How ayush-learner44/thesis works
This repository is a Mininet/BMv2 testbed for distributed SYN-flood detection in a fat-tree fabric. Operators boot the topology, start the controller, and launch benign or attack traffic from client hosts toward server hosts. Edge switches spray flowlets, aggregation switches emit detector digests, and the controller combines evidence across switches, scores flows, and installs fabric-wide blocks; a separate cardinality monitor flags spoofed-source victims. Servers run nginx and packet capture; verification compares captures and run labels with controller decisions. README documents these capabilities; controller details are sampled only in part.
Main entry points: controller.py P4Runtime controller · ddos_detector.p4 Aggregation detector · network.py Fabric bootstrap · launch.py Traffic scenarios
Components 22
Fabric setup
- Fabric bootstrap
network.py - Fat-tree topology
lib/fattree.py
Switch dataplane
- Core forwarding
p4src/ft_core.p4 - Edge flowlet spray
p4src/ft_edge.p4 - Aggregation detector
p4src/ddos_detector.p4
Detection control
- P4Runtime controller
controller.py - Flow reputation
controller.py - Lean classifier
controller.py - Trained model
models/lean_model.pkl - Spoof cardinality monitor
controller.py
Traffic and service
- Traffic scenarios
launch.py - SYN traffic generator
lib/attack.py - nginx and capture
server.py - nginx configuration
lib/nginx_ft.conf
Run verification
- Run verification
lib/verify.py
Other components
- Operator
- Mininet fabric
- Client hosts
- Server hosts
- Server packet captures
- Run role labels
- Controller evaluation CSV
Connections 38
- Operator → Fabric bootstrap: boots
- Fabric bootstrap → Fat-tree topology: uses topology
- Fabric bootstrap → Mininet fabric: configures fabric
- Fabric bootstrap → Core forwarding: programs core
- Fabric bootstrap → Edge flowlet spray: programs edges
- Fabric bootstrap → Aggregation detector: programs aggregations
- Fabric bootstrap → nginx and capture: starts servers
- Mininet fabric → Client hosts: hosts
- Mininet fabric → Server hosts: hosts
- Client hosts → Edge flowlet spray: send traffic
- Edge flowlet spray → Aggregation detector: spray uplinks
- Aggregation detector → Core forwarding: forward packets
- Core forwarding → Aggregation detector: forward packets
- Aggregation detector → Server hosts: deliver packets
- Operator → P4Runtime controller: starts controller
- P4Runtime controller → Fat-tree topology: loads routes
- P4Runtime controller → Mininet fabric: connects P4Runtime
- P4Runtime controller → Aggregation detector: enables digests
- Aggregation detector → P4Runtime controller: send digests
- P4Runtime controller → Flow reputation: updates flow evidence
- P4Runtime controller → Lean classifier: scores windows
- Lean classifier → Trained model: predicts with
- P4Runtime controller → Spoof cardinality monitor: tracks completions
- Spoof cardinality monitor → P4Runtime controller: reports suspects
- P4Runtime controller → Aggregation detector: installs block rules
- Operator → Traffic scenarios: chooses scenario
- Traffic scenarios → Client hosts: launches traffic
- Traffic scenarios → SYN traffic generator: invokes flooder
- SYN traffic generator → Server hosts: sends SYNs
- nginx and capture → Server hosts: runs on
- nginx and capture → nginx configuration: loads config
- nginx and capture → Server packet captures: writes captures
- Traffic scenarios → Run role labels: writes roles
- P4Runtime controller → Controller evaluation CSV: writes decisions
- Operator → Run verification: scores run
- Run verification → Server packet captures: reads captures
- Run verification → Run role labels: reads roles
- Run verification → Controller evaluation CSV: reads decisions