{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,27]],"date-time":"2026-06-27T20:20:26Z","timestamp":1782591626153,"version":"3.54.5"},"reference-count":32,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2021,4,13]],"date-time":"2021-04-13T00:00:00Z","timestamp":1618272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2021,4,13]],"date-time":"2021-04-13T00:00:00Z","timestamp":1618272000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Basic Research Program of China","doi-asserted-by":"publisher","award":["2017YFC0803400"],"award-info":[{"award-number":["2017YFC0803400"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Wireless Com Network"],"published-print":{"date-parts":[[2021,12]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>In order to solve the problem of distributed denial of service (DDoS) attack detection in software-defined network, we proposed a cooperative DDoS attack detection scheme based on entropy and ensemble learning. This method sets up a coarse-grained preliminary detection module based on entropy in the edge switch to monitor the network status in real time and report to the controller if any abnormality is found. Simultaneously, a fine-grained precise attack detection module is designed in the controller, and a ensemble learning-based algorithm is utilized to further identify abnormal traffic accurately. In this framework, the idle computing capability of edge switches is fully utilized with the design idea of edge computing to offload part of the detection task from the control plane to the data plane innovatively. Simulation results of two common DDoS attack methods, ICMP and SYN, show that the system can effectively detect DDoS attacks and greatly reduce the southbound communication overhead and the burden of the controller as well as the detection delay of the attacks.<\/jats:p>","DOI":"10.1186\/s13638-021-01957-9","type":"journal-article","created":{"date-parts":[[2021,4,13]],"date-time":"2021-04-13T04:03:48Z","timestamp":1618286628000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":44,"title":["A cooperative DDoS attack detection scheme based on entropy and ensemble learning in SDN"],"prefix":"10.1186","volume":"2021","author":[{"given":"Shanshan","family":"Yu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4295-2950","authenticated-orcid":false,"given":"Jicheng","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3160-9233","authenticated-orcid":false,"given":"Ju","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaoqing","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yafeng","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tianfeng","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2021,4,13]]},"reference":[{"issue":"1","key":"1957_CR1","doi-asserted-by":"publisher","first-page":"602","DOI":"10.1109\/COMST.2015.2487361","volume":"18","author":"Q Yan","year":"2016","unstructured":"Q. Yan, F.R. Yu, Q. Gong, J. Li, Software-defined networking (SDN) and distributed denial of service (DDoS) attacks in cloud computing environments: a survey, some research issues, and challenges. IEEE Commun. Surv. Tutor. 18(1), 602\u2013622 (2016)","journal-title":"IEEE Commun. Surv. Tutor."},{"issue":"2","key":"1957_CR2","doi-asserted-by":"publisher","first-page":"404","DOI":"10.1049\/cje.2019.01.017","volume":"28","author":"S Li","year":"2019","unstructured":"S. Li, Y. Cui, Y. Ni, L. Yan, An effective SDN controller scheduling method to defence DDoS attacks. Chin. J. Electron. 28(2), 404\u2013407 (2019)","journal-title":"Chin. J. Electron."