Dual Log Analysis Rapidly Detects DDoS Attacks in Software-Defined Networks - Bioengineer.org

A research team has designed and evaluated a dual-stage log analysis framework capable of identifying distributed denial-of-service attacks within software-defined networking environments. Published in Discover Networks, the study demonstrates how coupling coarse-grained Shannon entropy filtering with fine-grained Kullback-Leibler divergence verification allows network controllers to recognize malicious traffic surges rapidly.

In simulated tests, the staged architecture attained a true positive rate of 98.5 percent against high-volume transmission control protocol synchronization floods and 96.0 percent against address randomization attacks. Concurrently, the dual-process approach suppressed false positive rates to 1.5 percent while imposing a modest central processing unit overhead of approximately 3.6 percent on the centralized controller.

Software-defined networking vulnerability

Software-defined networking establishes centralized administrative visibility by programmatically isolating the underlying data-forwarding plane from the higher-level control plane. Network administrators direct entire infrastructures through centralized software controllers, such as OpenDaylight, which oversee global network topologies and dynamically distribute operational flow rules.

However, this architectural concentration creates a profound vulnerability because malicious actors targeting the controller can exhaust its finite computational bandwidth through volumetric request floods. Traditional perimeter defense mechanisms struggle to protect software-defined topologies due to rapid fluctuations in dynamic flow entries and an inherent dependence on central controllers for routing decisions.

Two-phase detection approach

To counteract these disruptions without saturating control hardware, the investigators devised a Log Analysis Subsystem operating on both structured flow records and unstructured textual events. The system uses an external log subsystem linked to the controller via transmission control protocol streams, thereby offloading rigorous mathematical verification routines from primary forwarding services.

Central to this detection framework is an in-memory database storage pipeline coupled with a two-phase mathematical filtering sequence. The coarse screening stage leverages Shannon entropy to measure the distribution randomness across specific flow attributes, while the second stage uses Kullback-Leibler divergence calculation to evaluate distributional shifts when preliminary entropy boundaries are violated.

Experimental validation results

Experimental validation was conducted within a virtualized software-defined testbed managed via Mininet, incorporating an OpenDaylight control node, three OpenFlow switches, and simulated endpoint hosts. Baseline non-malicious background communications mimicking typical browsing, bulk file transmissions, and video streams were generated using traffic synthesis tools.

Empirical findings confirmed marked performance advantages for the hybrid approach over standalone entropy baseline systems. Across synchronization flood evaluations, the proposed method achieved a true positive rate of 98.5 percent compared to 92.5 percent for simple entropy mechanisms. Average detection latency remained around 210 milliseconds—a reduction of more than 100 milliseconds compared to baseline approaches.

When evaluated against real-world attack vectors from the CIC-DDoS2019 dataset, the framework maintained an overall detection accuracy of 98.5 percent while registering complete detection cycles within 0.21 seconds. Scalability assessments across expanded virtual topologies confirmed that detection latency stayed consistently below 280 milliseconds, with peak processor overhead capping at 6.8 percent.