# Detection of DDoS Attacks in Software Defined Networking Using Entropy
## 3 Proposed Work  
### Fusion Entropy  
Entropy is an important part of information theory. Entropy can measure the randomness of packets entering the network, which is the main reason for using entropy in DDoS detection. Entropy increases with the increase of randomness and decreases with the decrease of randomness. Common entropy includes information entropy, mean energy, mean Teager Kaiser energy, shannon wavelet entropy and log energy entropy. Considering the probability of using destination IP address in this paper, for the case of only one variable, this paper mainly uses information entropy and log energy entropy and achieves the purpose of improving the detection effect by using complementarity through fusion. To calculate the information entropy, the first is to calculate the probability of the destination IP address. The variable \(x\) is used to define the destination IP address of the packet, and the probability of \(x\) is calculated by using Equation (1). Set the number of packets in the window to \(n\). The probability of each element in the window is defined as \(p\). \[p_{i}=\frac{x_{i}}{\sum_{i=1}^{n}x_{i}} \tag{1}\]  
In Equation (1), \(i=\{1,2,3...n\}\), \(0\leq p_{i}\leq 1\). Then calculate information entropy, the calculation formula is Equation (2). \(H\) is the information entropy of the destination IP address of packets appearing in a specific window. \[H1=-\sum_{i=1}^{n}p_{i}\log p_{i} \tag{2}\]Log energy entropy as another kind of entropy, its calculation formula is shown in Equation (3). In Equation (3), \(n\) and \(p_{i}\) still represent the number of packets and the probability of destination IP addresses. \[H2=-\sum_{i=1}^{n}\log{p_{i}}^{2} \tag{3}\]  
Through research and experiments, it is found that the entropy value of information entropy will be significantly reduced when an attack occurs, but the attack cannot be detected quickly, while the log energy entropy can quickly detect the attack, but the entropy value is not as obvious as the information entropy. This paper considers the fusion of the two entropies through weighting, so as to achieve complementary effects. Since \(p\) ranges from 0 to 1, according to the mathematical properties of the logarithmic function, the log energy entropy will get a negative value. In order to better integrate with the information entropy, we multiply the log energy entropy by minus one and weighted with information entropy. This change is shown in Equation (3). The selection of weight is based on the change rate of entropy decline of the two kinds of entropy when the attack occurs. The fusion entropy calculation is shown in Equation (4). In Equation (4), 0.75 in weight \(w_{1}\) is the change rate of entropy corresponding to information entropy, while 0.13 in weight \(w_{2}\) is the change rate of entropy corresponding to log energy entropy. The subsequent experimental results show that the fusion entropy effectively realizes the complementary advantages of information entropy and log energy entropy, which can not only quickly detect the attack but also have a high decline rate of entropy. \[ \begin{array}{l}H3\ =\ w_{1}*H1\ +\ w_{2}*H2\\ w_{1}\ =\ \frac{0.75}{0.75\ +\ 0.13}\\ w_{2}\ =\ \frac{0.13}{0.75\ +\ 0.13}\end{array}  \tag{4}\]  
When multiple data packets are received on the same host or switch port in a specific window and the number of data packets exceeds the threshold, DDoS attacks are detected. The basic steps handled by this detection method are shown in Figure 2. During an attack, if the computation entropy of a specified window continuously drops below the threshold, the target port on the specified switch is blocked. In the experiment, data packets will continuously flow into the network. For each incoming packet, the entropy is calculated. If the entropy value is higher than or equal to the threshold, the next calculation will be carried out normally. If the entropy value falls below the threshold, the packet is logged. The threshold is determined based on the entropy fluctuation range in normal traffic scenarios.