CoWatch: Collaborative Prediction of DDoS Attacks in Edge Computing with Distributed SDN

With the development of Edge Computing (EC), security issues have raised concerns. Due to the unusual vulnera-bility of EC servers and the distributed nature of attack sources, it is a great challenge to efficiently and effectively defend against DDoS attacks. Existing detection solutions, based on the feedback of servers under the attacks, can incur high bandwidth costs and degradation of service performance. To address this problem, we propose a novel collaborative prediction framework, called CoWatch. Based on the distributed software-defined network (SDN), the CoWatch framework can collaboratively predict the DDoS attacks towards the EC servers and detect the attack flows near the attack source in time. To efficiently filter the suspicious flows in distributed SDN, we design an optimal threshold model by balancing the trade-off between collaboration efficiency and prediction effectiveness. We also explore the prototypical LSTM network to design an LSTM-based Collaborative Prediction (LCP) algorithm, which can effectively predict and detect DDoS attacks. Experiment results demonstrate the effectiveness of the prediction and detection of DDoS attacks and validate the efficiency of flow information synchronization in distributed SDN.