Adaptive Entropy-Based Detection and Mitigation of Ddos Attacks in Software Defined Networks

Abstract

Software Defined Networking (SDN) has emerged as a new networking paradigm that is based on the decoupling between data plane and control plane providing several benefits that include flexible, manageable, and centrally controlled networks. From a security point of view, SDNs suffer from several vulnerabilities that are associated with the nature of communication between control plane and data plane. In this context, software defined networks are vulnerable to distributed denial of service attacks. In particular, the centralization of the SDN controller makes it an attractive target for these attacks because overloading the controller with huge packet volume would result in bringing the whole network down or degrade its performance. Moreover, DDoS attacks may have the objective of flooding a network segment with huge traffic volume targeting single or multiple end systems. In this paper, we propose an entropy-based mechanism for Distributed Denial of Service (DDoS) attack detection and mitigation in SDN networks. The proposed mechanism is based on the entropy values of source and destination IP addresses of flows observed by the SDN controller which are compared to a preset entropy threshold values that change in adaptive manner based on network dynamics. The proposed mechanism has been evaluated through extensive simulation experiments.

DDoS Attack Detection and Classification Using Hybrid Model for Multicontroller SDN

“…Mousavi and St-Hilaire [9] proposed using the central control of an SDN for attack detection and introduced a solution that was effective and lightweight in terms of the resources. Dalou et al [28] proposed an entropy-based mechanism for the distributed denial-of-service (DDoS) attack detection and mitigation in SDN networks that was evaluated through extensive simulation experiments. Wang and Liu [29] proposed a DDoS attack detection method based on information entropy and deep learning; the experiments indicated that the accuracy of this method reaches 98.98%, which has the potential to detect a DDoS attack traffic effectively in the SDN environment.…”