{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T14:31:42Z","timestamp":1785335502396,"version":"3.55.0"},"reference-count":36,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2020,2,3]],"date-time":"2020-02-03T00:00:00Z","timestamp":1580688000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100014440","name":"Ministerio de Ciencia, Innovaci\u00f3n y Universidades","doi-asserted-by":"publisher","award":["RTI2018-102002-A-I00"],"award-info":[{"award-number":["RTI2018-102002-A-I00"]}],"id":[{"id":"10.13039\/100014440","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>The expected advent of the Internet of Things (IoT) has triggered a large demand of embedded devices, which envisions the autonomous interaction of sensors and actuators while offering all sort of smart services. However, these IoT devices are limited in computation, storage, and network capacity, which makes them easy to hack and compromise. To achieve secure development of IoT, it is necessary to engineer scalable security solutions optimized for the IoT ecosystem. To this end, Software Defined Networking (SDN) is a promising paradigm that serves as a pillar in the fifth generation of mobile systems (5G) that could help to detect and mitigate Denial of Service (DoS) and Distributed DoS (DDoS) threats. In this work, we propose to experimentally evaluate an entropy-based solution to detect and mitigate DoS and DDoS attacks in IoT scenarios using a stateful SDN data plane. The obtained results demonstrate for the first time the effectiveness of this technique targeting real IoT data traffic.<\/jats:p>","DOI":"10.3390\/s20030816","type":"journal-article","created":{"date-parts":[[2020,2,5]],"date-time":"2020-02-05T03:18:48Z","timestamp":1580872728000},"page":"816","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":148,"title":["Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN: An Experimental Approach"],"prefix":"10.3390","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8691-8944","authenticated-orcid":false,"given":"Jes\u00fas","family":"Galeano-Brajones","sequence":"first","affiliation":[{"name":"Department of Computing and Telematics Engineering, Universidad de Extremadura, 06800 M\u00e9rida, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3910-876X","authenticated-orcid":false,"given":"Javier","family":"Carmona-Murillo","sequence":"additional","affiliation":[{"name":"Department of Computing and Telematics Engineering, Universidad de Extremadura, 06800 M\u00e9rida, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1843-2365","authenticated-orcid":false,"given":"Juan F.","family":"Valenzuela-Vald\u00e9s","sequence":"additional","affiliation":[{"name":"Department of Signal Theory, Telematics and Communications, Universidad de Granada, 18071 Granada, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0455-7223","authenticated-orcid":false,"given":"Francisco","family":"Luna-Valero","sequence":"additional","affiliation":[{"name":"ITIS Software, Universidad de M\u00e1laga, 29071 M\u00e1laga, Spain"},{"name":"Department of Languages and Computer Science, Universidad de M\u00e1laga, 29071 M\u00e1laga, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2020,2,3]]},"reference":[{"key":"ref_1","unstructured":"(2019, December 15). Cisco Visual Networking Index: Forecast and Trends (2017\u20132022). Available online: https:\/\/www.cisco.com\/c\/en\/us\/solutions\/collateral\/service-provider\/visual-networking-index-vni\/white-paper-c11-741490.html."},{"key":"ref_2","unstructured":"Ericsson (2019, December 15). Ericsson Mobility Report. Available online: https:\/\/www.ericsson.com\/4acd7e\/assets\/local\/mobility-report\/documents\/2019\/emr-november-2019.pdf."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"8005","DOI":"10.1109\/JIOT.2019.2904123","article-title":"Security Management Architecture for NFV\/SDN-Aware IoT Systems","volume":"6","author":"Bernabe","year":"2019","journal-title":"IEEE Internet Things J."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"8182","DOI":"10.1109\/JIOT.2019.2935189","article-title":"IoT: Internet of Threats? A Survey of Practical Security Vulnerabilities in Real IoT Devices","volume":"6","author":"Meneghello","year":"2019","journal-title":"IEEE Internet Things J."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"216","DOI":"10.1016\/j.csi.2016.12.007","article-title":"Technology pillars in the architecture of future 5G mobile networks: NFV, MEC and SDN","volume":"54","author":"Blanco","year":"2017","journal-title":"Comput. Stand. Interfaces"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"2468","DOI":"10.1109\/JSAC.2017.2760418","article-title":"NFV and SDN\u2014Key Technology Enablers for 5G Networks","volume":"35","author":"Yousaf","year":"2017","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"114","DOI":"10.1109\/MCOM.2013.6461195","article-title":"Improving network management with software defined networking","volume":"51","author":"Kim","year":"2013","journal-title":"IEEE Commun. Mag."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1109\/JPROC.2014.2371999","article-title":"Software-defined networking: A comprehensive survey","volume":"103","author":"Kreutz","year":"2015","journal-title":"Proc. IEEE"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"2542","DOI":"10.1109\/ACCESS.2015.2499271","article-title":"Software-defined network function virtualization: A survey","volume":"3","author":"Li","year":"2015","journal-title":"IEEE Access"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"36","DOI":"10.1109\/MCOMSTD.2018.1700063","article-title":"Overview of 5G Security Challenges and Solutions","volume":"2","author":"Ahmad","year":"2018","journal-title":"IEEE Commun. Stand. Mag."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"812","DOI":"10.1109\/COMST.2018.2862350","article-title":"A Survey on Emerging SDN and NFV Security Mechanisms for IoT Systems","volume":"21","author":"Farris","year":"2019","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"e4067","DOI":"10.1002\/dac.4067","article-title":"Application of entropy formulas in detection of denial-of-service attacks","volume":"32","author":"Basicevic","year":"2019","journal-title":"Int. J. Commun. Syst."