  The possibility of programming the control and data planes, enabled by the
Software-Defined Networking (SDN) paradigm, represents a fertile ground on top
of which novel operation and management mechanisms can be fully explored, being
Distributed Denial of Service (DDoS) attack detection based on machine learning
techniques the focus of this work. To carry out the detection, this paper
proposes ORACLE: cOllaboRation of dAta and Control pLanEs to detect DDoS
attacks, an architecture that promotes the coordination of control and data
planes to detect network attacks. As its first contribution, this architecture
delegates to the data plane the extraction and processing of traffic
information collected per flow. This is done in order to ease the calculation
and classification of the feature set used in the attack detection, as the
needed flow information is already processed when it arrives at the control
plane. Besides, as the second contribution, this architecture breaks the
limitations to calculate some features that are not possible to implement in a
traditional OpenFlow-based environment. In the evaluation of ORACLE, we
obtained up to 96% of accuracy in the testing phase, using a K-Nearest Neighbor
model.
