Dual Log Analysis Rapidly Detects DDoS Attacks in Software-Defined Networks

A research team comprising Swarnajit Bhattacharya, Asit Kumar Nayek, and Mrinmoy Sen has designed and evaluated a dual-stage log analysis framework capable of identifying distributed denial-of-service attacks within software-defined networking environments. Published in Discover Networks, the study outlines how coupling coarse-grained Shannon entropy filtering with fine-grained Kullback–Leibler divergence verification allows network controllers to recognize malicious traffic surges rapidly. In simulated tests, the staged architecture attained a true positive rate of 98.5 percent against high-volume transmission control protocol synchronization floods and 96.0 percent against address randomization attacks. Concurrently, the dual-process approach suppressed false positive rates to 1.5 percent while imposing a modest central processing unit overhead of approximately 3.6 percent on the centralized controller, demonstrating that granular mathematical tracking need not paralyze operational network control planes.

Software-defined networking establishes centralized administrative visibility by programmatically isolating the underlying data-forwarding plane from the higher-level control plane. Network administrators direct entire infrastructures through centralized software controllers, such as OpenDaylight, which oversee global network topologies, dynamically distribute operational flow rules, and aggregate systemic state variables. However, this architectural concentration creates a profound vulnerability because malicious actors targeting the controller can exhaust its finite computational bandwidth through volumetric request floods. Traditional perimeter defense mechanisms struggle to protect software-defined topologies due to rapid fluctuations in dynamic flow entries and an inherent dependence on central controllers for routing decisions. Inundating an open control plane causes cascading connectivity failures across dependent server nodes, making responsive, lightweight, real-time intrusion monitoring critical for preserving infrastructural integrity.

To counteract these disruptions without saturating control hardware, the investigators devised a Log Analysis Subsystem operating on both structured flow records and unstructured textual events. In typical network deployments, controllers regularly capture granular session information, including transport layer port allocations, source internet protocol addresses, destination records, and operational connection durations. Simultaneously, connected infrastructure generates narrative text streams encompassing connection drops, handshake timeouts, and resource warnings. Conventional intrusion detection models either prioritize packet header monitoring or depend on computationally demanding machine learning routines that mandate extensive preliminary training datasets. By contrast, the authors positioned an external log subsystem linked to the controller via transmission control protocol streams, thereby offloading rigorous mathematical verification routines from primary forwarding services to prevent control bottlenecks.

Central to this detection framework is an in-memory database storage pipeline coupled with a two-phase mathematical filtering sequence. Parsing massive, raw flat-file logs on physical storage drives introduces significant input-output read latency that undermines real-time defensive response times. To eliminate this operational lag, incoming structured session headers and chronological timestamps are directly ingested into memory-resident database caching engines such as Redis or Memcached. The subsystem subsequently executes a cascading statistical inspection workflow across discrete operational time windows, set experimentally to intervals such as five seconds. Global traffic diversity is continuously surveyed using Shannon entropy, which scales with linear computational complexity, while the mathematically demanding Kullback–Leibler divergence is reserved exclusively for secondary verification whenever baseline entropy limits are breached.

The coarse screening stage leverages Shannon entropy to measure the distribution randomness across specific flow attributes, prominently destination internet protocol addresses and client source ports. Under standard operational conditions, incoming requests exhibit diverse destination attributes and balanced distributions that yield stable entropy baselines. During a targeted flooding episode, attackers concentrate extensive packet volumes toward isolated server destinations, prompting a measurable drop in destination entropy. Conversely, port randomization campaigns drive source entropy sharply upward as spoofed identities proliferate. By comparing observed entropy across active inspection intervals against dynamic three-sigma statistical thresholds derived from baseline operational phases, the system issues preliminary anomaly alerts without requiring intensive multivariate analysis on legitimate data flows.

When preliminary entropy boundaries are violated, the architecture activates its second stage: a targeted Kullback–Leibler divergence calculation that evaluates distributional shifts. Kullback–Leibler divergence quantifies the statistical divergence between an empirical traffic distribution and an established baseline probability model recorded across secure operational periods. In mathematical terms, identical traffic yields a divergence value of zero, whereas significant statistical skewing results in elevated positive values. By computing divergence specifically across session duration profiles and targeted address frequencies for flagged clients, the subsystem corroborates genuine attacks. This staged arrangement restricts computationally demanding logarithmic cross-entropy calculations to suspicious traffic subsets, ensuring overall processing overhead remains linearly manageable under expanding transmission loads.