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1145\/1355734.1355746","article-title":"OpenFlow: Enabling Innovation in Campus Networks","volume":"38","author":"McKeown","year":"2008","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"1701","DOI":"10.1109\/COMST.2017.2689819","article-title":"A survey on the security of stateful SDN data planes","volume":"19","author":"Dargahi","year":"2017","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"ref_15","unstructured":"(2019, December 15). BigFlows Tcpreplay sample captures. Available online: http:\/\/tcpreplay.appneta.com\/wiki\/captures.html."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","article-title":"Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset","volume":"100","author":"Koroniotis","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"e2042","DOI":"10.1002\/nem.2042","article-title":"DDoS protection with stateful software-defined networking","volume":"29","author":"Rebecchi","year":"2019","journal-title":"Int. J. Network Manage."},{"key":"ref_18","unstructured":"Carvalho, R.N., Bordim, J.L., and Alchieri, E.A.P. (2019, January 20\u201324). Entropy-Based DoS Attack Identification in SDN. Proceedings of the 2019 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW), Rio de Janeiro, Brazil."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Goksel, N., and Demirci, M. (2019, January 18\u201320). DoS Attack Detection using Packet Statistics in SDN. Proceedings of the 2019 International Symposium on Networks, Computers and Communications (ISNCC), Istanbul, Turkey.","DOI":"10.1109\/ISNCC.2019.8909114"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"2358","DOI":"10.1109\/JSAC.2018.2869997","article-title":"JESS: Joint Entropy-Based DDoS Defense Scheme in SDN","volume":"36","author":"Kalkan","year":"2018","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"221","DOI":"10.1016\/j.comnet.2018.07.020","article-title":"IoT survey: An SDN and fog computing perspective","volume":"143","author":"Salman","year":"2018","journal-title":"Comput. Networks"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Ojo, M., Adami, D., and Giordano, S. (2016, January 4\u20138). A SDN-IoT architecture with NFV implementation. Proceedings of the 2016 IEEE Globecom Workshops (GC Wkshps), Washington, DC, USA.","DOI":"10.1109\/GLOCOMW.2016.7848825"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"e31","DOI":"10.1002\/itl2.31","article-title":"Accuracy or delay? A game in detecting interest flooding attacks","volume":"1","author":"Liu","year":"2018","journal-title":"Internet Technol. Lett."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.jnca.2019.01.006","article-title":"Efficient DDoS attacks mitigation for stateful forwarding in Internet of Things","volume":"130","author":"Liu","year":"2019","journal-title":"J. Network Comput. Appl."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3301614","article-title":"Software-defined Networking-based DDoS Defense Mechanisms","volume":"52","author":"Swami","year":"2019","journal-title":"ACM Comput. Surv."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Han, T., Jan, S.R.U., Tan, Z., Usman, M., Jan, M.A., Khan, R., and Xu, Y. (2019). A comprehensive survey of security threats and their mitigation techniques for next-generation SDN controllers. Concurr. Comput. Pract. Exp.","DOI":"10.1002\/cpe.5300"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Haider, S., Akhunzada, A., Ahmed, G., and Raza, M. (2019, January 21\u201322). Deep Learning based Ensemble Convolutional Neural Network Solution for Distributed Denial of Service Detection in SDNs. Proceedings of the 2019 UK\/China Emerging Technologies (UCET), Glasgow, UK.","DOI":"10.1109\/UCET.2019.8881856"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Gkountis, C., Taha, M., Lloret, J., and Kambourakis, G. (2017, January 25\u201327). Lightweight algorithm for protecting SDN controller against DDoS attacks. Proceedings of the 2017 10th IFIP Wireless and Mobile Networking Conference (WMNC), Valencia, Spain.","DOI":"10.1109\/WMNC.2017.8248858"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"379","DOI":"10.1002\/j.1538-7305.1948.tb01338.x","article-title":"A Mathematical Theory of Communication","volume":"27","author":"Shannon","year":"1948","journal-title":"Bell Syst. Tech. J."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Gu, Y., McCallum, A., and Towsley, D. (2005, January 24\u201325). Detecting Anomalies in Network Traffic Using Maximum Entropy Estimation. Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, Berkeley, CA, USA.","DOI":"10.1145\/1330107.1330148"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"109","DOI":"10.1049\/iet-ifs.2018.5186","article-title":"Detecting anomalous traffic in the controlled network based on cross entropy and support vector machine","volume":"13","author":"Han","year":"2019","journal-title":"IET Inf. Secur."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1007\/s11235-018-0475-8","article-title":"A comprehensive survey on network anomaly detection","volume":"70","author":"Fernandes","year":"2019","journal-title":"Telecommun. Syst."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"217","DOI":"10.1145\/1090191.1080118","article-title":"Mining Anomalies Using Traffic Feature Distributions","volume":"35","author":"Lakhina","year":"2005","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"122","DOI":"10.1016\/j.bjp.2013.10.014","article-title":"Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments","volume":"62","author":"Giotis","year":"2014","journal-title":"Comput. Netw."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Handigol, N., Heller, B., Jeyakumar, V., Lantz, B., and McKeown, N. (2012). Reproducible Network Experiments Using Container-based Emulation. Proceedings of the 8th International Conference on Emerging Networking Experiments and Technologies, ACM.","DOI":"10.1145\/2413176.2413206"},{"key":"ref_36","unstructured":"(2019, December 20). Ryu SDN Framework. Available online: https:\/\/osrg.github.io\/ryu\/."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/3\/816\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T08:54:15Z","timestamp":1760172855000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/3\/816"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,2,3]]},"references-count":36,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2020,2]]}},"alternative-id":["s20030816"],"URL":"https:\/\/doi.org\/10.3390\/s20030816","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,2,3]]}}}