Mitigate Distributed Denial Of Service Attacks Research Articles

A multi-point collaborative DDoS defense mechanism for IIoT environment

Nowadays, a large number of intelligent devices involved in the Industrial Internet of Things (IIoT) environment are posing unprecedented cybersecurity challenges. Due to the limited budget for security protection, the IIoT devices are vulnerable and easily compromised to launch Distributed Denial-of-Service (DDoS) attacks, resulting in disastrous results. Unfortunately, considering the particularity of the IIoT environment, most of the defense solutions in traditional networks cannot be directly applied to IIoT with acceptable security performance. Therefore, in this work, we propose a multi-point collaborative defense mechanism against DDoS attacks for IIoT. Specifically, for the single point DDoS defense, we design an edge-centric mechanism termed EdgeDefense for the detection, identification, classification, and mitigation of DDoS attacks and the generation of defense information. For the practical multi-point scenario, we propose a collaborative defense model against DDoS attacks to securely share the defense information across the network through the blockchain. Besides, a fast defense information sharing mechanism is designed to reduce the delay of defense information sharing and provide a responsive cybersecurity guarantee. The simulation results indicate that the identification and classification performance of the two machine learning models designed for EdgeDefense are better than those of the state-of-the-art baseline models, and therefore EdgeDefense can defend against DDoS attacks effectively. The results also verify that the proposed fast sharing mechanism can reduce the propagation delay of the defense information blocks effectively, thereby improving the responsiveness of the multi-point collaborative DDoS defense.

Machine Learning Enabled Techniques for Protecting Wireless Sensor Networks by Estimating Attack Prevalence and Device Deployment Strategy for 5G Networks

A number of disadvantages of traditional networks may be attributed to the close relationship that exists between the control plane and the data plane inside proprietary hardware designs, as described above. The problem of security is one of the most difficult to deal with. There are a plethora of network hazards and attacks that might be encountered these days. DDoS attacks are one of the most popular and disruptive attacks on the internet today, and they affect a wide range of organisations. Despite a large number of traditional mitigation solutions now available, the frequency, volume, and intensity of distributed denial-of-service (DDoS) attacks continue to rise. According to the findings of this paper, a new network paradigm is necessary to satisfy the requirements of today’s complex security concerns. It was necessary to develop a software-defined network (SDN) in order to meet the real-time needs of the massive network that was expanding at an exponential rate. Many advantages of SDN exist, including simplicity of administration, scalability, and agility, but one of the most critical is security, which is one of the most important considerations when implementing SDN. SDS may be seen as a paradigm in which the implementation of new security regulations in the computer environment is performed via the use of protected software, which is described further below. The goal is to provide a flexible and extensible architecture for DDoS detection and prevention that is both flexible and extendable; the suggested clustering approach, which is based on the Open Day Light (ODL) Controller, is employed to carry out the experimental findings. In this section, we emphasise DDoS penetration techniques from a range of tools, and we evaluate the vulnerability against various tactics. It is necessary to use a Mininet emulation tool to construct a detection and prevention system against distributed denial of service (DDoS) attacks in order to achieve success. There is a range of other simulation tools that are utilised in conjunction with this research in order to bring it to a conclusion. Integration of industry standards such as SNORT and Flow has been accomplished in a variety of situations and parameter settings. During the creation of a framework capable of detecting and mitigating DDoS attacks at an early stage in both the control and application levels, the implementation of this framework has been shown to be crucial in the development of a framework.

BSD-Guard: A Collaborative Blockchain-Based Approach for Detection and Mitigation of SDN-Targeted DDoS Attacks

Software-Defined Networking (SDN) enhances the flexibility and programmability of networks by separating control plane and data plane. The logically centralized control mechanism makes the control plane vulnerable in both single and multiple controller scenarios. Malicious third parties can exploit vulnerabilities of reactive forwarding mode to launch distributed denial-of-service (DDoS) attacks against SDN controllers. Unfortunately, existing DoS/DDoS solutions under single controller can not afford effective performance under multiple controllers due to the absence of cooperative detection and mitigation. To solve the above problem, we propose a blockchain-based SDN-targeted DDoS defense framework (BSD-Guard) that can provide cooperative detection and mitigation mechanism to protect SDN controllers. BSD-Guard introduces a blockchain-based secure middle plane between control plane and data plane. The secure middle plane calculates the suspect rate of new flows based on the collected packets’ information and reports suspect lists to blockchain for immutably storing and sharing. Besides, the smart contract deployed on blockchain in advance constitutes collaborative defense strategies based on the suspect lists reported from multiple SDN domains. When receiving defense strategies, the secure middle plane converts them to specific flow table actions and installs actions into relevant switches. The experimental results indicate that BSD-Guard can efficiently detect DoS/DDoS attacks in multiple controllers scenario and issue precise defensive strategies near the source of attack by identifying the attack path.

