# Detection of DDoS Attacks in Software Defined Networking Using Entropy
## 5 Experimental Results and Discussion  
In this experiment, each test contains 250 data packets, divided by window value of 50, 5 results will be obtained, and a total of 16 times of running, and we will get a total of \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Controller** & **Language** & **Openflow** & **Thread** & **Release** \\ \hline Ryu & Python & 1.0\(\sim\)1.4 & Single & 03/2015 \\ Pox & Python & 1.0 & Single & 10/2013 \\ Nox & C++ & 1.08\(\pm\)1.3 & Multiple & 02/2014 \\ Beacon & Java & 1.0 & Multiple & 09/2013 \\ Floodlight & Java & 1.0 & Multiple & 11/2012 \\ Opendaylight & Java & 1.08\(\pm\)1.3 & / & 03/2015 \\ ONOS & Java & 1.08\(\pm\)1.3 & / & 03/2015 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: SDN Controllers. Figure 3: Designed network topology. 80 data results. The results are plotted as a discounted graph, where the horizontal axis represents representative packets and the vertical axis represents the value of calculated entropy. Table 2 shows the information entropy values of partial data packets in the normal and attack scenario. The entropy values of the data packets with 10 nodes in the above representative data packets are selected. The entropy value calculated in the normal scenario is that host 1 randomly sends normal traffic to the simulated network topology. To simulate the attack scenario, two hosts 4 and 6 send attack traffic to the target host 56. Figure 4 shows the comparison of information entropy between the two scenarios. Among the 80 packets, the green line represents the information entropy value in the normal scenario, and the blue line represents the information entropy value in the attack scenario. The green line shows the packet's information entropy fluctuates between 0.8 and 1.4. The minimum entropy value of 0.8 was adopted as the threshold of our experiment, which could ensure the minimum error. From the 10 th packet to the 65 th packet, the entropy value drops sharply and remains in the low value region between 0 and 0.21. The lowest point of normal flow entropy is 0.84288, and the highest point of attack flow entropy is 0.20882. The difference between the two is 0.63406, indicating a 75% decrease in information entropy under attack in the normal scenario. According to the experimental results of information entropy, when an attack occurs, the entropy value decreases obviously, but the attack is not detected immediately. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Information Entropy** & & **Incoming Packets** \\
**Normal** & **Attack** & **Incoming Packets** \\ \hline
1.11439 & 1.13712 & 1 \\
1.1174 & 1.13712 & 10 \\
0.84288 & 0.20198 & 20 \\
1.0235 & 0.02878 & 30 \\
1.0235 & 0.20452 & 40 \\
1.05419 & 0.20017 & 50 \\
1.0235 & 0.01419 & 60 \\
1.0235 & 1.0235 & 70 \\
0.84288 & 1.10643 & 80 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Information entropy values. Figure 4: Information entropy variation. Without changing other experimental conditions, log energy entropy is used to measure the randomness of the network. Table 3 shows the calculated log energy entropy values of partial data packets in the normal and attack scenario. The entropy values of the data packets with 10 nodes in the above representative data packets are selected. Figure 5 shows the comparison of log energy entropy under the two scenarios. In normal traffic scenarios, the entropy value of packets ranges from 1.7 to 3.5. We use the minimum entropy value of 1.7 as the threshold to ensure a small error. It can be seen from the figure that in the attack scenario, the value of log energy entropy starts to decline from the third packet, showing an earlier change. The lowest point of entropy of normal flow is 1.87379. The maximum entropy of attack traffic is 1.62796 when very few abnormal data are discarded. The difference between the two is 0.24583, indicating that the log energy entropy decreases by 13% when the attack occurs.