A Dynamic Entropy-Based Approach for DDoS Protection in Software-Defined Networks

5G has initiated a strong trend toward network softwarization, which is expected to intensify with 6G. At the core of this shift, Software-Defined Networking (SDN) enables a programmable control plane but also broadens the attack surface. This work examines volumetric random-source Distributed Denial of Service (DDoS) attacks in SDN, where the exploitation of table misses in OpenFlow devices generates massive PACKET-IN floods toward the controller, potentially disrupting flow rule management or even compromising network stability. To address this security issue, an entropy-based detection mechanism is proposed, also introducing a dynamic and network-aware computation of the proposal’s hyper-parameters, such as the entropy threshold and the PACKET-IN message window used to analyse the network behavior. Additionally, a mitigation technique is applied by exploiting the meter table provided by the OpenFlow specification, limiting the impact of malicious entities. Experiments show that the proposed solution adapts to network conditions and attack rates, outperforming static entropy-based approaches that ignore traffic dynamics.