Toward Proactive and Efficient DDoS Mitigation in IIoT Systems: A Moving Target Defense Approach

Nowadays, a large number of intelligent devices involved in the industrial Internet of Things (IIoT) environment lead to unprecedented challenges in security. Due to limited resources with weak security protection, the IIoT devices can be easily compromised to launch distributed denial-of-service (DDoS) attacks, resulting in catastrophic results. Although there are many DDoS mitigations of traditional static schemes, the proactive defense method to resist attacks has not been well studied. Furthermore, existing proactive schemes ignored the delay-sensitive characteristic of applications under the IIoT environments. To address these issues, we first adopt two kinds of moving target defense (MTD) techniques that dynamically control the admission of devices and migrate service replicas to isolate attackers on limited edge clouds and mitigate DDoS attacks early near its source. Then, we formulate a multistage optimization problem of MTD mechanisms deployment and model it as constrained Markov decision processes in order to maximize the available resources of the system under the limitations of the IIoT environments. Besides, we present an MTD optimal strategy algorithm to solve decision problems in a cost-effective manner. In this article, the proposed algorithm can achieve an optimal admission allocation by means of attackers gathering within the same service where the service migration decisions are assisted by means of value iteration. The experimental results verify that the proposed algorithm, compared with existing strategies, can effectively mitigate DDoS attacks with acceptable degradation of the quality of service.

Intelligent Feature Subset Selection with Machine Learning Based Detection and Mitigation of DDoS Attacks in 5G Environment

The fifth-generation (5G) technology is anticipated to permit connectivity to billions of devices, called the Internet of Things (IoT). The primary benefit of 5G is that it has maximum bandwidth and can drastically expand service beyond cell phones to standard internet service for conventionally fixed connectivity to homes, offices, factories, etc. But IoT devices will unavoidably be the primary target of diverse kinds of cyberattacks, notably distributed denial of service (DDoS) attacks. Since the conventional DDoS mitigation techniques are ineffective for 5G networks, machine learning (ML) approaches find helpful to accomplish better security. With this motivation, this study resolves the network security issues posed by network devices in the 5G networks and mitigates the harmful effects of DDoS attacks. This paper presents a new pigeon-inspired optimization-based feature selection with optimal functional link neural network (FLNN), PIOFS-OFLNN model for mitigating DDoS attacks in the 5G environment. The proposed PIOFS-OFLNN model aims to detect DDoS attacks with the inclusion of feature selection and classification processes. The proposed PIOFS-OFLNN model incorporates different techniques such as pre-processing, feature selection, classification, and parameter tuning. In addition, the PIOFS algorithm is employed to choose an optimal subset of features from the pre-processed data. Besides, the OFLNN based classification model is applied to determine DDoS attacks where the Rat Swarm Optimizer (RSO) parameter tuning takes place to adjust the parameters involved in the FLNN model optimally. FLNN is a low computational interconnectivity higher cognitive neural network. There are still no hidden layers. FLNN’s input vector is operationally enlarged to produce non-linear remedies. More details can be accessed application of Nature-Inspired Method to Odia Written by hand Number system Recognition. To validate the improved DDoS detection performance of the proposed model, a benchmark dataset is used.

Blockchain Based Solutions to Mitigate Distributed Denial of Service (DDoS) Attacks in the Internet of Things (IoT): A Survey.

Internet of Things (IoT) devices are widely used in many industries including smart cities, smart agriculture, smart medical, smart logistics, etc. However, Distributed Denial of Service (DDoS) attacks pose a serious threat to the security of IoT. Attackers can easily exploit the vulnerabilities of IoT devices and control them as part of botnets to launch DDoS attacks. This is because IoT devices are resource-constrained with limited memory and computing resources. As an emerging technology, Blockchain has the potential to solve the security issues in IoT. Therefore, it is important to analyse various Blockchain-based solutions to mitigate DDoS attacks in IoT. In this survey, a detailed survey of various Blockchain-based solutions to mitigate DDoS attacks in IoT is carried out. First, we discuss how the IoT networks are vulnerable to DDoS attacks, its impact over IoT networks and associated services, the use of Blockchain as a potential technology to address DDoS attacks, in addition to challenges of Blockchain implementation in IoT. We then discuss various existing Blockchain-based solutions to mitigate the DDoS attacks in the IoT environment. Then, we classify existing Blockchain-based solutions into four categories i.e., Distributed Architecture-based solutions, Access Management-based solutions, Traffic Control-based solutions and the Ethereum Platform-based solutions. All the solutions are critically evaluated in terms of their working principles, the DDoS defense mechanism (i.e., prevention, detection, reaction), strengths and weaknesses. Finally, we discuss future research directions that can be explored to design and develop better Blockchain-based solutions to mitigate DDoS attacks in IoT.

