## 2 Related Work
### DDoS Attacks on SDN  
As DDoS attacks have different behaviours, several techniques are used to detect and block those attacks. [PERSON] et al. (2016) define a table in the controller to track the packets by IP address during a DDoS attack. All the new packets are regarded as suspicious packets and assigned a small timeout value in the flow entry. The number of packets using that connection is also compared with a minimum value to determine if it is a normal request or an attack. From the simulation, this method effectively reduces flow entries in the switch, and the bandwidth of controller-switch channel is still available during DDoS attacks. However, this mechanism consumes a huge amount of resources on the controller if the attacker modifies source address. [PERSON] and [PERSON] (2016) propose to use entropy for DDoS detection due to its ability to measure randomness, where two essential components are time period and threshold. Although it may improve detection accuracy in the real network, the proposed techniques only address detection without providing countermeasures. Similarly, [PERSON] et al. (2016) suggest a statistical tool, called Sequential Probability Ratio Test (SPRT), to improve existing false positive and false negative issues. It predefines two boundaries (A and B, B \(<\) A) related to the probabilities of false positive (a) and false negative (b) (it is suggested A = b/(1 - a), B = (1 - b)/a), and the decision is made from the log-probability ratio. The evaluation of the DARPA Intrusion Detection Data Sets ([PERSON] et al., 2016) shows its promptness and accuracy. However, the proposed method is evaluated using only mathematical results without simulations, where random variables can be introduced. [PERSON] et al. (2016) propose a \"Multislot\" strategy to process requests in each time slot so that legitimate users can communicate to each other properly during DDoS attacks. However, if the subscriber and attacker share the same switch port, large flow latency will be introduced because it places the legitimate and malicious request in the same queue. [PERSON] et al. (2016) propose to use a \"flow collector\", which sits between the switch and the controller. When the number of invalid packets exceeds the threshold within a certain duration, the flow collector is triggered to further inspect those suspicious packets. However, this introduces a delay to legitimate users. Furthermore, there is no mathematical analysis, simulations or real implementation. [PERSON] and [PERSON] (2016) define a peak time and establish a trust level to defend control and data planes against DDoS attacks. The node's trust level is used to determine the priority of processes on the controller, where the value is set depending on the behaviour during normal time. During peak time, the controller discards requests from particular nodes whose number of requests already exceeds a certain threshold. Even for  
\begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Algorithm** & **Simulation** & **Real Implementation** & **Detection or Defence** & **Control or Data Plane** & **Advantages** & **Disadvantages** \\ \hline [PERSON] et al. (2016) & ✗ & ✓ & Both & Data Plane & Detection is based on the IoT application, which means the behaviour in the network is predictable for a specific application. & The performance of detection might highly rely on the habit of using the application. For a flexible application, it could result to a low accuracy in the detection. & The performance of detection might highly rely on the habit of using the application. For a flexible application, it could result to a low accuracy in the detection. & [PERSON] and [PERSON] (2016) define a peak time and establish a trust level to defend control and data planes against DDoS attacks. The node’s trust level is used to determine the priority of processes on the controller, where the value is set depending on the behaviour during normal time.