Methods and apparatuses for determining security attacks in software-defined networks

1 . A method performed by a controller in a wireless communication system for determining a security attack, the method comprising:

obtaining a first statistics based on an amount of messages received from at least one packet forwarding entity within a pre-defined time interval, t, wherein the first statistics is a time-domain data;

obtaining a second statistics based on at least one arriving-time difference, T d , between two consecutive messages;

detecting an anomaly based on the second statistics;

determining, if the anomaly is detected, a security attack based on the first statistics;

initiating a security attack notification to an orchestrator; and

comparing, in the step of detecting the anomaly, the obtained single arriving-time difference, T d , with an obtained pre-trained threshold value, TH, wherein the anomaly is detected, if the single arriving-time difference, T d , is less than the pre-trained threshold value, TH,

wherein the pre-trained threshold value, TH, is an intersection point of an empirical probability distribution curve obtained from a set of arriving-time difference, T d , in a pre-trained normal packet traffic and an empirical probability distribution curve obtained from a set of arriving-time difference, T d , in a pre-trained attack packet traffic.

2 . The method of claim 1 , further comprising:

comparing, in the step of detecting the anomaly, an obtained probability distribution of a set of arriving-time difference, T d , with a probability distribution of a set of arriving-time difference, T d , obtained in the pre-trained normal packet traffic.

3 . The method of claim 2 , wherein the obtained probability distributions are one of Cumulative Distribution Function, CDF, or Probability Distribution Function, PDF.

4 . The method of claim 3 , wherein logarithmic values of arriving-time difference, T d , are used for the obtained probability distributions.

5 . The method of claim 1 , further comprising:

comparing, in the step of determining the security attack, an obtained probability distribution of frequency-domain data with at least one of a probability distribution of frequency-domain data obtained in the pre-trained normal packet traffic or in the pre-trained attack packet traffic.

6 . The method of claim 5 , wherein the frequency-domain data are obtained by applying Discrete Fourier Transform, DFT, to the first statistics.

7 . The method of claim 6 , wherein a machine learning, ML, model or a statistical inference, STAT, model is trained with the probability distributions of frequency-domain data obtained in the pre-trained normal and in the pre-trained attack packet traffic.

8 . The method of claim 1 , wherein the messages received from the at least one packet forwarding entity within the pre-defined time interval, t, are Packet-In messages encapsulated as packets according to a protocol employed by the controller.

9 . The method of claim 8 , wherein the protocol employed by the controller is an OpenFlow, OF, protocol to communicate with the at least one packet forwarding entity.

10 . The method of claim 1 , wherein the at least one packet forwarding entity is a physical or a virtual OpenFlow, OF, switch.

11 . The method of claim 1 , wherein the controller in the wireless communication system for determining the security attack is a Software-Defined Networking, SDN, controller.

12 . The method of claim 11 , wherein the security attack determined by the Software-Defined Networking, SDN, controller in the wireless communication system is a Distributed Denial of Service, DDoS, attack.

13 . A controller for determining a security attack in a wireless communication system, configured to:

obtain a first statistics based on an amount of messages received from at least one packet forwarding entity within a pre-defined time interval, t, wherein the first statistics is a time-domain data;

obtain a second statistics based on at least one arriving-time difference, Ta, between two consecutive messages;

detect an anomaly based on the second statistics;

determine, if the anomaly is detected, a security attack based on the first statistics;

initiate a security attack notification to an orchestrator; and

compare, in the step of detecting the anomaly, the obtained single arriving-time difference, T d , with an obtained pre-trained threshold value, TH, wherein the anomaly is detected, if the single arriving-time difference, T d , is less than the pre-trained threshold value, TH,

wherein the pre-trained threshold value, TH, is an intersection point of an empirical probability distribution curve obtained from a set of arriving-time difference, T d , in a pre-trained normal packet traffic and an empirical probability distribution curve obtained from a set of arriving-time difference, T d , in a pre-trained attack packet traffic.

14 . The controller of claim 13 , further configured to:

compare, in the step of detecting the anomaly, an obtained probability distribution of a set of arriving-time difference, T d , with a probability distribution of a set of arriving-time difference, T d , obtained in the pre-trained normal packet traffic.

15 . The controller of claim 14 , wherein the obtained probability distributions are one of Cumulative Distribution Function, CDF, or Probability Distribution Function, PDF.

16 . The controller of claim 15 , wherein logarithmic values of arriving-time difference, T d , are used for the obtained probability distributions.