SMRE: A Lightweight Statistical Mean Rényi Entropy Approach for Early DDoS Detection in SDN

Software-Defined Networking (SDN) centralizes control logic, improving programmability but exposing the controller to volumetric and low-rate Distributed Denial of Service (DDoS) attacks. Entropy-based detectors often raise late alarms or require significant traffic distribution changes, while machine-learning approaches impose high training and inference overhead. To address these issues, this work proposes a Statistical Mean Renyi Entropy (SMRE)-based early-warning system that amplifies micro-level disturbances in flow randomness using a tunable sensitivity weight ( μ ). The formulation enhances responsiveness to entropy deviations without adding computational complexity, enabling O(n) single-pass execution per monitoring window. The method was implemented on a Mininet testbed (nine switches, 64 hosts, POX controller with the L3_learning module) with mixed benign traffic and hping3/Scapy-generated UDP and TCP flood attack traffic at intensities ranging from 10 to 75%. Experimental results demonstrate that SMRE detects early-stage attacks with 94.7–98.1% accuracy, 0.8–2.3% false positive rate, and 6.5–14 ms detection latency, outperforming Shannon and classical Renyi entropy detectors. ROC analysis (AUC ≈ 0.99) and paired t -tests ( p < 0.01) confirm statistical significance. Resource profiling shows negligible CPU and memory overhead, supporting real-time deployment. By eliminating model training and ensuring robust early detection, SMRE offers a lightweight and practical detection mechanism for SDN environments, whose applicability to cloud, edge, and IoT deployments will be further substantiated through validation on real traffic traces and multi-controller architectures.