# Detection of DDoS Attacks in Software Defined Networking Using Entropy
## 2 Related Works
### Analysis of Threats over SDN Network  
From 2020 to 2025, some enablers such as cloud service providers will greatly promote the use of SDN, which is expected to increase by 19% [15]. However, SDN architecture still has some security holes. These security vulnerabilities are related to some of their own characteristics [16].  
SDN separates the control plane from the data plane through OpenFlow protocol. Frequent communication between switches and controllers makes SDN vulnerable to attacks, which greatly reduces the network performance. Switches in traditional networks not only complete forwarding tasks but also need to formulate flow rules, while SDN formulates flow rules through controllers. This means that if one of the controllers and switches is attacked, the other will be affected. SDN is attacked mainly for the following four reasons:  
* The lack of security protection mechanism makes the controller in a potential threat;
* Complex interactions between various applications increase the burden of flow rules;
* Lack of authentication mechanism and application authorization;
* There is not enough secure encryption for the flow rules, making it easy for the flow rules to be tampered with after publication.  
Although SDN brings the benefits of programmability, centralization and flexibility, it also brings new security issues. In ref. [17], the author analyzes the security problems of the three planes in SDN architecture and puts forward corresponding security solutions. In order to deal with the security threats of SDN, relevant organizations have developed corresponding security challenges and solutions. It is necessary to analyze the security threats of this architecture from different functional planes.  
In SDN architecture, the security of the control plane (namely OpenFlow controller) directly affects the data forwarding plane. As the decision center, the controller has a high probability to become the target of attackers. [PERSON] et al. [18] analyzed the advantages and disadvantages of SDN in detail and classify security threats into SDN's unique challenges and the same challenges as classical networks. The security vulnerability of controller is studied and discussed from different angles, because it is the most vulnerable component in SDN architecture. In a multi-controller architecture, the threat to distributed multi-controllers is also a security problem. The coexistence and cooperation of multiple controllers will lead to configuration conflict. In addition, malicious access can occur to applications running on the controller, which requires a different security policy for each application. [PERSON] et al. [19] paid attention to how SDN is further applied in practice and discuss structural security and attack detection measures. More consideration has been given to the security of the controller. A DDoS attack on a controller prevents legitimate traffic from using controller resources and functions by exhausting computing or memory resources. An attacker launches an attack on SDN within a short period of time, and the attack traffic is mixed with normal traffic. Under normal circumstances, it is difficult to distinguish the two types.