CFP last date
20 November 2026
Call for Paper
December Edition
IJCA solicits high quality original research papers for the upcoming December edition of the journal. The last date of research paper submission is 20 November 2026

Submit your paper
Know more
The week's pick
Responsive image
A Machine Learning-based Decision Framework for Demand Forecasting and Price Optimization in Competitive E-Commerce Environments

Aera K. Leboulluec Janhavi Datye
Random Articles
Reseach Article

A Lightweight Flow-Statistics-based DDoS Detection and Mitigation Mechanism in SDN

by Yang Yang, Shu Jiang, Hong Ye, Yanyi She, Ming Liu, Yuefeng Li
journal cover thumbnail

International Journal of Computer Applications
Foundation of Computer Science (FCS), NY, USA
Volume 187 - Number 146
Year of Publication: 2026
Authors: Yang Yang, Shu Jiang, Hong Ye, Yanyi She, Ming Liu, Yuefeng Li
10.5120/ijca66aa6399afa5

Yang Yang, Shu Jiang, Hong Ye, Yanyi She, Ming Liu, Yuefeng Li . A Lightweight Flow-Statistics-based DDoS Detection and Mitigation Mechanism in SDN. International Journal of Computer Applications. 187, 146 ( Oct 2026), 47-52. DOI=10.5120/ijca66aa6399afa5

@article{ 10.5120/ijca66aa6399afa5,
author = { Yang Yang, Shu Jiang, Hong Ye, Yanyi She, Ming Liu, Yuefeng Li },
title = { A Lightweight Flow-Statistics-based DDoS Detection and Mitigation Mechanism in SDN },
journal = { International Journal of Computer Applications },
issue_date = { Oct 2026 },
volume = { 187 },
number = { 146 },
month = { Oct },
year = { 2026 },
issn = { 0975-8887 },
pages = { 47-52 },
numpages = {9},
url = { https://ijcaonline.org/archives/volume187/number146/a-lightweight-flow-statistics-based-ddos-detection-and-mitigation-mechanism-in-sdn/ },
doi = { 10.5120/ijca66aa6399afa5 },
publisher = {Foundation of Computer Science (FCS), NY, USA},
address = {New York, USA}
}
%0 Journal Article
%1 2026-10-24T03:08:31+05:30
%A Yang Yang
%A Shu Jiang
%A Hong Ye
%A Yanyi She
%A Ming Liu
%A Yuefeng Li
%T A Lightweight Flow-Statistics-based DDoS Detection and Mitigation Mechanism in SDN
%J International Journal of Computer Applications
%@ 0975-8887
%V 187
%N 146
%P 47-52
%D 2026
%I Foundation of Computer Science (FCS), NY, USA
Abstract

Software-defined networking (SDN) provides centralized control and programmable flow management, making it suitable for dynamic detection and mitigation of distributed denial-of-service (DDoS) attacks. This paper proposes a lightweight flow-statistics-based DDoS detection and mitigation mechanism for SDN. The controller periodically collects OpenFlow flow statistics and extracts four interpretable indicators: aggregated packet rate, source count, flow count, and normalized source-address entropy. A destination is first marked as a candidate attack target when all four traffic conditions are simultaneously satisfied, and a DDoS attack is confirmed only when the suspicious state persists for a predefined duration, thereby suppressing alarms caused by transient traffic bursts. Once an attack is confirmed, the controller dynamically installs high-priority source-specific drop rules and uses an OpenFlow barrier mechanism to confirm mitigation-rule processing. Experiments were conducted in a Mininet environment using Ryu, Open vSwitch, and OpenFlow 1.3. Low-, medium-, and high-rate UDP DDoS scenarios were independently repeated three times, with observed packet rates of 481.81 ± 1.09 pps, 964.00 ± 0.98 pps, and 1606.10 ± 1.08 pps, respectively. The attack-confirmation duration remains approximately 1 s, while the mean barrier-confirmed mitigation delay ranges from 0.7938 ms to 0.8878 ms. A 0.5-s multi-source burst satisfies the traffic-feature conditions but is not confirmed as a DDoS attack, demonstrating the effectiveness of the suspicious-duration mechanism. Additional experiments show that TCP SYN and ICMP flooding attacks can also be successfully detected and mitigated. The installed source-specific rules effectively block attack traffic while preserving legitimate communication with the victim host.

