SynFloWatch: A Detection System against TCP-SYN based DDoS Attacks using Entropy in Hybrid SDN
Mitali Sinha
Abstract
The emergence of hybrid software-defined networks (SDNs) that combine traditional network infrastructure with SDN creates new security challenges, particularly regarding TCP-SYN-based Distributed Denial-of-Service (DDoS) attacks. These attacks flood both the controller and victim servers with a large volume of spoofed TCP-SYN packets, leading to network malfunctions. In this paper, we have designed SynFloWatch in the SDN control layer to detect DDoS attacks by employing Tsallis entropy analysis on network traffic directed towards the controller w.r.t destination IP parameter. SynFloWatch is implemented in Floodlight controller and extensive experiments have been conducted under various attack scenarios. The experimental results show that SynFloWatch is able to detect both low and high rate SYN-flood attacks with an increased accuracy of 25% as compared to existing solutions.