The proposed detection model is deployed in the controller in the SDN. It includes two main parts: an abnormal initial detection module based on information entropy and a DDoS traffic detection module based on DNN, as shown in Fig. 1. In the SDN network, every time the switch receives a new data packet, the controller will update the flow table entry of the switch. When the SDN network is attacked, the controller will receive a large number of data packets from the switch, resulting in control device interrupts the service and the network is paralyzed. The abnormal initial detection module collects the packet_in data packets in the SDN controller, calculates the entropy value of the data characteristics in the fixed interval data packet window, and compares it with the set threshold. Once it is not within the normal range, the traffic is deemed to be suspected to be abnormal, and it is subjected to the DNN-based anomaly detection. The DDoS traffic detection module based on DNN extracts the required characteristics through the switch flow table entry, and performs further detection to confirm whether a DDoS attack occurs in the network. If an attack occurs, a warning will be issued and the network manager will be notified for further processing.

Information entropy reflects the degree of uncertainty in the value of random variables (RVs). When the value of the RV is more random, the value of information entropy is higher. When the value of the RV is more consistent, the information entropy has lower value [27]. We use the Shannon's formula to calculate the sample entropy: (1)H(x)=−∑i=1N⁡(niS)ln⁡(niS)

Among them, the data sample x={nii=1,2,…,N} indicates that a certain sample i in the data has occurred ni times. S=∑iN⁡ni which indicates the total number of sample values X. From Eq. (1), we can see that the size of the sample entropy changes in the interval (0; ln⁡S). When the value distribution of the sample is the most concentrated, the entropy value is 0, then n1=n2=…=nN means that all the sample values are the same. When the distribution of the sample is the most dispersed, the entropy value is the largest, and all sample values are different at this time.

Due to the self-similarity of network traffic, we consider that the sparseness and denseness of the data packet feature samples are only related to the number of samples, and the size of the entropy value is only determined by the similarities and differences of the sample data. For example, two sample sequences of the same number X and Y, where X is a sample sequence collected within 30 s, Y is a sample sequence collected within 45 s, but the entropy of the two sample sequences is the same. Then it is inferred that X and Y have the same degree of sparse distribution [28].

In the experiment, the packet_in data packet of the SDN controller is regarded as the unit data packet. We define a fixed packet number interval as a packet unit data packet (packetbin). That is, the continuous data packet is divided into a packet unit according to a specific number of packets (bin). We use some feature sequence values in packetbin as sample data, and calculate the entropy value of the feature sequence sample data. We have selected two most important features that can reflect the current network status: source and destination IP addresses. The choice of the number of packets W in each packetbin controls the change of sample characteristics in a short period of time. If the value of W is too large, the entropy value will not change significantly, which will reduce the accuracy of detection. In the SDN network of this experimental environment, according to the number of hosts and traffic conditions, after measurement and analysis, it is found that W = 100 is a good compromise for the deployed data. When calculating the entropy, it is S = W = 100 in Eq. (1), we calculate the information entropy of the source and destination IP addresses in the first consecutive W packets, and then move to the next adjacent W packets to calculate the corresponding entropy. We get an abnormal traffic analysis index based on the information entropy, as shown in Tab. 1.

We set the experimental threshold T. If the information entropy in the indicator is not within the threshold range, it is observed that some abnormality has occurred in the SDN, issue a warning, and start the DDoS traffic detection module based on DL at this moment. The traffic in the SDN is detected, DDoS attacks are found and the warnings are issued. Unlike other entropy-based methods, this study does not set a confidence interval because it does not use a criterion for judging whether the DDoS occurs in the network, but only use it as the initial inspection method. Because the pure entropy-based detection method has limitations, for example, how to determine the threshold will affect the accuracy of the entire algorithm, and this method often results in a higher FAR. In our initial inspection model, the threshold is set to a wider range. This method has a higher detection and recognition rates, but it has a higher FAR. As a preliminary inspection method, it only requires a higher recognition rate.

The abnormal initial inspection module based on information entropy observe the network traffic, and inputs the generated suspected abnormal traffic to the DL module for further processing. It not only completes the detection of abnormal traffic, but also slows down the DL module pressure of the required resources.

In traditional ML algorithms, how to select the features will affect the success of the entire algorithm. Choosing good features can improve the accuracy of the algorithm. But too many feature designs will increase the complexity, and the process of manually selecting features will affect the detection speed. The DNN model can automatically extract the features layer by layer, and assign weights to the extracted features to achieve the best results.

In the experimental DNN model, we directly extracted some of the fields in the OpenFlow flow table as the feature input of the first layer. In addition to the features that can be directly extracted in the flow table, we manually designed two features, which are also used as the input of the DL network. The input characteristics are shown in Tab. 2.

