Abstract

Software-defined networking (SDN) provides centralized control and programmable flow management, making it suitable for dynamic detection and mitigation of distributed denial-of-service (DDoS) attacks. This paper proposes a lightweight flow-statistics-based DDoS detection and mitigation mechanism for SDN. The controller periodically collects OpenFlow flow statistics and extracts four interpretable indicators: aggregated packet rate, source count, flow count, and normalized source-address entropy. A destination is first marked as a candidate attack target when all four traffic conditions are simultaneously satisfied, and a DDoS attack is confirmed only when the suspicious state persists for a predefined duration, thereby suppressing alarms caused by transient traffic bursts. Once an attack is confirmed, the controller dynamically installs high-priority source-specific drop rules and uses an OpenFlow barrier mechanism to confirm mitigation-rule processing. Experiments were conducted in a Mininet environment using Ryu, Open vSwitch, and OpenFlow 1.3. Low-, medium-, and high-rate UDP DDoS scenarios were independently repeated three times, with observed packet rates of 481.81 ± 1.09 pps, 964.00 ± 0.98 pps, and 1606.10 ± 1.08 pps, respectively. The attack-confirmation duration remains approximately 1 s, while the mean barrier-confirmed mitigation delay ranges from 0.7938 ms to 0.8878 ms. A 0.5-s multi-source burst satisfies the traffic-feature conditions but is not confirmed as a DDoS attack, demonstrating the effectiveness of the suspicious-duration mechanism. Additional experiments show that TCP SYN and ICMP flooding attacks can also be successfully detected and mitigated. The installed source-specific rules effectively block attack traffic while preserving legitimate communication with the victim host.

References

• N. McKeown, T. Anderson, H. Balakrishnan, et al., “OpenFlow: Enabling innovation in campus networks,” ACM SIGCOMM Comput. Commun. Rev., vol. 38, no. 2, pp. 69–74, 2008.
• D. Kreutz, F. M. V. Ramos, P. E. Verissimo, et al., “Software-defined networking: A comprehensive survey,” Proc. IEEE, vol. 103, no. 1, pp. 14–76, 2014.
• Q. Yan, F. R. Yu, Q. Gong, et al., “Software-defined networking (SDN) and distributed denial of service (DDoS) attacks in cloud computing environments: A survey, some research issues, and challenges,” IEEE Commun. Surveys Tuts., vol. 18, no. 1, pp. 602–622, 2015.
• J. Singh and S. Behal, “Detection and mitigation of DDoS attacks in SDN: A comprehensive review, research challenges and future directions,” Comput. Sci. Rev., vol. 37, Art. no. 100279, 2020.
• R. Braga, E. Mota, and A. Passito, “Lightweight DDoS flooding attack detection using NOX/OpenFlow,” in Proc. IEEE Local Computer Network Conf., 2010, pp. 408–415.
• S. M. Mousavi and M. St-Hilaire, “Early detection of DDoS attacks against SDN controllers,” in Proc. 2015 Int. Conf. Computing, Networking and Communications (ICNC), 2015, pp. 77–81.
• K. Giotis, C. Argyropoulos, G. Androulidakis, et al., “Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments,” Comput. Netw., vol. 62, pp. 122–136, 2014.
• K. S. Sahoo, D. Puthal, M. Tiwary, et al., “An early detection of low rate DDoS attack to SDN based data center networks using information distance metrics,” Future Gener. Comput. Syst., vol. 89, pp. 685–697, 2018.
• J. Cui, M. Wang, Y. Luo, et al., “DDoS detection and defense mechanism based on cognitive-inspired computing in SDN,” Future Gener. Comput. Syst., vol. 97, pp. 275–283, 2019.
• S. Dong and M. Sarem, “DDoS attack detection method based on improved KNN with the degree of DDoS attack in software-defined networks,” IEEE Access, vol. 8, pp. 5039–5048, 2019.
• P. Manso, J. Moura, and C. Serrão, “SDN-based intrusion detection system for early detection and mitigation of DDoS attacks,” Information, vol. 10, no. 3, Art. no. 106, 2019.
• A. Ahalawat, K. S. Babu, A. K. Turuk, et al., “A low-rate DDoS detection and mitigation for SDN using Renyi entropy with packet drop,” J. Inf. Secur. Appl., vol. 68, Art. no. 103212, 2022.
• K. Jia, C. Liu, Q. Liu, et al., “A lightweight DDoS detection scheme under SDN context,” Cybersecurity, vol. 5, no. 1, Art. no. 27, 2022.
• Y. Liu, T. Zhi, M. Shen, et al., “Software-defined DDoS detection with information entropy analysis and optimized deep learning,” Future Gener. Comput. Syst., vol. 129, pp. 99–114, 2022.
• L. F. Eliyan and R. Di Pietro, “DeMi: A solution to detect and mitigate DoS attacks in SDN,” IEEE Access, vol. 11, pp. 82477–82495, 2023.
• A. I. Hassan, E. A. El Reheem, and S. K. Guirguis, “An entropy and machine learning based approach for DDoS attacks detection in software defined networks,” Sci. Rep., vol. 14, no. 1, Art. no. 18159, 2024.
• M. Yue, H. Yan, R. Han, et al., “A DDoS attack detection method based on IQR and DFFCNN in SDN,” J. Netw. Comput. Appl., vol. 240, Art. no. 104203, 2025.
• B. Pfaff, J. Pettit, T. Koponen, et al., “The design and implementation of Open vSwitch,” in Proc. 12th USENIX Symp. Networked Systems Design and Implementation (NSDI 15), 2015, pp. 117–130.
• B. Lantz, B. Heller, and N. McKeown, “A network in a laptop: Rapid prototyping for software-defined networks,” in Proc. 9th ACM SIGCOMM Workshop on Hot Topics in Networks, 2010, pp. 1–6.
• K. Rui, F. Tomonori, A. Yuji, et al., “Ryu SDN framework—Open-source SDN platform software,” NTT Tech. Rev., vol. 12, no. 8, pp. 18–22, 2014.