# Detection of DDoS Attacks in Software Defined Networking Using Entropy
## 2 Related Works
### Distributed Denial of Service in SDN  
A DDoS attack is one of the biggest security threats to SDN network in recent ten years. It can not only prevent legitimate users from accessing and using network resources, but also destroy the entire network [20]. Therefore, it is vital to protect the SDN network from DDoS attacks. Attackers combine multiple hosts to form zombie host groups that meet their attack requirements. These zombie hosts send a large number of useless data packets to the target, making it consume a large amount of resources such as CPU and bandwidth to process these packets. Once the target host receives far more data packets than the load, it will not work properly and cannot process legitimate data packets. DDoS attacks are easy to implement and favored by attackers. When the controller is attacked, the switch receives the attack packets and matches them with flow entries one by one. The attack packet is not valid and of course cannotmatch the flow table in the flow table entry. In this case, the switch encapsulates the packet as packet-in message and sends it to the controller. Then the controller makes decisions on the direction of the data packet. Attackers send a large number of attack packets so that packet-in messages continuously enter the controller and occupy a large number of controller resources [21]. As a result, the controller cannot process legitimate traffic data, and the controller cannot work properly or is faulty. The above content shows that the security problems under SDN cannot be underestimated. Although it subverts the traditional network and brings many amazing benefits, the security problems hidden behind it pose a great threat to its own development and application. It is very important to further discover the security vulnerabilities of SDN architecture and find appropriate solutions to promote the further development of SDN. DDoS attacks are of various types, such as TCP flood [22], UDP flood [23], and ICMP flood. An attacker sends a large amount of garbage traffic to the target network by operating the attack source, which sharply reduces the available bandwidth and prevents the target host from communicating with the outside world. TCP flood and UDP flood attacks use massive TCP and UDP packets to attack victims. ICMP flood is applied by displaying ICMP request packets to disturb normal traffic destined for the target host. In a TCP flood attack, the attacker sends a large number of forged IP address packets to the destination host. As the IP addresses of the packets are forged, the destination host cannot receive the response from the sender. The difference between UDP flooding attacks and TCP flooding attacks is that UDP is connectionless, which is commonly used in voice and video applications [24]. An attacker initiates UDP flooding attacks by generating excessive UDP packets to random ports of the destination host and prevents the attack target from responding to legitimate users. When a DDoS attack occurs on a controller, the impact on the SDN is more serious. Therefore, effective detection methods are of great significance to attack detection and response. So far, there have been many methods to detect DDoS attacks against SDN controllers. Each technology approach has a different design and definition in terms of architecture, timing, and parameters. Packet-based detection and flow-based detection are two main DDoS attack detection methods in SDN environment. The flow-based DDoS attack detection method checks flow tables on the switch, while the packet-based detection method should check all packets on the network. In the flow-based method, the pre-set trigger mechanism can first judge whether there is an attack in the network, and then start the attack detection algorithm if there is an attack. The package-based approach needs to examine every packet in the network, regardless of whether the attack time has occurred. In comparison, the flow-based detection method consumes less system resources and is more efficient. [PERSON] et al.