# Detection of DDoS Attacks in Software Defined Networking Using Entropy
## 2 Related Works
### Distributed Denial of Service in SDN
[25] proposed a new method based on switching processing capability. This method can quickly respond to DDoS attacks. However, the author could have added more details about the complex flows in the switch. The scheme in [26] defines the predicted value of the number of switch requests according to Taylor series, and can filter out the requests that lead to a sharp decrease in entropy. [PERSON] et al. [27] proposed a scheme for single TCP SYN flood, which can improve the processing delay. In ref. [28], the author uses Paspberry Pis as OpenvSwitches and proves that virtual hardware resources can be used as a solution for the Internet of Things. In this paper, entropy is used as a DDoS detection scheme, but the disadvantage is that the threshold cannot be dynamically updated. In ref. [29], the author uses multi-scale principal component analysis to denoise signals, but in this paper, data packets are used for different application objects, so denoising technology can be considered to reduce interference in data packets in subsequent work. In ref. [30], the author proposed the adaptive wavelet transform method for signal decomposition to improve the classification accuracy. In SDN, there are also many kinds of interference, this method can be considered to improve the accuracy of attack detection in the future. In ref. [31], the author proposes to use multivariate empirical wavelet transform to decode motor imagery tasks. Similar to the preprocessing method mentioned above, we will also preprocess the interference existing in the attack detection process in the future. Similarly, in [32], the author combines dimension reduction technology with neural network to improve system performance. The entropy value used in this paper can be used as feature vector for reduction and neural network, which will be discussed in the future. The authors in [33] propose a statistical feature to describe the traffic characteristic condition entropy of DDoS attacks, and then use support vector machine classifier to identify attacks. This method can distinguish attack traffic from normal traffic. [PERSON] et al. [34] proposed a distributed artificial neural network method based on anomaly detection and signature detection. This hybrid model can improve the detection performance of DDoS attacks. In ref. [35], entropy is used to detect whether the traffic is abnormal firstly. After extracting the attack characteristics, BiLSTM-RNN neural network algorithm is used to train the data set and classify the real-time traffic to achieve DDoS attack detection. [PERSON] et al. [36] calculates entropy using various attributes of source IP and TCP tokens in the network. This technology can detect TCP SYN flood, Ping flood, and Slow HTTP attacks, making good use of the programmability and flexibility provided by centralized control. [PERSON] et al. [37] proposed an intrusion detection system based on the Gated Recursive Unit Recursive Neural Network (GRU-RNN), which uses the least functions to achieve higher computational efficiency without affecting the performance of the network. The detection method based on the entropy change of destination IP address [38] can be used to identify the attack in the early stage. Entropy is a statistical concept that represents the randomness of a particular dataset. The higher the entropy is, the stronger the divergence of the data set is; the lower the entropy is, the weaker the divergence of the dataset is. Many DDoS detection methods based on SDN have been designed. In this paper, a fast DDoS detection method is proposed which can effectively detect attacks based on the significant change of entropy and it utilizes the working characteristics of flow table and the randomness of entropy.