RAD: A Statistical Mechanism Based on Behavioral Analysis for DDoS Attack Countermeasure

Nowadays, Distributed Denial of Service (DDoS) attacks are among the most prevailing and costly attacks across the networks which challenge a variety of services. While many defense mechanisms are presented to detect and mitigate DDoS attacks, attackers constantly explore alternative approaches for orchestrating novel DDoS attacks. Distribution of the mechanism and its deployment into different zones can improve the accuracy and coverage of DDoS attack varieties. In this paper, we propose a 3-phase DDoS attack countermeasure, named RAD, based on a statistical model for scoring users in order to detect DDoS attacks. In the first phase, users are classified into either suspicious or benign based on their traffic behavior, being indicated by the number of flows, packets, concurrent connections, and amount of user-generated traffic. In the second phase, we identify a potential attack state using the drop, jitter, and delay processing parameters. In the third phase, relevant policies are enforced on the suspicious class of users and its effects are assessed continuously in order to reduce false alarms. RAD is evaluated through the UNB CICDDoS2019 dataset and is compared with four well-known DDoS detection algorithms. RAD counters DDoS attacks with more than 80% precision, 99% recall, and 89% F1-Measure in CICDDoS2019.

COMPATIVE ANALYSIS OF DEEP LEARNING MODELS FOR DDOS ATTACKS DETECTION

Recently, Distributed Denial of Service(DDOS) attacks have been on the rise and come in very many forms costing many technology firms a lot of time and money. In this study, deep learning models were compared in terms of performance, to solve the problem of detecting these attacks. The first step to mitigating DDOS attacks is by first identifying them, which serves as a toll order. This report used two deep learning models: the Deep Feed Forward (DFF) algorithm and a hybrid containing a CNN with BiLSTM (bidirectional long short-term memory). To compare these algorithms, the “DDoS Botnet Attack on IoT a71a0b42-4” dataset available on Kaggle was chosen. The dataset was undergone various evaluations to find out the performance metrics between the two algorithms. From the simulations conducted, DFF was found to have an accuracy of 87.2% with detecting the time of 0.8 seconds, while the CNN-Bi-LSTM was found to have an accuracy of 94.6% with detecting the time of 1.4 seconds.

DDoS ATTACK MITIGATION WITH INTRUSION DETECTION SYSTEM (IDS) USING TELEGRAM BOTS

In the current IS/IT era, service to consumers is an absolute must to be prepared to survive in business competition. Physical and logical attacks with the aim of disrupting information technology services for individuals/agencies/companies or reducing the performance of IS/IT used. The development of IoT in the industrial revolution 4.0, which is all online, is a challenge in itself, from a negative point of view, all of them are able to carry out attacks on ISP servers, often carried out by hackers. DDoS (Distributed Denial of Service) attacks are the most common attacks. The development of software for DDoS attacks is very much on the internet, including UDP Unicorn software to attack very easily and can be done by anyone. Software for real-time monitoring of DDoS attacks, one of which is the Telegram bot. Telegram is a messaging system centered on security and confidentiality, while bots are computer programs that do certain jobs automatically. Telegram bot is free, lightweight and multiplatform. In the case study, this research contains 10 access points to the internet that will be mitigated from DDoS attacks. In this study, it was found that DDoS attacks caused traffic to become very high/congested by fulfilling upload traffic so that legitimate traffic users could not access the internet, connection to the internet was slow, the traffic was also unnatural, making it unable to connect to wireless devices and making Mikrotik login page becomes unable to appear. The purpose of this study is to mitigate DDoS attacks with the help of telegram bots so as to facilitate the notification of DDoS attacks in the event of an attack so that it is fast to deal with and find the perpetrators of the attack. The conclusion of this study is that DDoS attacks using UDP unicorn software resulted in a traffic spike of 53.5 Mbps on the upload traffic side, causing traffic for legitimate/authenticated users to slow down. By using telegram bots to know DDoS attacks occur in real time with a success rate of attack detection up to 100% notifications on telegram bots. Mitigation of DDoS attacks takes steps to track users using the torch feature on the routerboard interface menu, trace internet connection lines using wired or wireless transmission media, and ensure always monitoring the proxy interface from winbox.

