Deep Learning based Bursty Traffic Discrimination and Management using Sandpile Model

Abstract

The significant advancements in internet technologies and applications have resulted in a substantial increase in network traffic volume, presenting considerable challenges for network management. The management of bursty traffic, in particular, poses difficulties, as it can originate from both legitimate and malicious sources. To ensure the continuity of normal network operations, it is critical to distinguish between genuine and attack traffic, preventing the blockage of legitimate traffic. This study proposes a framework for detecting and managing bursty traffic within Software-Defined Networking (SDN) environments. A deep learning-based approach is applied to differentiate between Distributed Denial of Service (DDoS) and flash traffic, utilizing the BiLSTM algorithm for its high classification accuracy. This approach uses the Markov Modulated Poisson Process (MMPP) to generate flash traffic, which is then integrated with the CIC-DDoS2019 dataset. For traffic management, a drop mechanism is applied to DDoS traffic, while the Bak-Tang-Wiesenfeld (BTW) Sandpile load balancing algorithm is utilized for managing flash traffic. The proposed Sandpile-based load balancing approach significantly reduces round-trip time by 93% and packet loss by 98.4%, while improving bandwidth availability by 94.5%. Thus the proposed approach combines deep learning for precise traffic classification with a dynamic, self-organizing load-balancing mechanism, offering an efficient and novel solution for managing bursty traffic in real-time network environments.