Abstract:Summary Software defined network (SDN) has emerged as a new paradigm in terms of network architecture, providing flexibility, agility, and programmability to network management. These benefits boosted the SDN adoption, bringing new challenges mainly related to security, in particular, those related to Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. The detection, prevention, and mitigation of these attacks are important since they can affect the entire network. Many current security measures use statistical techniques, as entropy, or machine learning (ML) algorithms to detect DoS and DDoS attacks. While the definition of a threshold to determine whether a traffic is an attack is not trivial in statistical techniques, ML solutions may provide better accuracy but require considerable computational resources and time to converge to a model able to detect these attacks. Trying to circumvent these limitations, current hybrid approaches either use the results from entropy as input in ML algorithms (Entropy→ ML) or use entropy as a filter and ML algorithms to identify attacks. This work goes one step ahead and combines these techniques in a three‐step approach (Entropy→ ML→ Entropy), called ML‐Entropy, which inherits the intelligence of ML algorithms to adjust the threshold used by entropy. The proposed solution was implemented and evaluated in two datasets, the well‐known synthetic DARPA dataset and a dataset composed by traffic collected from a real‐corporate environment. Experimental results show that, in general, ML‐Entropy presents an accuracy above 99%, similar to support vector machine (SVC) and random forest (RF) algorithms, being able to converge to a detection model up to 192,771× and 137,924× faster than RF and SVC, respectively.

DoS Detection Model Base on Alive Entropy

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

Detection of low-rate DDoS attack based on self-similarity

Detection of DDoS Attacks in Software Defined Networking Using Entropy

A Detection Model for Distributed Denial of Service Attacks Based on Network Connection Analysis

Detecting DDoS Attacks Based on Network Connection Statistics

Denial-of-Service Attack Detection via Differential Analysis of Generalized Entropy Progressions

An Online Entropy-based DDoS Flooding Attack Detection System with Dynamic Threshold

A Method to Detect Network Attacks Using Entropy in the Intrusion Detection System

An Approach on Detecting Network Attack Based on Entropy

A DoS attack detection method based on adversarial neural network

Exploiting Artificial Immune systems to detect unknown DoS attacks in real-time

An Entropy-based Method for Attack Detection in Large Scale Network

DDoS attack detection in SDN: Enhancing entropy‐based detection with machine learning

A New Attack Detection in Large Scale Network Based on Entropy.

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

A DoS Attack Defense Model Adopting Data Mining

A hybrid method of entropy and SSAE-SVM based DDoS detection and mitigation mechanism in SDN

A New Multistage Approach to Detect Subtle DDoS Attacks.