References
  1. N. McKeown, T. Anderson, H. Balakrishnan, et al., “OpenFlow: Enabling innovation in campus networks,” ACM SIGCOMM Comput. Commun. Rev., vol. 38, no. 2, pp. 69–74, 2008.
  2. D. Kreutz, F. M. V. Ramos, P. E. Verissimo, et al., “Software-defined networking: A comprehensive survey,” Proc. IEEE, vol. 103, no. 1, pp. 14–76, 2014.
  3. Q. Yan, F. R. Yu, Q. Gong, et al., “Software-defined networking (SDN) and distributed denial of service (DDoS) attacks in cloud computing environments: A survey, some research issues, and challenges,” IEEE Commun. Surveys Tuts., vol. 18, no. 1, pp. 602–622, 2015.
  4. J. Singh and S. Behal, “Detection and mitigation of DDoS attacks in SDN: A comprehensive review, research challenges and future directions,” Comput. Sci. Rev., vol. 37, Art. no. 100279, 2020.
  5. R. Braga, E. Mota, and A. Passito, “Lightweight DDoS flooding attack detection using NOX/OpenFlow,” in Proc. IEEE Local Computer Network Conf., 2010, pp. 408–415.
  6. S. M. Mousavi and M. St-Hilaire, “Early detection of DDoS attacks against SDN controllers,” in Proc. 2015 Int. Conf. Computing, Networking and Communications (ICNC), 2015, pp. 77–81.
  7. K. Giotis, C. Argyropoulos, G. Androulidakis, et al., “Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments,” Comput. Netw., vol. 62, pp. 122–136, 2014.
  8. K. S. Sahoo, D. Puthal, M. Tiwary, et al., “An early detection of low rate DDoS attack to SDN based data center networks using information distance metrics,” Future Gener. Comput. Syst., vol. 89, pp. 685–697, 2018.
  9. J. Cui, M. Wang, Y. Luo, et al., “DDoS detection and defense mechanism based on cognitive-inspired computing in SDN,” Future Gener. Comput. Syst., vol. 97, pp. 275–283, 2019.
  10. S. Dong and M. Sarem, “DDoS attack detection method based on improved KNN with the degree of DDoS attack in software-defined networks,” IEEE Access, vol. 8, pp. 5039–5048, 2019.
  11. P. Manso, J. Moura, and C. Serrão, “SDN-based intrusion detection system for early detection and mitigation of DDoS attacks,” Information, vol. 10, no. 3, Art. no. 106, 2019.
  12. A. Ahalawat, K. S. Babu, A. K. Turuk, et al., “A low-rate DDoS detection and mitigation for SDN using Renyi entropy with packet drop,” J. Inf. Secur. Appl., vol. 68, Art. no. 103212, 2022.
  13. K. Jia, C. Liu, Q. Liu, et al., “A lightweight DDoS detection scheme under SDN context,” Cybersecurity, vol. 5, no. 1, Art. no. 27, 2022.
  14. Y. Liu, T. Zhi, M. Shen, et al., “Software-defined DDoS detection with information entropy analysis and optimized deep learning,” Future Gener. Comput. Syst., vol. 129, pp. 99–114, 2022.
  15. L. F. Eliyan and R. Di Pietro, “DeMi: A solution to detect and mitigate DoS attacks in SDN,” IEEE Access, vol. 11, pp. 82477–82495, 2023.
  16. A. I. Hassan, E. A. El Reheem, and S. K. Guirguis, “An entropy and machine learning based approach for DDoS attacks detection in software defined networks,” Sci. Rep., vol. 14, no. 1, Art. no. 18159, 2024.
  17. M. Yue, H. Yan, R. Han, et al., “A DDoS attack detection method based on IQR and DFFCNN in SDN,” J. Netw. Comput. Appl., vol. 240, Art. no. 104203, 2025.
  18. B. Pfaff, J. Pettit, T. Koponen, et al., “The design and implementation of Open vSwitch,” in Proc. 12th USENIX Symp. Networked Systems Design and Implementation (NSDI 15), 2015, pp. 117–130.
  19. B. Lantz, B. Heller, and N. McKeown, “A network in a laptop: Rapid prototyping for software-defined networks,” in Proc. 9th ACM SIGCOMM Workshop on Hot Topics in Networks, 2010, pp. 1–6.
  20. K. Rui, F. Tomonori, A. Yuji, et al., “Ryu SDN framework—Open-source SDN platform software,” NTT Tech. Rev., vol. 12, no. 8, pp. 18–22, 2014.
Index Terms

Computer Science
Information Sciences

Keywords

Software-defined networking; DDoS detection; flow statistics; normalized entropy; OpenFlow; dynamic mitigation

Powered by PhDFocusTM