# Real-Time Detection of DDoS Attacks Based on Random Forest in SDN
## 3 Materials and Methods
### Real-Time Computing
#### 3.1.2 Distributed Computing  
Distributed Computing Concepts  
Distributed computing is a model of computing that increases computational efficiency and processing power by distributing computational tasks to be executed on multiple computer nodes. In distributed computing, each computing node can perform the same or different tasks, and the nodes communicate and coordinate their work with each other through the network to complete the whole computing task together. Distributed computing can be used for computing tasks in various fields such as processing large-scale data, highly concurrent computing, machine learning, and artificial intelligence. Its advantages include improved computing efficiency, reduced computing costs, enhanced system reliability, and scalability [24]. Distributed computing and centralized computing are related. With the development of the Internet of Things, the scale of data is becoming more and more massive, so the centralized computing of traditional networks can no longer meet the needs of fast computing. Distributed computing, on the other hand, breaks down large amounts of data into many smaller parts, distributes them to multiple nodes for parallel computation and processing, and then merges the results obtained from the computation. This saves overall computation time and improves computation efficiency. This is shown in Figure 2.  
Load Balancing for Distributed Computing  
How to properly schedule nodes for task assignment is one of the important points of distributed computing. However, some current mainstream systems adopt a random task scheduling strategy that ignores the performance differences of nodes and the state of nodes running, thus easily leading to load inequality and performance degradation [25]. To address these problems, we propose a residual weight random polling algorithm to satisfy the efficient execution of tasks. In Algorithm 1, first, the initial weights of each  
Figure 1: Time delay in the network.  
node are calculated. Then, every time T, the real-time consumption weights of each node are counted, the nodes with residual weights are recorded, and the probability of each node being scheduled is calculated. Finally, the nodes are randomly scheduled according to the probability of each node, and if the scheduled node has no remaining weights to process at that time, this node is removed from the remaining weights queue and randomly scheduled again. The residual weight random polling algorithm not only takes into account the increase or decrease of nodes in the SDN controller cluster and runtime state changes, but also performs cluster state statistics every period T and takes into account the inherent initial performance weight and runtime performance weight of each node. If the node has a stronger initial performance and more residual performance, it is more likely to be scheduled.  
Remaining weight of nodes:  
\[W_{i}^{\prime\prime}=W_{i}-W_{i}^{\prime} \tag{2}\]  
Total remaining weight of nodes:  
\[W^{\prime\prime}=\sum_{i=1}^{k}W_{i}^{\prime\prime} \tag{3}\]  
Node scheduling probability:  
\[P_{i}=\frac{W_{i}^{\prime\prime}}{W^{\prime\prime}} \tag{4}\]  
\(W_{i}\) the initial weight of the ith node, \(W_{i}^{\prime}\) the real-time consumption weight of the ith node, \(W_{i}^{\prime\prime}\) the remaining weight of the ith node.