Operating concurrently alongside structured mathematical evaluations is an independent text-parsing pipeline designed to evaluate unstructured controller logs. In standard deployments, incoming traffic floods trigger operational warning messages, including link failure records, connection timeouts, and buffer saturation notices. The unstructured inspection agent monitors these narrative event logs for diagnostic error signatures that correlate with mathematical anomalies flagged by the primary stream. If unformatted logs display definitive diagnostic confirmations of systemic resource exhaustion, anomalous identifiers are routed immediately to quarantine listings. In ambiguous instances, unstructured insights trigger enhanced validation queries within the structured numerical module, cross-referencing semantic system context against quantitative probability metrics to prevent benign traffic spikes from triggering unwarranted defensive blacklists.

Experimental validation was conducted within a virtualized software-defined testbed managed via Mininet, incorporating an OpenDaylight control node, three OpenFlow switches, and simulated endpoint hosts. Baseline non-malicious background communications mimicking typical browsing, bulk file transmissions, and video streams were generated using traffic synthesis tools, yielding a structured baseline dataset of 150,000 log records following Gaussian distributions. Hostile scenarios were introduced using network traffic generators that executed synchronization floods and address randomization sweeps across variable intensities spanning 100 to 4,000 packets per second. System performance was benchmarked directly against simple single-metric entropy thresholds to quantify improvements in detection accuracy, response latency, and central processing consumption.

Empirical findings confirmed marked performance advantages for the hybrid approach over standalone entropy baseline systems. Across synchronization flood evaluations, the proposed method achieved a true positive rate of 98.5 percent compared to 92.5 percent for simple entropy mechanisms. For complex randomization attacks, detection accuracy reached 96.0 percent. Notably, false positive rates dropped to 1.5 percent during synchronization floods and 2.5 percent during randomization trials, whereas simple entropy models falsely flagged legitimate traffic up to 9.5 percent of the time due to an inability to distinguish sudden flash crowds from malicious assaults. Average detection latency remained around 210 milliseconds—a reduction of more than 100 milliseconds compared to baseline approaches—while controller CPU overhead rose marginally from 3.1 to 3.6 percent.

To evaluate performance against contemporary real-world attack vectors, the researchers replayed network trace captures from the benchmark CIC-DDoS2019 dataset into the virtualized testbed using packet replay utilities. Evaluated on realistic synchronization floods and lightweight directory access protocol reflection attacks, the framework maintained an overall detection accuracy of 98.5 percent. This accuracy matched resource-intensive deep learning models such as long short-term memory recurrent neural networks while outperforming them decisively in execution latency, registering complete detection cycles within 0.21 seconds. Scalability assessments across expanded virtual topologies comprising up to 20 switches and 15,000 flows per second confirmed that detection latency stayed consistently below 280 milliseconds, with peak processor overhead capping at 6.8 percent.

When anomalous patterns are definitively confirmed across structured and unstructured diagnostic channels, the subsystem triggers targeted automated mitigation. Flagged source addresses are cataloged in an active quarantine repository, prompting the Log Analysis Subsystem to dispatch mitigation instructions back to the OpenDaylight controller. The controller immediately installs programmatic OpenFlow flow-table entries that block or isolate malicious internet protocol sessions directly at ingress switches, arresting resource exhaustion before volumetric flows penetrate internal servers. By offloading screening mechanics to in-memory databases and filtering calculations through cascading statistical formulas, the framework shields controller hardware from saturation while executing precise, automated network defense.

Despite these demonstrable gains, the authors identified several structural boundaries and future research opportunities within their framework. The baseline profiling routine currently relies on sliding statistical calculation windows updated at fixed fifteen-minute intervals, which may require manual adjustments if underlying baseline traffic behaviors alter dramatically over extended periods. Future research aims to formulate dynamic baseline adaptation algorithms that permit reference distributions to evolve continuously alongside natural enterprise traffic trends. Additionally, the team plans to integrate natural language processing algorithms into the unstructured text analysis module to interpret raw system messages more granularly and replace binary blocking with graduated traffic shaping and rate-limiting responses.

Subject of Research: Hybrid multi-format log analysis for detecting distributed denial-of-service attacks in software-defined networking

Article Title: Employing multi-format log analysis to detect Distributed Denial-of-Service (DDoS) attacks in Software-Defined Networks (SDN)

Article References: Bhattacharya, S., Nayek, A. K., & Sen, M. (2026). Employing multi-format log analysis to detect Distributed Denial-of-Service (DDoS) attacks in Software-Defined Networks (SDN). Discover Networks, 2(1), Article 6. https://doi.org/10.1007/s44354-026-00020-7

Image Credits: AI Generated

DOI: 10.1007/s44354-026-00020-7

Keywords: Software-Defined Networking, Distributed Denial-of-Service, Shannon Entropy, Kullback-Leibler Divergence, Log Analysis Subsystem, OpenDaylight Controller, Network Security, In-Memory Database, TCP SYN Flood, Port Randomization, Anomaly Detection, Mininet Simulation, CIC-DDoS2019, Traffic Classification, Control Plane Resilience, OpenFlow Protocols