When Time Meets Space: Entropy Integration and Dynamic Threshold for Adaptive DDoS Detection in SDN

• URL: http://arxiv.org/abs/2608.15642v1
• Date: Sun, 16 Aug 2026 09:17:05 GMT
• Title: When Time Meets Space: Entropy Integration and Dynamic Threshold for Adaptive DDoS Detection in SDN
• Abstract summary: This paper proposes a lightweight temporal entropy-based detector for DDoS attacks.<n>It requires 3.95 ms of core processing per window and 11.65% system-wide CPU deployment.
• Score: 24.48377951509124
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Entropy-based Distributed Denial of Service (DDoS) detection in Software-Defined Networking (SDN) commonly relies on spatial traffic distributions and static or loosely adaptive thresholds, making it vulnerable to legitimate traffic fluctuations in Internet of Things (IoT) environments. This paper proposes a lightweight spatiotemporal entropy-based detector for DDoS attacks. Spatial entropy is computed from dynamically selected traffic attribute pairs, while temporal entropy captures the randomness of packet inter-arrival times. The two normalized entropy measures are fused into a unified indicator and evaluated using a constrained second-order Exponentially Weighted Moving Average threshold that jointly tracks entropy trend and volatility. To prevent attack-contaminated observations from biasing threshold adaptation, threshold updates are performed only for windows classified as normal. Testbed results show 99.26% recall, a 0.9737 F1-score, and a 3.2% false positive rate (41.74% below that of spatial entropy alone). On CICDDoS2019, the method achieves an FPR of 0 and remains competitive with machine-learning-based methods. It requires 3.95 ms of core processing per window and 11.65% system-wide CPU utilization, supporting resource-constrained edge and IoT deployment.

Related papers

• Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning [78.29352305480285]
  In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds.<n>This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement.
  arXiv  Detail & Related papers  (2026-08-22T18:38:39Z)
• Deconstructing Off-Policy Ratios: Entropy-Scaled Trust Regions for Asynchronous Reinforcement Learning [6.667218294299622]
  Asynchronous reinforcement learning (RL) accelerates large language model (LLM) post-training by overlapping rollout generation with policy optimization.<n>Existing methods typically retain or discard tokens based solely on the magnitude of their importance ratios.<n>We propose the Entropy-Scaled Trust Region (ESTR), which scales each token's off-policy deviation by its local entropy.
  arXiv  Detail & Related papers  (2026-07-24T10:55:42Z)
• Robust Cross-Domain WiFi Fall Detection via Physics-Driven Attention-Enhanced Transformers [64.35403680946182]
  Device-free fall detection utilizing WiFi Channel State Information (CSI) has emerged as a promising solution for elderly health monitoring.<n>Existing deep learning approaches suffer from severe performance degradation when deployed in unseen environments.<n>We propose a robust, domain-general framework featuring a novel Attention-Enhanced CNN-Transformer hybrid architecture.
  arXiv  Detail & Related papers  (2026-04-23T03:28:12Z)
• Adaptive Tensor Network Simulation via Entropy-Feedback PID Control and GPU-Accelerated SVD [0.0]
  Bond dimension chi controls the trade-off between accuracy and computational cost.<n>Fixed bond dimension strategies either waste resources in low-entanglement regions or lose fidelity in high-mententangle regions.<n>This work introduces a bond dimension management framework that uses von Neumann feedback and Proportional-Integral-Derivative (PID) controller.
  arXiv  Detail & Related papers  (2026-04-05T04:30:46Z)
• Collaborative Zone-Adaptive Zero-Day Intrusion Detection for IoBT [9.82963599072781]
  We present ZAID, a collaborative detection and model-improvement framework for unseen attack types.<n>ZAID combines a universal convolutional model for generalisable traffic representations, an autoencoder-based reconstruction signal as an auxiliary anomaly score, and lightweight adapter modules for parameter-efficient zone adaptation.<n>We evaluate ZAID on ToN_IoT using a zero-day protocol that excludes MITM, DDoS, and DoS from supervised training and introduces them during zone-level deployment and adaptation.
  arXiv  Detail & Related papers  (2026-02-18T00:02:15Z)
• Federated Spatiotemporal Graph Learning for Passive Attack Detection in Smart Grids [2.721477719641864]
  This paper introduces a graph-centric, multimodal detector that fuses physical-layer and behavioral indicators over temporal windows to detect passive attacks.<n>The model achieves a testing accuracy of 98.32% per-timestep and 93.35% per-sequence at 0.15% FPR.
  arXiv  Detail & Related papers  (2025-09-29T08:52:30Z)
• Time Is a Feature: Exploiting Temporal Dynamics in Diffusion Language Models [57.474294329887236]
  Diffusion large language models (dLLMs) generate text through iterative denoising.<n>Current decoding strategies discard rich intermediate predictions in favor of the final output.<n>We introduce two complementary methods that exploit temporal consistency.
  arXiv  Detail & Related papers  (2025-08-12T17:59:57Z)
• PeFAD: A Parameter-Efficient Federated Framework for Time Series Anomaly Detection [51.20479454379662]
  We propose a. Federated Anomaly Detection framework named PeFAD with the increasing privacy concerns. We conduct extensive evaluations on four real datasets, where PeFAD outperforms existing state-of-the-art baselines by up to 28.74%.
  arXiv  Detail & Related papers  (2024-06-04T13:51:08Z)
• DASA: Delay-Adaptive Multi-Agent Stochastic Approximation [64.32538247395627]
  We consider a setting in which $N$ agents aim to speedup a common Approximation problem by acting in parallel and communicating with a central server. To mitigate the effect of delays and stragglers, we propose textttDASA, a Delay-Adaptive algorithm for multi-agent Approximation.
  arXiv  Detail & Related papers  (2024-03-25T22:49:56Z)
• Resilience of Entropy Model in Distributed Neural Networks [7.6340310234573465]
  entropy coding has been introduced to further reduce the communication overhead. In this paper, we investigate resilience of entropy models to intentional interference and unintentional interference. We propose a new defense mechanism that can reduce the transmission overhead of the attacked input by about 9% compared to unperturbed data, with only about 2% accuracy loss.
  arXiv  Detail & Related papers  (2024-03-01T19:39:19Z)
• Adaptive Anomaly Detection for IoT Data in Hierarchical Edge Computing [71.86955275376604]
  We propose an adaptive anomaly detection approach for hierarchical edge computing (HEC) systems to solve this problem. We design an adaptive scheme to select one of the models based on the contextual information extracted from input data, to perform anomaly detection. We evaluate our proposed approach using a real IoT dataset, and demonstrate that it reduces detection delay by 84% while maintaining almost the same accuracy as compared to offloading detection tasks to the cloud.
  arXiv  Detail & Related papers  (2020-01-10T05:29:17Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.