Comparative Study on TCP SYN Flood DDoS Attack Detection: A Machine Learning Algorithm Based Approach

A most common attack on the internet network is a Distributed Denial of Service (DDoS) attack, which involves occupying computational resources and bandwidth to suppress services to potential clients. The attack scenario is to massively flood the packets. The attack is called a denial of service (DoS) if the attack originates from a single server, and a distributed denial of service (DDoS) if the attack originates from multiple servers. Control and mitigation of DDoS attacks have been a research goal for many scholars for over a decade, and they have achieved in delivering a few major DDoS detection and protection techniques. In the current state of internet use, how quickly and early a DDoS attack can be detected in broadcasting network transactions remains a key research goal. After the development of a machine learning algorithm, many potential methods of DDoS attack detection have been developed. The work presents the results of various experiments carried out using data mining and machine learning algorithms as well as a combination of these algorithms on the commonly available dataset named CAIDA for TCP SYN flood attack detection. Also, this work analysis the various performance metrics such as false positive rate, precision, recall, F-measure and receiver operating characteristic (ROC) using various machine learning algorithm. One-R(OR) with an ideal FPR value of 0.05 and recall value of 0.95,decision stump(DS) with an ideal precision value of o.93,PART with an excellent F-measure value of 0.91 are some of the performance metric values while performing TCP SYN flood attack detection.

Adaptive tuning of network traffic policing mechanisms for DDoS attack mitigation systems

Distributed denial-of-service (DDoS) attacks are responsible for shutting down servers, denying access to critical sectors of the economy, and generating substantial downtime costs and reputation harm. Only in 2020, over ten million DDoS attacks were observed worldwide. Commonly, open-loop network traffic rate policing is used to mitigate them. That is how network devices are currently designed. This paper shows how to extend the state-of-the-art design by introducing the adaptive closed-loop tuning of policing mechanisms. As demonstrated experimentally, open-loop policing based on the celebrated token-bucket mechanism generates a steady-state control error. In contrast, the robust self-tuning controller eliminates that control error while adjusting the bitrate limiting operations to the severe and hardware-specific network operating conditions during a DDoS attack. The study shows the controller’s implementation details and discusses the critical difficulties encountered in its technical development. Furthermore, it illustrates how the control error variance depends on the commanded traffic rate limit and explains why the self-tuning controller’s anti-windup filter may fail to bring the control signal back to the set of admissible control values. All experiments presented in this paper were conducted using real data from the Polish nation-wide cybersecurity system FLDX managed by the NASK National Research Institute.

DDOS ATTACK DETECTION AND MITIGATION AT SDN ENVIROMENT

Abstract- Software-Defined Networking (SDN) is a promising sample that allows the programming behind the network’s operation with some abstraction level from the underlying networking devices .the insistence to detect and mitigate Distributed Denial of Service (DDoS) which introduced by network devices tries to discover network security weaknesses and the negative effects of some types of Distributed Denial of Service (DDoS) attacks. An SDN-based generic solution to mitigate DDoS attacks when and where they originate. Briefly, it compares at runtime the expected trend of normal traffic against the trend of abnormal traffic; if big deviation on the traffic trend is detected, then an event is created; as an event associated to a DDoS attack is produced, an SDN (OpenDayLight) controller creates flow rules for blocking the malign traffic, By designing and implementing an application that reactively impairs the attacks at its origin, ensuring the “normal operation” of the network infrastructure. The evaluation results suggest that the proposal timely detect the characteristics of a flooding DDoS attacks, and mitigates their negative impacts on the network performance, and ensures the correct data delivery of normal traffic. The work sheds light on the programming relevance over an abstracted view of the network infrastructure.

