A Lucid Solution: Online Machine Learning for DDoS Attack Detection in Programmable Switches

Abstract

Distributed Denial-of-Service (DDoS) attacks are cyberattacks in which a malicious actor floods a service, server, or network with illegitimate internet traffic. The malicious actor uses multiple systems, such as a network of devices with unique IP addresses, to carry out this distributed attack. DDoS attacks prevent legitimate users from being served, and compromise the performance and reliability of modern computer networks such as cloud datacenters. Machine Learning (ML) is increasingly being used in DDoS attack detection, which aims to distinguish malicious DDoS traffic from benign traffic. We identify three key challenges faced by in-network systems that use ML for DDoS attack detection. First, it is critical that the system has both high performance and low latency. Second, the system must continuously monitor for concept drift: the event in which the ML model in the system becomes ineffective at detecting attacks due to massive changes in the traffic distribution. The ML model must be updated if concept drift occurs. Third, these in-network systems often use languages that are widely known to be difficult and verbose, such as P4, which leads to delays in development. We propose a system design which would use Lucid, a Domain Specific Language (DSL) developed in Princeton, to implement a decision tree on programmable switches. This system would utilize 2-Way D-Left hashing for stateful feature tracking, an SRAM array to encode the decision tree's rules, and concept drift detection directly on the switch using an algorithm adapted from Exponentially Weighted Moving Average (EWMA). Our Proof-of-Concept system utilizes a pruned decision tree of 92% test accuracy and 13 nodes. We demonstrate that our Lucid implementation is compatible with standard programmable switches. Our Lucid implementation requires 20 ~ 30 times fewer lines of code than the equivalent implementation in P4.