SDN Switches Detecting DDoS Attacks via Entropy Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional software-defined networks (SDNs) are vulnerable to DDoS attacks, particularly when they occur between the control plane and data plane, leading to network overload and inability to provide normal service, as existing methods do not effectively detect and protect against such attacks.

Innovation Solution

The SDN architecture includes switches on the data plane that collect packets and detect DDoS attacks using entropy calculations, transmitting warning messages to the controller, thereby distributing the detection process and reducing overload on the control plane.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If DDoS attack detection is performed by centralizing all packet analysis at the controller, then detection accuracy is improved, but the controller becomes overloaded and cannot provide normal service

Engineering Contradiction:

ImproveDDoS attack detection accuracyVSAvoidcontroller service availability

Core Design Contradiction:

Measurement precisionVSReliability

Solution Approach 1:

The patent divides the DDoS detection function between the controller and switches. Each switch independently collects packets and calculates entropy locally, then only transmits necessary information to the controller. This segmentation prevents the controller from being overloaded while maintaining detection accuracy through distributed computation.

Inventive Principle:

Principle #1Segmentation

2Ease of operation

If the SDN architecture is simplified by separating control plane and data plane, then network manageability is improved, but security vulnerability to DDoS attacks increases

Engineering Contradiction:

Improvenetwork manageabilityVSAvoidDDoS attack vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent implements preliminary DDoS detection at each switch before packets reach the controller. By calculating entropy and detecting attack patterns locally in advance, the system prevents malicious packets from overwhelming the controller, thus maintaining the simplicity of SDN architecture while mitigating security vulnerabilities.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If packet collection and analysis is performed at every switch, then distributed detection capability is improved, but network overhead increases

Engineering Contradiction:

Improvedistributed detection capabilityVSAvoidnetwork overhead

Core Design Contradiction:

Adaptability or versatilityVSLoss of energy

Solution Approach 1:

Each switch performs packet collection and entropy calculation locally based on its specific network conditions and traffic patterns. This localized processing enables distributed detection without requiring all switches to perform identical complex analysis, thereby reducing unnecessary network overhead while maintaining adaptive detection capability.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS10637886B2Software defined network capable of detecting DDoS attacks and switch included in the same

Publication Date: 2020.04.28 FOUND OF SOONGSIL UNIV IND COOP

AI summary

Software defined network capable of detecting a DDoS attack and a switch included in the same are disclosed. The software defined network comprises a controller arranged on a control plane of the software defined network, and a plurality of switches arranged on a data plane of the software defined network. Here, each of the switches collects packets received through corresponding external network and detects a DDoS attack by using the collected packets.