DDoS Detection Approach using Inter-Quartile Range and Entropy

Abstract

Software-defined networking (SDN) is aimed to enhance network flexibility and management by centralizing control. SDN systems offer several advantages but carry a risk if improperly deployed as the controller and its centralized property can be a potential single point of failure. The OpenFlow protocol utilized in SDN for communication between the controller and its corresponding switches can make it vulnerable to network attacks including Distributed Denial of Service (DDoS) attacks. DDoS attacks involve attackers flooding a network with spoofed IP packets, overwhelming the controller, leading to resource exhaustion and the collapse of entire SDN networks. The proposed methodology focuses on a defence solution for detecting and mitigating spoofed flooding DDoS attacks, implemented in an SDN controller using the Interquartile Range (IQR) as a statistical measure along with entropy. The simulations for various scenarios are assessed using various performance metrics such as detection time, precision, recall, FPR, FNR, accuracy etc