DDoS Attacks and Flash Event Detection Based on Flow Characteristics in SDN

With the development of Software-Defined Networking (SDN), its security has been increasingly emphasized. Due to the centralized management and programmability of SD-N, an attacker can easily exploit its security vulnerabilities to carry out distributed denial-of-service (DDoS) attacks. Targeting at the -entropy improved on basis of Shan-non entropy and generalized entropy, we presents a multi-type DDoS detection and Flash Event method based on flow characteristics. To conduct the DDoS attack detection while detecting and distinguishing DDoS and Flash Events (FE) correctly, samples are classified via the multi-dimension features of the flow table in the switch, such as protocol type, the duration of flow and the -entropy of source / destination IP, Among them, the adjustable of -entropy is more conducive to discovering the attack behavior in the early stage. Experiments show that this method can effectively improve the detection rate of DDoS and reduce the false alarm rate of Flash Events, which verifies the accuracy and effectiveness of the experiments.