://openalex.org/W2027038743","https://openalex.org/W2035536878","https://openalex.org/W2040340473","https://openalex.org/W2063625716","https://openalex.org/W2089367555","https://openalex.org/W2105934661","https://openalex.org/W2119227347","https://openalex.org/W2128599397","https://openalex.org/W2130583399","https://openalex.org/W2137345105","https://openalex.org/W2139836766","https://openalex.org/W2150093579","https://openalex.org/W2158733823","https://openalex.org/W2165976789","https://openalex.org/W2177270872","https://openalex.org/W2212753854","https://openalex.org/W2299450638","https://openalex.org/W2308983626","https://openalex.org/W2336887547","https://openalex.org/W2338598777","https://openalex.org/W2507290484","https://openalex.org/W2577968487","https://openalex.org/W2610817200","https://openalex.org/W2765220306","https://openalex.org/W2775047245","https://openalex.org/W2775132284","https://openalex.org/W2790522845","https://openalex.org/W2798603998","https://openalex.org/W2799843691","https://openalex.org/W2820900234","https://openalex.org/W2888795148","https://openalex.org/W2899374119","https://openalex.org/W2908633404","https://openalex.org/W2911964244","https://openalex.org/W2963936979","https://openalex.org/W2965148303","https://openalex.org/W2967136126","https://openalex.org/W2973528622","https://openalex.org/W2978866625","https://openalex.org/W2979998718","https://openalex.org/W2989747861","https://openalex.org/W2990309507","https://openalex.org/W2999113954","https://openalex.org/W3007603430","https://openalex.org/W3008243670","https://openalex.org/W3013210424","https://openalex.org/W3016554829","https://openalex.org/W4213107800","https://openalex.org/W6630417872","https://openalex.org/W6631284866","https://openalex.org/W6766546739"],"related_works":["https://openalex.org/W2360429410","https://openalex.org/W2204131204","https://openalex.org/W2383770723","https://openalex.org/W2898696280","https://openalex.org/W2958385475","https://openalex.org/W2921433547","https://openalex.org/W2783466926","https://openalex.org/W4286539397","https://openalex.org/W2370216173","https://openalex.org/W3091388705"],"abstract_inverted_index":{"While":[0],"there":[1],"have":[2],"been":[3],"extensive":[4],"studies":[5],"of":[6,8,57,104,122,190],"denial":[7],"service":[9],"(DoS)":[10],"attacks":[11,17,27,59,179],"and":[12,55,91,96,195],"DDoS":[13,25],"attack":[14],"mitigation,":[15],"such":[16],"remain":[18],"challenging":[19],"to":[20,30,33,158,162],"mitigate.":[21],"For":[22],"example,":[23],"Low-Rate":[24],"(LR-DDoS)":[26],"are":[28],"known":[29],"be":[31,159],"difficult":[32],"detect,":[34],"particularly":[35],"in":[36,42,60,71,127,135,152,193],"a":[37,47,119],"software-defined":[38],"network":[39,142],"(SDN).":[40],"Hence,":[41],"this":[43],"paper":[44],"we":[45,64,138],"present":[46],"flexible":[48],"modular":[49],"architecture":[50,73,192],"that":[51,115,134],"allows":[52],"the":[53,66,101,112,125,140,172,183,188],"identification":[54],"mitigation":[56],"LR-DDoS":[58,197],"SDN":[61],"settings.":[62],"Specifically,":[63],"train":[65],"intrusion":[67,173],"detection":[68,120,175],"system":[69,144,176],"(IDS)":[70],"our":[72,116,136,155,169,191],"using":[74,100],"six":[75],"machine":[76,151],"learning":[77],"(ML)":[78],"models":[79],"(i.e.,":[80],"J48,":[81],"Random":[82,86],"Tree,":[83,85],"REP":[84],"Forest,":[87],"Multi-Layer":[88],"Perceptron":[89],"(MLP),":[90],"Support":[92],"Vector":[93],"Machines":[94],"(SVM))":[95],"evaluate":[97],"their":[98],"performance":[99],"Canadian":[102],"Institute":[103],"Cybersecurity":[105],"(CIC)":[106],"DoS":[107],"dataset.":[108],"The":[109],"findings":[110],"from":[111],"evaluation":[113],"demonstrate":[114],"approach":[117],"achieves":[118],"rate":[121],"95%,":[123],"despite":[124],"difficulty":[126],"detecting":[128],"LR-DoS":[129],"attacks.":[130,198],"We":[131],"also":[132],"remark":[133],"deployment,":[137],"use":[139],"open":[141],"operating":[143],"(ONOS)":[145],"controller":[146],"running":[147],"on":[148],"Mininet":[149],"virtual":[150],"order":[153],"for":[154],"simulated":[156],"environment":[157],"as":[160,166],"close":[161],"real-world":[163],"production":[164],"networks":[165],"possible.":[167],"In":[168],"testing":[170],"topology,":[171],"prevention":[174],"mitigates":[177],"all":[178],"previously":[180],"detected":[181],"by":[182],"IDS":[184],"system.":[185],"This":[186],"demonstrates":[187],"utility":[189],"identifying":[194],"mitigating":[196]},"counts_by_year":[{"year":2026,"cited_by_count":21},{"year":2025,"cited_by_count":54},{"year":2024,"cited_by_count":67},{"year":2023,"cited_by_count":76},{"year":2022,"cited_by_count":53},{"year":2021,"cited_by_count":36},{"year":2020,"cited_by_count":1}],"updated_date":"2026-07-09T07:52:08.696243","created_date":"2025-10-10T00:00:00"}