ANALYSIS OF SOFTWARE-DEFINED NETWORK TRAFFIC USING ENTROPY

Abstract

Software-defined networking (SDN) is an approach to building a network that uses software controllers or application programming interfaces (APIs) to communicate with the underlying hardware infrastructure and route network traffic instead of physical routers and switches. Software-defined networks use a centralized controller, so ensuring the reliability of its operation is very important for the functioning of the network. The issue of security becomes especially acute when the number of network users increases. One of the biggest and most common threats to software-defined networks is a distributed denial of service (DDoS) attack. To detect network attacks, statistical characteristics of network traffic such as the sample mean, sample variance, Pearson's chi-square test, and the information-theoretic measure entropy can be used. Quantitatively, entropy is characterized using the entropy of C. Shannon's probability distribution. Information entropy is a measure of uncertainty associated with a random variable. Entropy characterizes the probability with which a certain state is established, it is a measure of chaos or irreversibility. The greater the chaos of the system, the higher the value of entropy, and vice versa. Software complexes are based on entropy analysis of network data recorded by NetFlow sensors. Typical sensors connect to TAP or SPAN ports on switches. Streams are analyzed during fixed time intervals. The collected streams are registered in a database and then analyzed. Anomaly filters are provided by direction, protocol, and subnet. Next, the entropy value of positive and negative values of α for the distribution of motion characteristics is calculated. In the detection step, the observed entropy is compared with the minimum and maximum values stored in the profile, and an anomaly threshold is determined. Threshold values less than 0 or greater than 1 indicate abnormal concentration or variance, respectively. One solution to detect such attacks is to use fusion entropy. This method allows you to detect DDoS attacks in a time close to real, and the entropy values for normal and malicious traffic differ by 90%.