A Hybrid Mechanism to Detect DDoS Attacks in Software Defined Networks

DDoS(Distributed Denial-of-Service)attacks are among the cyberattacks that are increasing day by day and have caused problems for computer network servers. With the advent of SDN networks, they are not immune to these attacks, and due to the software-centric nature of these networks, this type of attack can be much more difficult for them, ignoring effective parameters such as port and Source IP in detecting attacks, providingcostly solutions which are effective in increasing CPU load, and low accuracy in detecting attacks are of the problems of previously presented methods in detecting DDoS attacks. Given the importance of this issue,the purpose of this paper is to increase the accuracy of DDoS attack detection using the second ordercorrelation coefficient technique based on ∅-entropy according to source IP and selection of optimal features.To select the best features, by examining the types of feature selection algorithms and search methods, the WrapperSubsetEval feature selection algorithm, the BestFirst search method, and the best effective features were selected.This study was performed on CTU-13 and ISOT datasets and the results were compared with other methods. The accuracy of the detection in this work indicates the high efficiency of the proposed approach compared to other similar methods.