# Detection of DDoS Attacks in Software Defined Networking Using Entropy
## 1 Introduction  
SDN breaks the shackles of traditional network complexity and coupling and makes it possible for network architecture to satisfy flexibility, reliability and security at the same time. It separates the control plane from the data plane and separates the control function of the network from the data forwarding function [1]. The control plane is only responsible for routing decisions, while the data plane realizes these decisions by forwarding packets and other behaviors. The separation of the two planes can improve the abstraction and programming ability of the network and makes the network structure less tedious and redundant. Centralized control and implementation of network programming solve the interdependence problem in three planes which are control plane, data plane and application plane. The control plane communicates with the application plane through northbound API. The southbound API is mainly the OpenFlow protocol, through which the control plane is able to communicate with the data plane. Essentially, SDN provides a brain (controller) for the underlying network, making each network plane device centrally programmable [2] and giving the administrator absolute control over the use of software to manage network functions through a centralized control point. Although SDN architecture has many advantages compared with traditional network, it is often subjected to network threats and attacks. Network threats to SDN are mainly reflected in security device licensing and global view acquisition [3]. Because packets are passed according to flow rules, physical security devices do not have the right to decide, and attackers can bypass security devices before deployment. The controller is the core of the entire network and can obtain various network status information. The attacker can use the controller to directly grasp the global view of the network to launch serious attacks. SDN has a clear plane structure, and the attack objects at different planes are different. At the control plane, because the controller manages the entire network, an attacker damaging the controller can cause serious damage. Controllers are the main targets of attacks in recent years. In emerging SDN deployment scenarios such as data centers, the centralized control plane is the main cornerstone, which makes SDN more scalable [4]. The controller has the right of absolute control over the whole SDN. They communicate with switches through commands and perform network operations through packet switching and routing SDN applications. It acts as a core brain, controlling the forwarding operation of the data plane and managing the traffic behavior of the entire network. The controller has the unique property of providing a global view of the network, making it the highest priority target in the network [5]. The global view of the network includes flow rules for network devices and various statistics. The main security challenges on the control plane are as follows:  
* Application threats: Applications implemented on the control plane may seriously threaten the security of the control plane. * Scalability Threats: Due to lack of scalability, the control plane gradually becomes saturated and cannot handle more flows [6]. * DDoS attack: Controllers are vulnerable to DDoS attacks [7]. When receiving a packet, the switch matches the packet with the flow table entry. If the packet fails to match, the switch encapsulates the packet header into a packet_in message and sends the packet to the controller. When an attacker sends a large number of packets to the network, the switch forwards these packets to the controller. A large number of DDoS spoofing packets exhaust controller resources and make the controller unable to work properly, posing serious threats to the controller and the entire network. * Other threats: Inconsistent and conflicting controller configurations may result in failure to receive network information [8]. Malicious applications can easily be developed to apply to controllers.