Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a lightweight spatiotemporal entropy-based DDoS detection method for Software-Defined Networking (SDN) that addresses the limitations of traditional static thresholds by dynamically adapting to traffic patterns. By integrating spatial and temporal entropy measures, the proposed approach effectively captures the randomness of traffic and utilizes a constrained second-order Exponentially Weighted Moving Average for threshold adaptation, ensuring resilience against legitimate traffic fluctuations. Testbed evaluations demonstrate impressive performance metrics, including a 99.26% recall and a 0.9737 F1-score, significantly reducing false positives compared to existing methods.
Achieving a 99.26% recall and zero false positives, this novel DDoS detection method adapts dynamically to traffic patterns, outperforming traditional static approaches.
Entropy-based Distributed Denial of Service (DDoS) detection in Software-Defined Networking (SDN) commonly relies on spatial traffic distributions and static or loosely adaptive thresholds, making it vulnerable to legitimate traffic fluctuations in Internet of Things (IoT) environments. This paper proposes a lightweight spatiotemporal entropy-based detector for DDoS attacks. Spatial entropy is computed from dynamically selected traffic attribute pairs, while temporal entropy captures the randomness of packet inter-arrival times. The two normalized entropy measures are fused into a unified indicator and evaluated using a constrained second-order Exponentially Weighted Moving Average threshold that jointly tracks entropy trend and volatility. To prevent attack-contaminated observations from biasing threshold adaptation, threshold updates are performed only for windows classified as normal. Testbed results show 99.26% recall, a 0.9737 F1-score, and a 3.2% false positive rate (41.74% below that of spatial entropy alone). On CICDDoS2019, the method achieves an FPR of 0 and remains competitive with machine-learning-based methods. It requires 3.95 ms of core processing per window and 11.65% system-wide CPU utilization, supporting resource-constrained edge and IoT deployment.