## 2 Related Work
### DDoS Attacks on SDN
During peak time, the controller discards requests from particular nodes whose number of requests already exceeds a certain threshold. Even for the normal nodes, the controller replies switch a new rule with a lower timeout value. However, the authors do not indicate how to define a peak time and the threshold of the peak time. Moreover, the proposed technique is not simulated or tested on the real equipment. [PERSON] et al. [18] propose a model to use a Bloom filter to deal with the detection of link flooding attack in the SDN. This model contains two subsystems: (i) collector and (ii) detector. When the link utilisation is abnormal, the collector scans the flow table on the switch and finds the abnormal flows from the statistics of flow entries. The detector monitors the entire network using a controller; therefore, it can sniff packets. The classification of these packets are sent to the Bloom filter to determine whether it is abnormal, because relevant IP features are stored in the Bloom filter. However, there is no definition of abnormal link utilisation, and how to detect this issue on the controller is also unmentioned. [PERSON] et al. [19] propose to detect DDoS attacks using a Support Vector Machine (SVM) classifier. The SVM learns the pattern with training samples and predicts the unknown traffic sample to be normal or attack. The 2000 DARPA intrusion detection scenario specific dataset is taken to instruct the SVM. The SVM has a higher accuracy and lower false positive comparing with other methods from the simulation. However, the performance of SVM is deeply based on the training dataset. Similarly, [PERSON] et al. [20] propose to use the combination of SVM and SOM to classify DDoS attacks. SVM and SOM are trained by ready-made datasets before the model is used for testing. Each protocol has a dedicated SVM to filter traffic in the control plane. If a specific flow is in the attack region according to the SVM, it is then sent to the classifier. If the flow is in the vogue region, it is sent to SOM to make the decision. The simulations indicate that the combination of SVM and SOM has better performance than deploying them individually. [PERSON] et al. [21] propose to modify the IP address of the victim to mitigate DDoS attacks. The DDoS Blocking Application (DBA) running on the controller has a secure channel, which is directly connected to the server. Once the server detects DDoS attacks using some metrics, DBA assigns the server a new IP address and asks switches to redirect packets to this new address. After updating the IP address, if a host still sends packets to the previous address and the number exceeds a predefined threshold, the host is blocked as a bot. The simulation results show that DDoS attacks from bots are blocked. However, how to define the metric and threshold to trigger defence and drop action is not mentioned. [PERSON] et al. [22] present an approach to detect DDoS attacks by the coordination of Monitor, Correlator and Controller. The Monitor part observes network for anomaly detection and triggers an Intrusion Detection System (IDS) to further inspect packets. Once the IDS confirms the attack, it delivers relevant information to the Correlator and alerts the Controller to retrieve the flow table in the switch. If any relevant feature in the flow table matches the suspicious element, the controller instructs the switch to behave according to the prevention actions. Only few works endorse multi-domain networks. [PERSON] et al. [23] propose a multi-controller cluster model, called Protocol for DDoS Attack miTigation in Multi-contrOller SDN networkS (PATMOS). PATMOS has three phases: (i) find the overloaded controller via delay in the control message or its stability, (ii) elect the best performance controller to coordinate mitigation and (iii) minimise the effects of DDoS attacks. Simulation results show the efficiency of PATMOS in reducing CPU utilisation, increasing throughput and decreasing latency.