Entropy-based DDoS Attack Detection in SDN using Dynamic Threshold

Hemmati, Zahra; Mirjalily, Ghasem; Mohtajollah, Zahra

doi:10.1109/icspis54653.2021.9729355

Cited by 3 publications

(1 citation statement)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To address the issue of the low detection accuracy associated with static threshold detection based on information entropy, Zahra et al [19] proposed a method that utilizes a dynamic threshold setting in information entropy detection. This method collects entropy values in each period, divides them into normal entropy values and attack entropy value sets based on their relationship with the threshold, and updates the entropy threshold based on the mean and standard deviation of the two sets.…”

Section: Information Entropy-based Ddos Attack Detection Technologymentioning

confidence: 99%

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

Su,

Xiong,

Qian

et al. 2024

Electronics

View full text Add to dashboard Cite

The widespread adoption of software-defined networking (SDN) technology has brought revolutionary changes to network control and management. Compared to traditional networks, SDN enhances security by separating the control plane from the data plane and replacing the traditional network architecture with a more flexible one. However, due to its inherent architectural flaws, SDN still faces new security threats. This paper expounds on the architecture and security of SDN, analyzes the vulnerabilities of SDN architecture, and introduces common distributed denial of service (DDoS) attacks within the SDN architecture. This article also provides a review of the relevant literature on DDoS attack detection and mitigation in the current SDN environment based on the technologies used, including statistical analysis, machine learning, policy-based, and moving target defense techniques. The advantages and disadvantages of these technologies, in terms of deployment difficulty, accuracy, and other factors, are analyzed. Finally, this study summarizes the SDN experimental environment and DDoS attack traffic generators and datasets of the reviewed literature and the limitations of current defense methods and suggests potential future research directions.

show abstract

Section: Information Entropy-based Ddos Attack Detection Technologymentioning

confidence: 99%

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

Su,

Xiong,

Qian

et al. 2024

Electronics

View full text Add to dashboard Cite

show abstract

A Two-level DDoS attack Detection using Entropy and Machine Learning in SDN

Puranik,

Patil,

Ghaligi

et al. 2023

2023 3rd International Conference on Intelligent Technologies (CONIT)

View full text Add to dashboard Cite

Renyi entropy-driven network traffic anomaly detection with dynamic threshold

Yu,

Yang,

Cui

et al. 2024

Cybersecurity

View full text Add to dashboard Cite

Network traffic anomaly detection is a critical issue in network security. Existing Abnormal traffic detection methods rely on statistical-based or anomaly-based approaches, and these detection methods all require a full understanding of traffic characteristics and attack patterns. Information entropy has been widely studied in abnormal traffic detection because it can describe the distribution characteristics of network traffic. However, this method makes it difficult to cope with the timing and variability of network traffic. To address these challenges, this paper proposes a network traffic anomaly detection method based on Renyi entropy. Simultaneously, we introduce a fixed time window and utilize an improved EWMA model within this window to dynamically set thresholds for anomaly detection. Experimental results show that the method proposed in this paper is superior to popular abnormal traffic detection methods in terms of effectiveness and efficiency, it is better adapted to the dynamic changes of network traffic and provides a more reliable solution for anomaly detection.

show abstract

Entropy-based DDoS Attack Detection in SDN using Dynamic Threshold

Cited by 3 publications

References 13 publications

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

A Two-level DDoS attack Detection using Entropy and Machine Learning in SDN

Renyi entropy-driven network traffic anomaly detection with dynamic threshold

Contact Info

Product

Resources

About