When Time Meets Space: Entropy Integration and Dynamic Threshold for Adaptive DDoS Detection in SDN

2026-08-16

AI Summary

This study addresses the susceptibility of traditional entropy-based detection to IoT traffic fluctuations and the poor adaptability of static thresholds in SDN environments. We propose a lightweight spatiotemporal entropy detector that integrates spatiotemporal metrics with a constrained second-order EWMA dynamic threshold mechanism updated exclusively via normal traffic windows, thereby effectively resisting attack contamination and enabling adaptive detection. Experimental results demonstrate that the proposed model achieves a recall rate of 99.26% and an F1-score of 0.9737 while reducing the false positive rate by 41.74%. With a processing latency of only 3.95 ms, this approach significantly enhances both the accuracy and real-time performance of DDoS detection in SDNs.

Abstract

Entropy-based Distributed Denial of Service (DDoS) detection in Software-Defined Networking (SDN) commonly relies on spatial traffic distributions and static or loosely adaptive thresholds, making it vulnerable to legitimate traffic fluctuations in Internet of Things (IoT) environments. This paper proposes a lightweight spatiotemporal entropy-based detector for DDoS attacks. Spatial entropy is computed from dynamically selected traffic attribute pairs, while temporal entropy captures the randomness of packet inter-arrival times. The two normalized entropy measures are fused into a unified indicator and evaluated using a constrained second-order Exponentially Weighted Moving Average threshold that jointly tracks entropy trend and volatility. To prevent attack-contaminated observations from biasing threshold adaptation, threshold updates are performed only for windows classified as normal. Testbed results show 99.26% recall, a 0.9737 F1-score, and a 3.2% false positive rate (41.74% below that of spatial entropy alone). On CICDDoS2019, the method achieves an FPR of 0 and remains competitive with machine-learning-based methods. It requires 3.95 ms of core processing per window and 11.65% system-wide CPU utilization, supporting resource-constrained edge and IoT deployment.

Problem

• DDoS Detection
• Software-Defined Networking
• Entropy-based Detection
• IoT Traffic Fluctuations
• Adaptive Threshold

Innovation

• Spatiotemporal Entropy
• Dynamic Threshold
• Adaptive DDoS Detection
• Software-Defined Networking
• Lightweight Detection