Intelligent Network Element: A Programmable Switch Based on Machine Learning to Defend Against DDoS Attacks

Abstract

The proposed native intelligent network by 6G networks has provided a boost to network security capabilities. Unlike intelligent networks built by intelligent network elements, plug-in AI applications require transmission bandwidth for traffic analysis and consume computation and storage resources of security devices. This cannot meet the real-time requirements for detecting and processing DDoS attacks. This paper proposes the intelligent network element that combines programmable switch technology and AI algorithms. The intelligent network element is used to build a distributed intelligent network defense system that analyzes the packet header information of the traffic to classify the packets, thus realizing network intelligence at the network layer. We analyzes a total of 14 types of DDoS attack traffic categorized into application layer DDoS, low-rate DDoS, and DRDoS. The machine learning model is used to sink to the network layer.In conclusion, the performance of the k-means, random forest, and decision tree algorithms is evaluated by comparing the performance of single-point and multi-point deployment scenarios on intelligent network elements in multiple dimensions. The results demonstrate that the multi-point intelligent network element system can reduce the packet loss rate by approximately 10% when the client transmits packets at a rate of 1000 pkts/s, while exhibiting a slight increase in resource consumption. This enables the intelligent network element detection accuracy to reach 98.03%.