ISSN 1000-1239 CN 11-1777/TP

Journal of Computer Research and Development ›› 2019, Vol. 56 ›› Issue (5): 909-918.doi: 10.7544/issn1000-1239.2019.20190017

Special Issue: 2019智能网络理论与关键技术专题

Previous Articles     Next Articles

DDoS Attack Detection Model Based on Information Entropy and DNN in SDN

Zhang Long, Wang Jinsong   

  1. (School of Computer Science and Engineering, Tianjin University of Technology, Tianjin 300384) (National Engineering Laboratory for Computer Virus Prevention and Control Technology (Tianjin University of Technology), Tianjin 300457) (Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology (Tianjin University of Technology), Tianjin 300384)
  • Online:2019-05-01

Abstract: The software defined networking (SDN) decouples the data layer and the control layer of the network, but the controller is in danger of “single node invalidation ”. Attackers launch DDoS attacks to disable the controller and threaten the safety of networks. This paper presents a DDoS detection model based on entropy and deep neural network (DNN), which includes the initial detection module based on entropy-based detection method and the further detection module based on DNN. The initial detection module finds out the suspicious traffic in the network preliminarily by calculating the entropy of source and destination IP address, and then the suspected abnormal traffic with DNN-based DDoS detection module confirms the anomaly traffic. Experiments show that this model has higher recognition rate and accuracy rate than the traditional detection algorithm based on entropy or machine learning. At the same time, the model can shorten the detection time and improve the efficiency of resource utilization.

Key words: software defined networking (SDN), anomaly detection, distributed denial of service (DDoS), information entropy, deep neural network (DNN)

CLC Number: