Analisis dan Mitigasi Serangan Distributed Denial of Service (DDoS) Menggunakan Metode Machine Learning Berbasis Deteksi Anomali

Abstract

Distributed Denial of Service (DDoS) attacks, particularly Volumetric DDoS, pose a serious threat to network infrastructure by disrupting service availability through traffic flooding. Signature-based defense approaches are often less effective in detecting new and adaptive attack patterns. This study aims to implement a Random Forest algorithm based on anomaly detection and evaluate the effectiveness of automated mitigation in a Software-Defined Networking (SDN) architecture in real time. The study employed a quantitative experiment based on network simulation. The model was trained using the CICIDS2017 dataset with stratified random sampling of 300,000 data rows. Network traffic features were normalized using Min-Max Scaler to optimize classification performance. The validated model was exported in pickle (.pkl) format and integrated into the Ryu Controller as a hybrid defense mechanism combined with a volumetric threshold. The simulation was conducted using the Mininet emulator with a single-switch topology and an ICMP Flood/Ping Flood attack scenario. The results showed that Random Forest achieved an accuracy of 99.80% during test data evaluation. Real-time testing in the SDN environment achieved a mitigation success rate of 99.79%, reducing attack traffic from 22,358 packets to only 48 packets reaching the target through automatic injection of DROP rules based on OFPFlowMod messages. The integration of machine learning and SDN effectively provides protection against Volumetric DDoS attacks with minimal mitigation response delay.