},{"issue":"16","key":"1957_CR3","doi-asserted-by":"publisher","first-page":"1259","DOI":"10.1049\/el.2015.0334","volume":"51","author":"S Lim","year":"2015","unstructured":"S. Lim, S. Yang, Y. Kim, S. Yang, H. Kim, Controller scheduling for continued SDN operation under DDoS attacks. Electron. Lett. 51(16), 1259\u20131261 (2015)","journal-title":"Electron. Lett."},{"issue":"7","key":"1957_CR4","doi-asserted-by":"publisher","first-page":"1838","DOI":"10.1109\/TIFS.2018.2805600","volume":"13","author":"J Zheng","year":"2018","unstructured":"J. Zheng, Q. Li, G. Gu, J. Cao, D.K.Y. Yau, J. Wu, Realtime DDoS defense using cots SDN switches via adaptive correlation analysis. IEEE Trans. Inf. Forensics Secur. 13(7), 1838\u20131853 (2018)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"10","key":"1957_CR5","doi-asserted-by":"publisher","first-page":"2358","DOI":"10.1109\/JSAC.2018.2869997","volume":"36","author":"K Kalkan","year":"2018","unstructured":"K. Kalkan, L. Altay, G. G\u00fcr, F. Alag\u00f6z, Jess: joint entropy-based DDoS defense scheme in SDN. IEEE J. Sel. Areas Commun. 36(10), 2358\u20132372 (2018)","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"1957_CR6","doi-asserted-by":"publisher","first-page":"5039","DOI":"10.1109\/ACCESS.2019.2963077","volume":"8","author":"S Dong","year":"2020","unstructured":"S. Dong, M. Sarem, Ddos attack detection method based on improved KNN with the degree of DDoS attack in software-defined networks. IEEE Access 8, 5039\u20135048 (2020)","journal-title":"IEEE Access"},{"key":"1957_CR7","doi-asserted-by":"publisher","first-page":"160536","DOI":"10.1109\/ACCESS.2019.2950945","volume":"7","author":"Y Xu","year":"2019","unstructured":"Y. Xu, H. Sun, F. Xiang, Z. Sun, Efficient DDoS detection based on k-fknn in software defined networks. IEEE Access 7, 160536\u2013160545 (2019)","journal-title":"IEEE Access"},{"key":"1957_CR8","doi-asserted-by":"crossref","unstructured":"N. Meti, D.G. Narayan, V.P. Baligar, Detection of distributed denial of service attacks using machine learning algorithms in software defined networks, in 2017 International Conference on Advances in Computing, Communications and Informatics (ICACCI) (2017)","DOI":"10.1109\/ICACCI.2017.8126031"},{"key":"1957_CR9","unstructured":"T.V. Phan, N.K. Bao, M. Park, A novel hybrid flow-based handler with DDoS attacks in software-defined networking, in 2016 International IEEE Conferences on Ubiquitous Intelligence Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress (UIC\/ATC\/ScalCom\/CBDCom\/IoP\/SmartWorld) (2016), pp. 350\u2013357"},{"key":"1957_CR10","unstructured":"L. Yang, H. Zhao, Ddos attack identification and defense using SDN based on machine learning method, in 2018 15th International Symposium on Pervasive Systems, Algorithms and Networks (I-SPAN) (2018), pp. 174\u2013178"},{"key":"1957_CR11","doi-asserted-by":"publisher","first-page":"44570","DOI":"10.1109\/ACCESS.2018.2854567","volume":"6","author":"Y Yu","year":"2018","unstructured":"Y. Yu, L. Guo, Y. Liu, J. Zheng, Y. Zong, An efficient SDN-based ddos attack detection and rapid response platform in vehicular networks. IEEE Access 6, 44570\u201344579 (2018)","journal-title":"IEEE Access"},{"key":"1957_CR12","doi-asserted-by":"publisher","first-page":"132502","DOI":"10.1109\/ACCESS.2020.3009733","volume":"8","author":"KS Sahoo","year":"2020","unstructured":"K.S. Sahoo, B.K. Tripathy, K. Naik, S. Ramasubbareddy, B. Balusamy, M. Khari, D. Burgos, An evolutionary SVM model for DDoS attack detection in software defined networks. IEEE Access 8, 132502\u2013132513 (2020)","journal-title":"IEEE Access"},{"issue":"7","key":"1957_CR13","doi-asserted-by":"publisher","first-page":"144","DOI":"10.23919\/JCC.2019.07.012","volume":"16","author":"Z Liu","year":"2019","unstructured":"Z. Liu, Y. He, W. Wang, B. Zhang, DDoS attack detection scheme based on entropy and PSO-BP neural network in SDN. China Commun. 