  The current paper addresses relevant network security vulnerabilities
introduced by network devices within the emerging paradigm of Internet of
Things (IoT) as well as the urgent need to mitigate the negative effects of
some types of Distributed Denial of Service (DDoS) attacks that try to explore
those security weaknesses. We design and implement a Software-Defined Intrusion
Detection System (IDS) that reactively impairs the attacks at its origin,
ensuring the normal operation of the network infrastructure. Our proposal
includes an IDS that automatically detects several DDoS attacks, and then as an
attack is detected, it notifies a Software Defined Networking (SDN) controller.
The current proposal also downloads some convenient traffic forwarding
decisions from the SDN controller to network devices. The evaluation results
suggest that our proposal timely detects several types of cyber-attacks based
on DDoS, mitigates their negative impacts on the network performance, and
ensures the correct data delivery of normal traffic. Our work sheds light on
the programming relevance over an abstracted view of the network infrastructure
to timely detect a Botnet exploitation, mitigate malicious traffic at its
source, and protect benign traffic.
