Detection of DDoS Attacks in Software Defined Networking Using Entropy

Abstract

Software Defined Networking (SDN) is one of the most commonly used network architectures in recent years. With the substantial increase in the number of Internet users, network security threats appear more frequently, which brings more concerns to SDN. Distributed denial of Service (DDoS) attacks are one of the most dangerous and frequent attacks in software defined networks. The traditional attack detection method using entropy has some defects such as slow attack detection and poor detection effect. In order to solve this problem, this paper proposed a method of fusion entropy, which detects attacks by measuring the randomness of network events. This method has the advantages of fast attack detection speed and obvious decrease in entropy value. The complementarity of information entropy and log energy entropy is effectively utilized. The experimental results show that the entropy value of the attack scenarios 91.25% lower than normal scenarios, which has greater advantages and significance compared with other attack detection methods.

Renyi Joint Entropy-Based Dynamic Threshold Approach to Detect DDoS Attacks against SDN Controller with Various Traffic Rates

“…Meanwhile, the proposed approach's performance was compared with two existing approaches dependent on the entropy algorithm [28], the fusion entropy algorithm [32], and information theory [34]. Since the entropy technique is the basis for all entropy-based methods, those approaches share the same common limitations.…”

“…The rest of this section first discusses the performance of the approaches [28,32,34] in detecting low and high DDoS attack traffic rates, regardless of whether the target is a single or multiple victims, then compares the results with the proposed approach. Table 5 compares the DR and FPR for all eight attack scenarios.…”

“…The experiments were performed on the proposed approach and the existing approaches [28,32] to prove the proposed approach could accurately detect low-and high-rate DDoS attacks on SDN controllers by single or multiple attackers regardless of whether the target is a single victim or multiple victims with high DR, without adding significant overhead to the SDN controller.…”

“…Fan et al [32] proposed a fusion entropy method for computing network traffic randomness to detect DDoS attacks in the SDN network environment. A dataset was used to evaluate and test the proposed approach.…”

Techniques for DDoS Attack in SDN: A Comparative Study

“…The DDoS attributes attack inside an SDN environment is placidly various from that at conventional networks. According to [2], the differences between DDoS attacks in classic networks and SDNs represents as follows; in classic networks, the DDoS attackers focus on destination servers, while in SDN, the DDoS attackers aim for the controller. The principal objective is to ensure the controller resources are not available by failing an SDN single point.…”