A software-defined network (SDN) brings a lot of advantages to the world of networking through flexibility and centralized management; however, this centralized control makes it susceptible to different types of attacks. Distributed denial of service (DDoS) is one of the most dangerous attacks that are frequently launched against the controller to put it out of service. This work takes the special ability of SDN to propose a solution that is an implementation run at the multicontroller to detect a DDoS attack at the early stage. This method not only detects the attacks but also identifies the attacking paths and starts a mitigation process to provide protection for the network devices. This method is based on the entropy variation of the destination host targeted with its IP address and can detect the attack within the first 250 packets of malicious traffic attacking a particular host. Then, fine-grained packet-based detection is performed using a deep-learning model to classify the attack into different types of attack categories. Lastly, the controller sends the updated traffic information to neighbor controllers. The chi-squared ( x 2 ) test feature selection algorithm was also employed to reveal the most relevant features that scored the highest in the provided data set. The experiment result demonstrated that the proposed Long Short-Term Memory (LSTM) model achieved an accuracy of up to 99.42% using the data set CICDDoS2019, which has the potential to detect and classify the DDoS attack traffic effectively in the multicontroller SDN environment. In this regard, it has an enhanced accuracy level to 0.42% compared with the RNN-AE model with data set CICDDoS2019, while it has improved up to 0.44% in comparison with the CNN model with the different data set ICICDDoS2017.

Software-Defined Network (SDN) brings a lot of advantages to the world of networking through its flexibility and centralized management; however this centralized control makes it susceptible to different types of attacks. Distributed Denial of Service (DDoS) is one of the most dangerous attacks which can frequently launch DDoS attacks towards the controller in order to make it out of service. This work takes the special ability of SDN to propose a solution that an implementation running at the multi-controller to detect DDoS attack at the early stage. The method not only detect the attacks but also identify the attacking paths and start a mitigation process to provide protection for the network devices the moment an attack is detected. This method is based on the entropy variation of the destination host targeted with its IP address and can detect the attack within the first 250 packets of malicious traffic attacking a particular host. Then, fine-grained packet-based detection is performed using deep learning model to classify the attack into different type of attack categories. Lastly, the controller sends the updated traffic information to neighbor controllers. To avoid a single point of controller failure, a multi-controller which is a logically centralized and physically distributed controller has used. The issues related to lack of detailed attack description have been addressed using categorical classification which is allowed to make specific attack descriptions by considering the traffic coming to the controller. The chi-square (x2) test feature selection algorithm has also employed to reveal the most relevant features that scored the highest in the provided data set. The experiment result demonstrate that the proposed Long Short-Term Memory (LSTM) model achieved an accuracy of up to 99.42% using the data set CIC-DDoS2019 which has the potential to detect and classify the DDoS attack traffic effectively in the multi-controller SDN environment. In this regard, it has enhanced accuracy level to 0.42% when we compared with RNN-AE model with data set CIC-DDoS2019, while it has improved up to 0.44% in comparison with CNN model with different data set ICICDDoS2017.