Abstract

In view of the problem that detecting DDoS attacktraffic in traditional SDN depends on the controllercontinuously collecting traffic and running the detection model,resulting in excessive controller overhead, low detectionefficiency, increased traffic forwarding delay, and easy to cause"single point of failure", a cooperative detection method ofDDoS attack in SDN based on information entropy and deeplearning is proposed, which divides part of the detection taskinto the data plane for detection based on information entropyand uses the improved CNN-BiLSTM model to detect DDoSattack traffic on control plane. The experimental results showthat, compared with the SVC-RF method in recent years, theaccuracy of the proposed CNN-BiLSTM model is increased by0.74%, the detection rate is increased by 1.42%, and the falsealarm rate is reduced by 1.5%. Compared with the BiLSTMmodel, the accuracy is increased by 0.75%, the detection rate isincreased by 0.64%, and the false alarm rate is reduced by1.14%. Compared with the RF method, the accuracy isincreased by 2.34%, the detection rate is increased by 3.88%,and the false alarm rate is reduced by 4%. Compared with thetraditional single point detection method which only depends onthe controller, the proposed switch-controller cooperativedetection method reduces the CPU occupancy of the controllerby about 12% and the detection time by about 13 seconds.