A Review on Detection, Defensive and Mitigation of DDoS Attacks with Traceback Methods

The most tremendous attacks in the globeis Distributed Denial of Service (DDoS) attacks, which is the very powerful and typical external attempts to weak bandwidth of the victims or interrupt legitimate users to access the services. The traditional Internet services of architecture is unsafe to DDoS attacks and the collection of internet connected devices affected by the malwares, then it allows the intruders to control all the internet connected devices is a Botnet or attacked networks.In Botnet, one disadvantage is that if the Botnet is set up then the intruder creates the large-scale networks to attack on more number of victims.As anoutcome of the permanentgrowth of latest attacks and constantly growingcollection of weak sources on the internet, the Detection, Prevention of DDoS attack and Trace back methods have been proposed.In this paper, we have reviewed various types of classification methods for DDoS attacks and its countermeasures. Finally,this survey paper assesses and illustrates the efficiency of variousDDoS attacks including detection, defense and mitigation, trace back methods. These methods rely on better router functionality or changes to existing protocols. The advantages and disadvantages of existing research methods in this problem are also described..

Collaborative detection and mitigation of DDoS in software-defined networks

This research presents the detection and mitigation of distributed denial of service (DDoS) in software defined networks (SDN). The proposed method consists of three modules: classifier module, mitigation module, and collaborative module. An ensemble classifier called V-NKDE is capable of detecting DDoS attacks accurately. The mitigation module blocks malicious traffics and purges entries of malicious traffic from the switch flow table. The collaborative module shares DDoS detection and mitigation rules among multiple SDN controllers using Redis Simple Message Queue mechanism. The proposed classifier performance validation on InSDN2020, CICIDS2017, NSL-KDD and UNSW-NB15 datasets. Furthermore we evaluated our proposed classifier in real traffic on an SDN simulation tested. The results show that the proposed method can detect DDoS attacks with high accuracy using an ensemble classifier, which performs better than single classifiers. More importantly, the false positive rate is greatly reduced, showing detection and mitigation of DDoS attacks across multi-controller domains with low controller overhead.

Distributed denial‐of‐service attack mitigation in network functions virtualization‐based 5G networks using management and orchestration

SummaryThe fifth generation (5G) technology is expected to allow connectivity to billions of devices, known as Internet of Things (IoT). However, IoT devices will inevitably be the main target of various cyberattack types. The most common one is known as distributed denial‐of‐service (DDoS) attack. In order to mitigate such attacks, network functions virtualization (NFV) has a great potential to provide the benefit of elasticity and low‐cost solutions for protecting 5G networks. In this context, this study proposes a new mechanism developed to mitigate DDoS attacks in 5G NFV networks. The proposed mechanism utilizes intrusion prevention system's (IPS) virtual machines (VMs) to intercept the queries. Based on the volume of DDoS traffic, IPS's VMs are dynamically deployed by means of management and orchestration (MANO) in order to balance the load. To evaluate the effectiveness of the mechanism, experiments are conducted in a real 5G NFV environment built by using 5G NFV environment tools. To our best knowledge, this is the first time that NFV‐based mechanism is experimentally tested in a real 5G NFV environment for mitigating DDoS attacks in 5G networks. The experimental results verify that the proposed mechanism can mitigate DDoS attacks effectively.

Intelligent feature selection using particle swarm optimization algorithm with a decision tree for DDoS attack detection

The explosive development of information technology is increasingly rising cyber-attacks. Distributed denial of service (DDoS) attack is a malicious threat to the modern cyber-security world, which causes performance disruption to the network servers. It is a pernicious type of attack that can forward a large amount of traffic to damage one or all target’s resources simultaneously and prevents authenticated users from accessing network services. The paper aims to select the least number of relevant DDoS attack detection features by designing an intelligent wrapper feature selection model that utilizes a binary-particle swarm optimization algorithm with a decision tree classifier. In this paper, the Binary-particle swarm optimization algorithm is used to resolve discrete optimization problems such as feature selection and decision tree classifier as a performance evaluator to evaluate the wrapper model’s accuracy using the selected features from the network traffic flows. The model’s intelligence is indicated by selecting 19 convenient features out of 76 features of the dataset. The experiments were accomplished on a large DDoS dataset. The optimal selected features were evaluated with different machine learning algorithms by performance measurement metrics regarding the accuracy, Recall, Precision, and F1-score to detect DDoS attacks. The proposed model showed a high accuracy rate by decision tree classifier 99.52%, random forest 96.94%, and multi-layer perceptron 90.06 %. Also, the paper compares the outcome of the proposed model with previous feature selection models in terms of performance measurement metrics. This outcome will be useful for improving DDoS attack detection systems based on machine learning algorithms. It is also probably applied to other research topics such as DDoS attack detection in the cloud environment and DDoS attack mitigation systems.

