## 3 DDoS Attack Behavior  
A low-rate DDoS attack has characteristics similar to normal network traffic in traffic patterns [21]. Conversely, a high-rate DDoS attack is distinguishable from normal traffic. In addition, low-rate DDoS attacks targeting multiple or single victims are more challenging to detect with low FPR and high DR.  
In DDoS attack scenarios, an attacker typically spoofs the source IP addresses of the generated packets with many unique IP addresses, resulting in many spoofed packets without matching rules in the switch table's flow entries (flow table). Consequently, the process forces the switch to forward all the packets to a controller for additional processing to develop new instructions for dealing with the incoming packets. Making matters worse, an attacker constantly generates and sends new spoofed packets into the network until the SDN controller becomes exhausted.  
As for the controller's performance under a DDoS attack, the efficiency is remarkably affected due to treating and managing all new incoming packets that lead to denying legitimate users from accessing services or resources, which could result in an entire SDN network's collapse [5].  
The role of a detection approach is to identify DDoS attack behavior using observations of the entire SDN network traffic flows from the hosts toward the destination. However,  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Author (Year)** & **Method** & & **Strengths** & **Drawbacks** \\ \hline \multirow{4}{*}{[PERSON] et al. [16]} & \multirow{4}{*}{Entropy} & - & Detecting high & \multirow{4}{*}{-} & Low attack \\  & & & DDoS attack & & detection rate for \\  & & & traffic rate with & & detecting low-rate \\  & & & a high & & attack traffic \\  & & & detection rate & & \\ \hline \multirow{4}{*}{[PERSON] et al. [17]} & \multirow{4}{*}{Entropy} & - & Lightweight & \multirow{4}{*}{-} & \multirow{4}{*}{Low attack} \\  & & - & Detecting & & detection rate for \\  & & & high-rate DDoS & & detecting low-rate \\  & & & attack traffic & & attack traffic \\  & & & with a high & & \\  & & & detection rate & & \\ \hline \multirow{4}{*}{[PERSON] et al. [18]} & \multirow{4}{*}{Generalized entropy} & \multirow{4}{*}{-} & \multirow{4}{*}{Detects high-rate} & - & False-positive rate \\  & & & increases during & \\  & & & different attack & traffic rates \\  & & & DDoS attacks & - & Low attack \\  & & & targeting a single & detection rate \\  & & & victim efficiently & & for detecting \\  & & & & low-rate attack \\  & & & & traffic targeting \\  & & & & multiple victims \\ \hline \multirow{4}{*}{[PERSON] et al. [19]} & IDS based & - & \multirow{4}{*}{DDoS attack} & - & Ineffective in \\  & & on machine & & classification & identifying \\  & & learning models & & & low-rate DDoS \\  & & & & attacks that target \\  & & & & multiple victims \\ \hline \multirow{4}{*}{[PERSON] et al. [20]} & \multirow{4}{*}{Entropy} & \multirow{4}{*}{-} & \multirow{4}{*}{Avoids the dropping of legitimate packets} & - & Delay in \\  & & & & processing new \\ \cline{1-1}  & & & & packets \\ \cline{1-1}  & & & & packets & \\ \cline{1-1}  & & & & detecting low-rate \\ \cline{1-1}  & & & & attack traffic \\ \cline{1-1}  & & & & that targets \\ \cline{1-1}  & & & & multiple victims \\ \hline \hline \end{tabular}
\end{table}
Table 1: Summary of work related to DDoS detection approaches against SDN.  
other existing detection approaches might observe all the network traffic flow incorrectly, which is one of the reasons for their inability to detect low-rate and high-rate DDoS attacks with a high DR and a low FPR [22]. Therefore, to overcome the abovementioned issues, the incoming network traffic must be collected from the hosts to be analyzed and used as input for the detection approach. This study also aims to analyze the entropy algorithm's impact on detecting low-rate and high-rate DDoS attacks against the SDN controller that target a single and multiple victims' hosts with a high DR and a low FPR.