Towards an Efficient DDoS Detection Scheme for Software-Defined Networks

Abstract

Software-Defined Networks (SDN) are becoming a trending network technology in the modern Internet by splitting control and data planes and using a central controller. An SDN controller can be extended with application to provide flexible management of flows. This opens a great opportunity for implement new attacks' detection and mitigation inside SDN controller. Distributed Denial of Service (DDoS) attacks poses an immense threat to the Internet, and many defense approaches have been proposed. However, the prediction and prevention of DDoS attacks in SDN environments are a challenge. In this paper, we introduce a methodology to protect the network against DDoS attacks more effectively using statistical analysis on traffic entropy. In order to validate this proposal, a prototype was built in Mininet environment. The detection accuracy and performance have demonstrated the proposed scheme effectiveness.