Abstract: Software Defined Network (SDN) is an emerging network architecture. By separating the forwarding layer and the control layer, centralized management and control of the network is achieved. As the core of the SDN network, the controller is easy to be the target of attacks. Distributed Denial of Service (DDoS) attack is one of the most threatening attacks faced by SDN networks. In response to this problem, this paper proposes a DDoS attack detection model based on machine learning. First, the method monitors the switch port traffic based on information entropy to determine whether there is abnormal traffic. After detecting anomalies, it extracts the flow characteristics and uses the SVM + K-Means composite algorithm to detect DDoS attacks. Finally, the controller delivers a drop flow table to deal with attack traffic. Experimental results show that the algorithm proposed in this paper is superior to SVM algorithm and K-Means algorithm in the indicators of false alarm rate, detection rate and accuracy.

Key words: DDoS(Distributed Denial of Service), SDN(Software Defined Network), entropy, SVM, K-Means