Entropy-Based DDoS Detection Models in an Unequal Access Software Defined Network

Abstract

Distributed Denial-of-Service (DDoS) attacks represent a persistent and significant threat to Software-Defined Networking (SDN), especially within unequal-access environments characterized by inherently imbalanced traffic distributions among hosts. In these scenarios, conventional entropy-based detection methods particularly those utilizing Shannon’s entropy face substantial limitations due to pronounced traffic variability, undermining the reliability and consistency of detection thresholds. To effectively address these challenges, this research proposes two novel entropy-based detection models designed to enhance both detection accuracy and entropy stability: the ATHA-EM and the HAMMA-EM. Each model integrates a specialized preprocessing algorithm with Shannon entropy, forming lightweight yet robust frameworks for effective DDoS detection. The first model, ATHA-EM, employs the ATHA Algorithm to harmonize synthetic traffic flows with real traffic across network hosts, thereby producing entropy measurements that remain comparable and consistent across hosts. This harmonization significantly mitigates entropy inconsistencies caused by baseline unequal access among hosts. ATHA-EM achieves Bhattacharyya Coefficient (BC) similarity scores in the range of 0.61–0.99 compared to the equal-access baseline. However, it does not fully reduce entropy fluctuations, which may compromise detection precision. To overcome this limitation, the second model, HAMMA-EM, integrates the HAMMA Algorithm with Shannon’s entropy to effectively stabilizing entropy values and mitigating fluctuations under unequal traffic conditions. The HAMMA Algorithm is constructed by integrating AMMA through The ATHA Algorithm, The AMMA algorithm operates through three complementary mechanisms: MDRTF, which normalizes drop behavior across overall traffic, a shrinking-window mechanism that progressively suppresses dominant high-frequency effects, and a cumulative mean of means that stabilizes evolving drop-ratio behavior. Together, these mechanisms effectively mitigate residual entropy fluctuations. Empirical evaluations show that HAMMA-EM improves BC similarity to the equal-access baseline into the 0.93–0.9991 range, enabling a unified, reliable detection threshold. It also achieves Detection Rate (DR) by approximately 96%. Comprehensive evaluations across both equal and unequal access SDN scenarios validate the effectiveness of both models. While ATHA-EM significantly enhances entropy consistency, HAMMA-EM provides superior stability and detection performance, making it a scalable and resilient solution for DDoS mitigation in heterogeneous SDN environments.