The two features manually extracted are the average number of data packets and the number of data packets. Among them, the average number of data packets n_packets_ave is the number of packets (n_packets) divided by the flow duration (duration), which is the number of data packets per second: (2)n_packets_ave=n_packetsduration

The average number of data packets (n_bytes_ave) is the number of packets (n_bytes) divided by the stream duration (duration), that is, the number of data packets per second: (3)n_bytes_ave=n_bytesduration

In summary, this paper constructed the 19-dimensional feature input of the DL detection model based on the flow table information. These features can be directly read in the flow table entry, and the manually constructed features are also easier to obtain. This 19 dimensional feature vector is used as the input of the DL detection model to identify the abnormal DDoS traffic.

DNN is a fully connected network that includes an input layer, multiple hidden layers, and an output layer [29]. Fig. 2 depicts a 5-dimensional vector input, 7-dimensional vector output and DNN network model with L − 1 hidden layers.

In the DNN network, each layer contains the weight vector W and the offset vector b. We calculate the output lh of the h-th layer: (4)lh=tanh⁡(bh+whlh−1)

Among them, bh is the offset vector, wh is the weight matrix, and the nonlinear function is the tanh. The top-level output lμ and the supervised target output y are combined to form the loss function ω(lμ,y). The output layer linear regression function is (5)liμ=ebiμ+wiμlμ−1∑j⁡ebjμ+wjμlμ−1

Among them, wiμ is the i-th row of wμ. In this case, we use the conditional log-likelihood function as the loss function with liμ>0 and ∑i⁡liμ=1 (6)η(lμ,y)=−log⁡P(Y=y x)=−log⁡(lyμ)

The expected value on the (x,y) pair is minimized. During training, back propagation (BP) and gradient descent (GD) algorithms are used to adjust the weight value and bias according to the output error value of each neuron. The amount of shift is adjusted. When the output of the cost function is the smallest, the best result is achieved.

The output selects the softmax function and defines the cross entropy error as follows (7)F(w)=∑i=1N⁡log⁡{1+e−ynwTxn}

Wherein, N is the number of units by the w obtained with respect to each weight wk cost function F(w), which is defined as (8)θh=∂∂(wk)F(w)where (9)wh+1=wh−τhθh

Among them, τh is called the learning efficiency [30]. Finally, according to Eqs. (7)–(9), the corresponding stochastic gradient descent algorithm is used to minimize the cost function, and finally we will get the best weight value. The experiment uses a DNN structure including an input layer, an output layer and 10 hidden layers. In the hidden layer, the hyperbolic tanh function is used for nonlinear processing, and the current activation is performed in the output layer. After multiple batches of GD training, the final detection model is determined.

This article uses Mininet to build an SDN, where the controller uses the JAVA-based open source controller Floodlight, and the operating system is Ubuntu 16.04. The DL module is developed based on the Tensorflow framework. The developed hardware environment is a 48-core CPU server. Before the experiment, we used the scapy tool to inject the traffic into the mininet virtual network (VN) to imitate the DDoS attack. The network topology created by Mininet is shown in Fig. 3. The SDN consists of ten switches, each switch connects ten hosts, select two of them as the source of DDoS attacks, and launch an attack on the SDN network.

The experiment uses three indicators: DR, accuracy (ACC), and FAR as the criteria for evaluating the model. The DR is the ratio of the correctly identified to all DDoS attack traffic in the sample which is expressed as (10)DR=TPTP+FN

The ACC is the ratio of correctly identifying normal and abnormal flows in the total data set (11)ACC=TP+TNTP+TN+FP+FN

The FAR refers to the ratio of normal traffic that is misidentified as DDoS attack traffic by the model to all normal traffic in the test set. The lower the FAR, the better the classification effect of the model (12)FAR=FPFP+TN

Among them, the true positive (TP) rate refers to the rate at which the abnormal DDoS traffic is identified by the model, and the false positive (FP) rate refers to the rate at which normal traffic is incorrectly identified as DDoS traffic. The true negative (TN) rate refers to the rate at which the normal traffic is correctly identified. False negative (FN) rate refers to the rate at which the DDoS traffic is incorrectly identified as normal traffic [31].

In the abnormal initial detection module based on information entropy, we propose an abnormal traffic analysis indicator, by calculating the entropy value of each feature vector in several windows, and judging whether the network has occurred according to whether the entropy value exceeds the threshold collect the packet-in of normal network traffic in the switch, read the source and destination IP addresses in the data packet, and then calculate the characteristic entropy value in each window, namely 100 data packets. The SDN network is subject to DDoS during the attack, 100,000 pieces of data traffic are collected, the source and destination IP addresses are analyzed, and the information entropy value is calculated. The comparison is shown in Figs. 4 and 5.

