Internet Protocol (IP)-Based Distributed Denial of Server (DDoS) Attack Detection and Mitigation for Software Defined Networking (SDN) Controller

Software-defined networking architectural framework eases the life of the network
administrators by isolating the data plane from the control plane. This facilitates
easy configuration of the network, provides a programmable interface for developing
applications related to management, security, logging etc. and the centralized logical
controller gives more control over the entire network, which has the total visibility
of the network.
These advantages of SDN also expose the network to the vulnerabilities and the
impact of the attacks are much severe when compared to conventional networks,
where the network devices in itself provided protection from the attacks and limits
the scope of the attacks.
In this paper, we explore various attacks that can be launched on SDN at different
layers. We also evaluate some of the existing security methods in mitigating the
attacks. We also explore a possible solution to prevent DDoS attacks using entropy.
A Distributed Denial of Service (DDoS) attack is a DoS attack utilizing multiple
distributed attack sources. Every network in the system has an entropy. Increase
in randomness causes decrease in entropy. To mitigate this threat, this project
proposes to use the central control of SDN for attack detection and introduces a
solution that is effective and lightweight in terms of the resources that it uses.
More precisely, this project shows how DDoS attacks can exhaust controller resources
and provides a solution to detect such attacks based on the entropy variation of
the destination IP address. Based on this value if it drops below threshold , we are
blocking the specific port in the switch and bring the port down. This method is able
to detect DDoS within the first five hundred packets of the attack traffic