## 3 Proposed Approach
\[EWMA_{i}=(1-\alpha)\cdot EWMA_{i-1}+\alpha\cdot Y_{i} \tag{2}\]  
where the \(Y_{i}\) value is observed at a particular \(t\) time and \(EWMA_{i}\) is the mean of historical data. In the proposed approach, \(Y_{i}\) is exchanged with \(H_{RJ\alpha}(x,y)_{i}\), as shown in Equation (3), to compute the randomness of both the source and the destination IP addresses of the packet header features. \[EWMA_{i}=(1-\alpha)\cdot EWMA_{i-1}+\alpha\cdot H_{RJ\alpha}(x,y)_{i} \tag{3}\]  
where \(EWMA_{i}\) is the current value of the EWMA and \(EWMA_{i-1}\) is the previously calculated EWMA value. The initial value of the threshold adopted in this research is 1.31, based on the calculation by [43], which allows accurate calculation of the first value of the dynamic threshold. \(H_{RJ\alpha}(x,y)_{i}\) is the currently measured value; therefore, the assumed current value is a Renyi joint entropy value for a specific time duration (a single-window size), and \(\alpha\) is the smoothing factor that filters the noise of \(H_{RJ\alpha}(x,y)_{i}\) and stabilizes EMWA; \(i\geq 1\), \(0<\alpha<1\) because the new threshold will be more precise based on the experiments to limit the value of false negative error, although this choice is somewhat arbitrary [40]. Moreover, the proposed approach depends on a rule-based detection mechanism, which has been used to detect DDoS attacks against the controller based on a statistical analysis of incoming network traffic flows. The proposed rule is based on the Renyi joint entropy value and dynamic threshold. A low- or high-rate DDoS attack within \(t\) time (window size) exists if the \(H_{RJ\alpha}(x,y)\) value is less than the \(Th\) value; otherwise, the traffic is considered normal. Figure 1 shows the flowchart of the rule-based DDoS detection mechanism. In Figure 1, \(Th\) is a dynamic threshold (refer to Equation (3)) and \(H_{RJ\alpha}(x,y)\) denotes Renyi joint entropy (refer to Equation (1)). As stated before, contrary to some existing DDoS attack detection approaches that use a static threshold, as listed in Table 1, the proposed approach considers the rate and dynamic threshold of incoming attack traffic that feed the proposed rule-based detection mechanism to accurately detect DDoS attacks, regardless of attack traffic rates (low or high). In a nutshell, the proposed adaptive dynamic threshold formula is capable of accurately detecting different DDoS attack traffic rates targeted at a single host victim or multiple host victims with a low false positive rate. Equation (3) is a general dynamic  
Figure 1: Rule-based DDoS detection mechanism. threshold formula used to find the optimal dynamic threshold based on Renyi joint entropy (refer to Equation (1)). Renyi joint entropy measures the randomness of the source and destination IP addresses of a packet in the network traffic flow that occurred within time \(t\), which is used as a clue for detecting low- and high-rate DDoS attacks on an SDN controller, and proposes a new rule mechanism based on the dynamic threshold value and Renyi joint entropy value. We use several scenarios to evaluate how the dynamic threshold method impacts the detection approach for low and high DDoS attack traffic rates. Thus, the optimal dynamic threshold value is found using various attack scenarios involving various attack sources (single or multiple hosts) that target single or multiple victim hosts. Based on this, the incoming packet's behavior changes over time due to varying attack sources. As previously stated, the EWMA algorithm defines a dynamic threshold depending on changes in network traffic flow situations. Thus, the values keep changing through calculations automatically based on the evaluation of the current network traffic flow situation at a particular time. The adaptive threshold method facilitates attack detection. An attack is detected when the traffic behavior computed during a specified time exceeds or falls below the threshold value.