Structured and Unstructured Log Analysis as a Methods to Detect DDoS Attacks in SDN networks

Abstract

In this paper, we proposed a method for detecting DDoS attacks in SDN networks. Since the SDN controller contains information about the network and can create rules for its proper functioning, we propose to configure the SDN controller to detect a possible DDoS attack by examining the session information based on information from logs and flow tables. The information from the logs will be transmitted to the Log Analysis Subsystem, where two independent analysis processes will be started. To achieve this goal, we divide session information into normal and abnormal using the entropy method. If traffic deviations are detected, which will indicate a DDoS attack, the Log Analysis Subsystem will transmit the information to the SDN controller, which will create a rule to block the harmful connection. To identify these connections, we suggest using the Kulbak-Labler approach to detect anomalies during the session so that the SDN controller can block the IP addresses suspected of a harmful connection.