It can be seen from Figs. 4 and 5 that when a DDoS attack occurs in SDN, the characteristic information entropy value has changed significantly, and the characteristic vector value has dropped rapidly, and the range of change is small. The initial inspection module based on information entropy is to be able to identify the abnormal traffic in the network, so it must have a high DR, but because it is only a preliminary inspection module, it is not required to have a very low FAR. According to the above principles, to analyze the experimental data, the threshold of the feature entropy value is shown in Tab. 3.

According to the analysis of experimental data, when the source IP address information entropy threshold is set to 2.5192, the DR of abnormal traffic identification is 100%, and the FAR is 42.769%. When the destination IP address information entropy threshold is set to 2.5557, the DR of abnormal traffic is 100%, and the FAR is 39.231%. When one of the two feature entropy values exceeds the specified threshold, it is concluded that an abnormality has occurred in the network.

In order to prove the effectiveness of the threshold, this study simulate the DDoS attacks and collect data, mark them to distinguish between normal and abnormal traffic, mix normal traffic with abnormal traffic, and perform anomaly detection based on information entropy. If the information entropy of a certain characteristic value is lower than the threshold, it is marked as abnormal traffic. Finally, the marking result is compared with the initial label to calculate the DR and FAR of the algorithm. The experimental results are shown in Tab. 4.

From the experimental results, it can be seen that the proposed method has a very high DR, which proves that it can effectively identify DDoS attack traffic. Although it has a high FAR, it does not affect its use as an initial check for the effectiveness.

The experimental data set is the real traffic in the SDN. A total of 120,000 traffic data, including 70,000 normal traffic and 50,000 DDoS attack traffic is collected. Among them, 79,970 data sets are used as training sets and 40030 pieces of data are used as the test set, as shown in Tab. 5.

The choice of the number of hidden layers of the DNN model will affect the accuracy of the model's recognition of DDoS traffic. It is very important to choose how many layers of DNN as the detection model. Therefore, we have constructed the number of hidden layers as 5 and 10 respectively. In the experiment, we use the same data set to perform 1,000 iterations of these five DNN models, and evaluate each DNN model through accuracy rate. Tab. 6 shows the comparison of the results of five DNN models with different structures after being trained for 1,000 rounds under the same training and test sets.

It can be seen from the results in Tab. 6 that the DNN model does not have more layers and has better training results. It is because too many hidden layers will even cause the accuracy of the recognition results to decline. Therefore, the experimental model chooses a 10-layer DNN model.

The actual data traffic set is deployed to compare the experiments with the XGBoost [24] and SVM models [25]. At the same time, the proposed model is compared with the traditional ML based K-nearest neighbor (KNN) model. The results are shown in Tab. 7. It can be seen from Tab. 7 that the proposed DNN model is better than the traditional methods in terms of DR, ACC and FAR. The ACC rate of the proposed model is 97.87%, and the FAR has dropped significantly. From the experimental results, it can be seen that the proposed model is better than traditional ML models.

At the same time, we conducted two sets of comparative experiments using the experimental data set and using the DNN model to detect the DDoS traffic. The first group of experiments directly used the 17 feature fields extracted directly from the OpenFlow as inputs. The second group of experiments is in addition to directly extracting the 17 feature fields. Two features “Average data grouping number” and “Average data grouping bit number” are manually constructed in real time, and these 19 features are used as model inputs. At the same time, the accuracy of abnormal traffic under two different traffic feature inputs are calculated. The results are shown in Tab. 8.

It can be seen from Tab. 8 that after adding two manually constructed features, the accuracy recognition increased by 0.75%, while the time only increased by 0.03 s. This proves the effectiveness of manually constructed features.

In addition, we also conducted two comparison experiments. The first experiment used only the detection module based on DL to detect the flow, while the second experiment used the preliminary inspection module based on information entropy for the initial inspection and the detection module based on deep learning. The results are shown in Tab. 9.

It can be seen from the detection accuracy that the two methods have high accuracy for the identification of abnormal traffic, both reaching more than 97%, and both have a good recognition effect. However, the detection method based on information entropy and deep learning saves CPU usage rate and reduce the processing time. The initial inspection method based on information entropy is a lightweight calculation, its occupancy rate of computing resources is not high, and has a faster processing speed.

By adjusting the number of DNN layers and manually designing input features, the optimal DNN detection model suitable for the experimental environment is obtained. At the same time, a comparative test was carried out with previous research methods, and the results showed that, the proposed model has a high accuracy rate for identifying the DDoS traffic in the traffic, occupies less computing resources and faster processing speed.