Journal of Soft Computing and Information Technology

Journal of Soft Computing and Information Technology

Detecting Distributed Denial of Service Attacks in Software Defined Networks by using Machine Learning and Statistical Analysis

Document Type : Persian Original Article

Authors
Department of Computer Engineering, Shahed University, Tehran, Iran
Abstract
Software-defined networking (SDN) is a novel approach to network architecture that provides flexibility, dynamism, and adaptability for network management. While accepting these advantages, the primary challenges of this type of network architecture are undoubtedly denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks. For this reason, preventing, detecting, and mitigating these attacks is crucial for the continued operation and efficiency of the network. Studies have shown that statistical approaches, such as entropy, or machine learning methods have attracted the attention of researchers in detecting these attacks. Statistical approaches have low computational overhead and high detection speed, but they have less detection ability than machine learning methods. Conversely, machine learning techniques typically require substantial computational resources and extended convergence times to accurately identify network attacks. In this study, a hybrid approach is proposed that integrates both statistical and machine learning-based methods for the detection of distributed denial-of-service attacks within software-defined networks. This integrated strategy aims to overcome the limitations of each method while capitalizing on their respective advantages. To minimize computational overhead and prevent resource saturation, the architecture employs two dedicated controllers, one responsible for traffic routing and the other for detecting anomalous behavior. Using this architecture, even if the routing controller is disrupted, the attack detection controller can identify the distributed denial-of-service attack. The hybrid model leverages entropy metrics in conjunction with the Packet-in rate over defined time intervals to identify suspicious traffic, which is subsequently subjected to in-depth analysis through machine learning algorithms. Using the proposed approach, the attack detection accuracy rate increases up to 99.47%. Furthermore, due to the examination of a large volume of traffic by statistical methods, which create less overhead, the proposed method shows a reduction in controller computational overhead by up to 10% compared to machine learning methods.
Keywords

[1] W. Zhijun, X. Qing, W. Jingjie, Y. Meng, and L. Liang, "Low-rate DDoS attack detection based on factorization machine in software defined network," IEEE Access, vol. 8, pp. 17404-17418, 2020.
[2] S. G. Rawat et al., "A survey of ddos attacks detection schemes in SDN environment," in 2023 International Conference on Computer, Information and Telecommunication Systems (CITS), 2023: IEEE, pp. 01-06.
[3] A. Hirsi et al., "Comprehensive analysis of ddos anomaly detection in software-defined networks," IEEE Access, 2025.
[4] Q.-Y. Zuo, M. Chen, G.-S. Zhao, C.-Y. Xing, G.-M. Zhang, and P. Jiang, "Research on OpenFlow-based SDN technologies," Journal of Software, vol. 24, no. 5, pp. 1078-1097, 2013.
[5] J. Naous, D. Erickson, G. A. Covington, G. Appenzeller, and N. McKeown, "Implementing an OpenFlow switch on the NetFPGA platform," in Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems, 2008, pp. 1-9.
[6] U. B. Clinton, N. Hoque, and K. Robindro Singh, "Classification of DDoS attack traffic on SDN network environment using deep learning," Cybersecurity, vol. 7, no. 1, p. 23, 2024.
[7] X. Wang et al., "Deep reinforcement learning: A survey," IEEE Transactions on Neural Networks and Learning Systems, vol. 35, no. 4, pp. 5064-5078, 2022.
[8] Y. Wang and L. Liu, "Centralized Network Management in SDN-based Communication Network of substation," in 2019 IEEE International Conference on Industrial Internet (ICII), 2019: IEEE, pp. 87-91.
[9] G. G. a. F. A. K.Kalkan, "Defense Mechanisms against DDoS Attacks in SDN Environment," IEEE Communications Magazine, vol. 55, pp. 175-179, 2017.
[10] N. Z. Bawany, Jawwad A. Shamsi, and Khaled Salah, "DDoS attack detection and mitigation using SDN: methods, practices, and solutions," Arabian Journal for Science and Engineering, vol. 42 pp. 425-441, 2017.
[11] T. Omar, A. Ho, and B. Urbina, "Detection of DDoS in SDN environment using entropy-based detection," in IEEE International Symposium on Technologies for Homeland Security (HST), 2019, pp. 1-4.
[12] J. Galeano-Brajones, J. Carmona-Murillo, J. F. Valenzuela-Valdés, and F. Luna-Valero, "Detection and mitigation of DoS and DDoS attacks in IoT-based stateful SDN: An experimental approach," Sensors, vol. 20, no. 3, p. 816, 2020.
[13] Z. Hemmati, G. Mirjalily, and Z. Mohtajollah, "Entropy-based DDoS Attack Detection in SDN using Dynamic Threshold," in 2021 7th International Conference on Signal Processing and Intelligent Systems (ICSPIS), 2021: IEEE, pp. 1-5.
[14] A. d. R. L. Ribeiro, R. Y. C. Santos, and A. C. A. Nascimento, "Anomaly detection technique for intrusion detection in sdn environment using continuous data stream machine learning algorithms," in 2021 IEEE international systems conference (SysCon), 2021: IEEE, pp. 1-7.
[15] A. O. Alzahrani and M. J. Alenazi, "Designing a network intrusion detection system based on machine learning for software defined networks," Future Internet, vol. 13, no. 5, p. 111, 2021.
[16] F. Khashab, J. Moubarak, A. Feghali, and C. Bassil, "DDoS attack detection and mitigation in SDN using machine learning," in 2021 IEEE 7th International Conference on Network Softwarization (NetSoft), 2021: IEEE, pp. 395-401.
[17] V. Deepa, K. M. Sudar, and P. Deepalakshmi, "Design of ensemble learning methods for DDoS detection in SDN environment," in 2019 International Conference on Vision Towards Emerging Trends in Communication and Networking (ViTECoN), 2019: IEEE, pp. 1-6.
[18] Z. Liu, Y. He, W. Wang, and B. Zhang, "DDoS attack detection scheme based on entropy and PSO-BP neural network in SDN," China Communications, vol. 16, no. 7, pp. 144-155, 2019.
[19] N. M. K. Cong Fan, Shi Chen, He Jiang, Yiwen Zhou, Carlene Campbell, "Detection of DDoS Attacks in Software Defined Networking Using Entropy," Applied Sciences, vol. 12, 2022.
[20] S. Abiramasundari and V. Ramaswamy, "Distributed denial-of-service (DDOS) attack detection using supervised machine learning algorithms," Scientific Reports, vol. 15, no. 1, p. 13098, 2025.
[21] D. Narayan, W. Heena, and K. Amit, "A Collaborative Approach to Detecting DDoS Attacks in SDN Using Entropy and Deep Learning," Journal of Telecommunications and Information Technology, 2024.