Entropy-based distributed denial of service attack detection in software-defined networking

Abstract

Software defined networking (SDN) is a new network architecture that allows for centralized network control. The separation of the data plane from the control plane, which establishes a programmable network environment, is the key breakthrough underpinning SDN. The controller facilitates the deployment of services that specify control policies and delivers these rules to the data plane using a common protocol such as OpenFlow at the control plane. Despite the many advantages of this design, SDN security remains a worry because the aforementioned chapter expands the network's attack surface. In fact, denial of service (DoS) assaults pose a significant threat to SDN settings in a variety of ways, owing to flaws in the data and control layers. This work shows how distributed denial of service (DDoS) attack detection is based on the entropy variation of the destination IP address. The study takes advantage of the OpenFlow protocol's (OFP) flexibility and an OpenFlow controller (POX) to apply the proposed method. An entropy computation to determine the distributed features of DDoS traffic is developed and it is capable of detecting a user datagram protocol (UDP) flood attack after 0.445 seconds this type of attack occurred.

A Comprehensive Detection and Mitigation Mechanism to Protect SD-IoV Systems Against Controller-Targeted DDoS Attacks

“…To measure the entropy variation, it is suggested to use destination address rather than source addresses. In [15] and [23], researchers use entropy variation of destination IP address to detect the attack and shows the capability of detecting User Datagram Protocol (UDP) flood attack detection. The entropy variation could improved by including checking the variation of Log Energy Entropy (LEE) in addition with Information Entropy (IE) as proposed in [24].…”

“…Therefore, an information theory-based system, as demonstrated in related research [6], [7], is deemed preferable for attacks targeting the controller. Previous studies, including [14], [15], and [16], have explored DDoS attack detection in SDN using entropy theory with a fixed threshold value. Recognizing the dynamic nature of environments like IoV, introducing a dynamic threshold in attack detection could enhance performance [17].…”

Detection and Mitigation Distribution Denial of Service Attack Based on Blockchain Concept

“…One such way is network-based detection techniques whereby network traffic is monitored, and abnormal patterns of this traffic are identified. Another one is traffic analysis which is considered one of the network-based approaches [11,13,14]. Additionally, machine learning and artificial intelligence techniques are widely used today to detect distributed denialof-service attacks, in addition to blockchain technology [2,4,15,16].…”

Anomaly detection for software defined datacenter networks using X-Pack

“…Currently VSS uses threshold crossing alerts (TCA) feature, based on traffic metrics like Packets in, Packets out, Bytes in, Bytes out, anterior cruciate ligament (ACL) deny event count, anti-spoof event count, that could be because of a DoS [16]- [18] attack, for generating real time alerts. TCA uses static threshold calculation to decide on the anomalies in the traffic pattern.…”