Impact of Defending Strategy Decision on DDoS Attack

Distributed denial-of-service (DDoS) attack is a serious threat to cybersecurity. Many strategies used to defend against DDoS attacks have been proposed recently. To study the impact of defense strategy selection on DDoS attack behavior, the current study uses logistic function as basis to propose a dynamic model of DDoS attacks with defending strategy decisions. Thereafter, the attacked threshold of this model is calculated. The existence and stability of attack-free and attacked equilibria are proved. Lastly, some effective strategies to mitigate DDoS attacks are suggested through parameter analysis.

Detection of DDOS Attack using Deep Learning Model in Cloud Storage Application

In recent years, distributed denial of service (DDoS) attacks pose a serious threat to network security. How to detect and defend against DDoS attacks is currently a hot topic in both industry and academia. There have been a lot of methodologies and tools devised to detect DDoS attacks and reduce the damage they cause. Still, most of the methods cannot simultaneously achieve efficient detection with a small number of false alarms. In this case, deep learning techniques are appropriate and effective algorithm to categorize both normal and attacked information. Hence, a novel a feature selection-whale optimization algorithm-deep neural network (FS-WOA–DNN) method is proposed in this research article to mitigate DDoS attack in effective manner. Initially, pre-processing step is carried out for the input dataset where min–max normalization technique is applied to replace all the input in a specified range. Later on, that normalized information is fed into the proposed FS-WOA to select the optimal set of features for ease the classification process. Those selected features are subjected to deep neural network classifier to categorize normal and attacked data. Further to enhance the security of proposed model, the normal data are secure with the help of homomorphic encryption and are securely stored in the cloud. The proposed algorithm will be simulated using the MATLAB tool and tested experimentally that shows 95.35% accuracy in detecting DDoS attack.

Mitigation of DDOS and MiTM Attacks using Belief Based Secure Correlation Approach in SDN-Based IoT Networks

In recent years the domain of Internet of Things (IoT) has acquired great interest from the ICT community. Environmental observation and collecting information is one of the key reasons that IoT infrastructure facilitates the creation of many varieties of the latest business methods and applications. There are however still issues about security measures to be resolved to ensure adequate operation of devices. Distributed Denial of Service (DDoS) attacks are currently the most severe virtual threats that are causing serious damage to many IoT devices. With this in mind, numerous research projects were carried out to discover new methods and develop Novel techniques and solutions for DDOS attacks prevention. The use of new technology, such as software-defined networking (SDN) along with IoT devices has proven to be an innovative solution to mitigate DDoS attacks. In this article, we are using a novel data sharing system in IoT units that link IoT units with the SDN controller and encrypt information from IoT unit. We use conventional Redstone cryptographic algorithms to encrypt information from IoT devices in this framework. The Proposed Belief Based Secure Correlation methodology supports the prevention of DDOS attacks and other forms of data attacks. The system proposes new routes for transmission through the controller and communicates with approved switches for the safe transmission of data. To simulate our entire scenario, we proposed the algorithm Belief Based Secure Correlation (BBSC) implemented in SDN–IoT Testbed and verified IoT data is secure during transmission in the network.

Mitigating DDoS Attacks in SDN-Based IoT Networks Leveraging Secure Control and Data Plane Algorithm

Software-Defined Networking (SDN) and Internet of Things (IoT) are the trends of network evolution. SDN mainly focuses on the upper level control and management of networks, while IoT aims to bring devices together to enable sharing and monitoring of real-time behaviours through network connectivity. On the one hand, IoT enables us to gather status of devices and networks and to control them remotely. On the other hand, the rapidly growing number of devices challenges the management at the access and backbone layer and raises security concerns of network attacks, such as Distributed Denial of Service (DDoS). The combination of SDN and IoT leads to a promising approach that could alleviate the management issue. Indeed, the flexibility and programmability of SDN could help in simplifying the network setup. However, there is a need to make a security enhancement in the SDN-based IoT network for mitigating attacks involving IoT devices. In this article, we discuss and analyse state-of-the-art DDoS attacks under SDN-based IoT scenarios. Furthermore, we verify our SDN sEcure COntrol and Data plane (SECOD) algorithm to resist DDoS attacks on the real SDN-based IoT testbed. Our results demonstrate that DDoS attacks in the SDN-based IoT network are easier to detect than in the traditional network due to IoT traffic predictability. We observed that random traffic (UDP or TCP) is more affected during DDoS attacks. Our results also show that the probability of a controller becoming halt is 10%, while the probability of a switch getting unresponsive is 40%.