16(7), 144\u2013155 (2019)","journal-title":"China Commun."},{"key":"1957_CR14","unstructured":"T.A. Tang, L. Mhamdi, D. McLernon, S.A.R.M. Zaidi, Ghogho, Deep recurrent neural network for intrusion detection in SDN-based networks, in 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft) (2018), pp. 202\u2013206"},{"key":"1957_CR15","unstructured":"W. Sun, Y. Li, S. Guan, An improved method of DDoS attack detection for controller of SDN, in 2019 IEEE 2nd International Conference on Computer and Communication Engineering Technology (CCET) (2019), pp. 249\u2013253"},{"key":"1957_CR16","doi-asserted-by":"publisher","first-page":"83765","DOI":"10.1109\/ACCESS.2020.2992044","volume":"8","author":"MP Novaes","year":"2020","unstructured":"M.P. Novaes, L.F. Carvalho, J. Lloret, M.L. Proen\u00e7a, Long short-term memory and fuzzy logic for anomaly detection and mitigation in software-defined network environment. IEEE Access 8, 83765\u201383781 (2020)","journal-title":"IEEE Access"},{"key":"1957_CR17","doi-asserted-by":"publisher","first-page":"53972","DOI":"10.1109\/ACCESS.2020.2976908","volume":"8","author":"S Haider","year":"2020","unstructured":"S. Haider, A. Akhunzada, I. Mustafa, T.B. Patel, A. Fernandez, K.R. Choo, J. Iqbal, A deep CNN ensemble framework for efficient DDoS attack detection in software defined networks. IEEE Access 8, 53972\u201353983 (2020)","journal-title":"IEEE Access"},{"key":"1957_CR18","doi-asserted-by":"publisher","first-page":"18701","DOI":"10.1109\/ACCESS.2019.2896783","volume":"7","author":"TV Phan","year":"2019","unstructured":"T.V. Phan, M. Park, Efficient distributed denial-of-service attack defense in SDN-based cloud. IEEE Access 7, 18701\u201318714 (2019)","journal-title":"IEEE Access"},{"issue":"4","key":"1957_CR19","doi-asserted-by":"publisher","first-page":"3559","DOI":"10.1109\/JIOT.2020.2973176","volume":"7","author":"N Ravi","year":"2020","unstructured":"N. Ravi, S.M. Shalinie, Learning-driven detection and mitigation of DDoS attack in IoT via SDN-cloud architecture. IEEE Internet Things J. 7(4), 3559\u20133570 (2020)","journal-title":"IEEE Internet Things J."},{"key":"1957_CR20","doi-asserted-by":"publisher","first-page":"69620","DOI":"10.1109\/ACCESS.2018.2878576","volume":"6","author":"MVO De Assis","year":"2018","unstructured":"M.V.O. De Assis, M.P. Novaes, C.B. Zerbini, L.F. Carvalho, T. Abr\u00e3ao, M.L. Proen\u00e7a, Fast defense system against attacks in software defined networks. IEEE Access 6, 69620\u201369639 (2018)","journal-title":"IEEE Access"},{"key":"1957_CR21","doi-asserted-by":"publisher","first-page":"34699","DOI":"10.1109\/ACCESS.2019.2895092","volume":"7","author":"Y Wang","year":"2019","unstructured":"Y. Wang, T. Hu, G. Tang, J. Xie, J. Lu, SGS: safe-guard scheme for protecting control plane against DDoS attacks in software-defined networking. IEEE Access 7, 34699\u201334710 (2019)","journal-title":"IEEE Access"},{"issue":"2","key":"1957_CR22","doi-asserted-by":"publisher","first-page":"231","DOI":"10.1109\/TSC.2016.2602861","volume":"12","author":"B Yuan","year":"2019","unstructured":"B. Yuan, D. Zou, S. Yu, H. Jin, W. Qiang, J. Shen, Defending against flow table overloading attack in software-defined networks. IEEE Trans. Serv. Comput. 12(2), 231\u2013246 (2019)","journal-title":"IEEE Trans. Serv. Comput."},{"key":"1957_CR23","doi-asserted-by":"publisher","first-page":"98893","DOI":"10.1109\/ACCESS.2019.2930715","volume":"7","author":"Z Abou El Houda","year":"2019","unstructured":"Z. Abou El Houda, A.S. Hafid, L. Khoukhi, Cochain-SC: an intra- and inter-domain DDoS mitigation scheme based on blockchain using SDN and smart contract. IEEE Access 7, 98893\u201398907 (2019)","journal-title":"IEEE Access"},{"key":"1957_CR24","unstructured":"J.C. Zhang, Research on DDoS attack defense mechanism based on SDN. Ph.D. thesis, Shandong University (2020)"},{"key":"1957_CR25","unstructured":"V. \u0160ul\u00e1k, P. Helebrandt, I. Kotuliak, Performance analysis of openflow forwarders based on routing granularity in openflow 1.0 and 1.3, in 2016 19th Conference of Open Innovations Association (FRUCT) (2016), pp. 236\u2013241"},{"issue":"8","key":"1957_CR26","doi-asserted-by":"publisher","first-page":"3510","DOI":"10.1109\/TNNLS.2017.2729778","volume":"29","author":"Y Wang","year":"2018","unstructured":"Y. Wang, S. Xia, Q. Tang, J. Wu, X. Zhu, A novel consistent random forest framework: Bernoulli random forests. IEEE Trans. Neural Netw. Learn. Syst. 29(8), 3510\u20133523 (2018)","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"1957_CR27","unstructured":"R.S. Rohith, R. Rohith, M. Minal, G. Shobha, Scapy\u2014a powerful interactive packet manipulation program, in 2018 International Conference on Networking, Embedded and Wireless Systems (ICNEWS) (2018), pp. 1\u20135"},{"key":"1957_CR28","first-page":"123","volume":"24","author":"L Breiman","year":"1996","unstructured":"L. Breiman, Bagging predictors. Mach. Learn. 24, 123\u2013140 (1996)","journal-title":"Mach. Learn."},{"key":"1957_CR29","unstructured":"S. Asadollahi, B. Oswami, M. Sameer, Ryu controller\u2019s scalability experiment on software defined networks, in 2018 IEEE International Conference on Current Trends in Advanced Computing (ICCTAC) (2018), pp. 1\u20135"},{"key":"1957_CR30","unstructured":"N. Gupta, A. Jain, P. Saini, V. Gupta, DDoS attack algorithm using ICMP flood, in 2016 3rd International Conference on Computing for Sustainable Global Development (INDIACom) (2016), pp. 4082\u20134084"},{"key":"1957_CR31","unstructured":"L. Arshadi, A.H. Jahangir, Entropy based SYN flooding detection, in 2011 IEEE 36th Conference on Local Computer Networks (2011), pp. 139\u2013142"},{"issue":"5","key":"1957_CR32","doi-asserted-by":"publisher","first-page":"3796","DOI":"10.1109\/TVT.2015.2441879","volume":"65","author":"C Li","year":"2016","unstructured":"C. Li, H. J. Yang, F. Sun, J. M. Cioffi, L. Yang, Multiuser overhearing for cooperative two-way multiantenna relays. IEEE Trans. Vehi. Tech. 65(5), 3796\u20133802 (2016)","journal-title":"IEEE Trans. Vehi. Tech."}],"container-title":["EURASIP Journal on Wireless Communications and Networking"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13638-021-01957-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s13638-021-01957-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13638-021-01957-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,4,13]],"date-time":"2021-04-13T04:15:02Z","timestamp":1618287302000},"score":1,"resource":{"primary":{"URL":"https:\/\/jwcn-eurasipjournals.springeropen.com\/articles\/10.1186\/s13638-021-01957-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,4,13]]},"references-count":32,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2021,12]]}},"alternative-id":["1957"],"URL":"https:\/\/doi.org\/10.1186\/s13638-021-01957-9","relation":{"has-preprint":[{"id-type":"doi","id":"10.21203\/rs.3.rs-154522\/v1","asserted-by":"object"}]},"ISSN":["1687-1499"],"issn-type":[{"value":"1687-1499","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,4,13]]},"assertion":[{"value":"19 January 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 March 2021","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 April 2021","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"90"}}