ing the randomness in the SDN controller. Controller over the network has the central view that provides us the opportunity to evaluate the rate of incoming new packets to the controller and predicts whether an attack is in progress or not. SDN enables to quantify randomness and have minimum and maximum based on the entropy making it a suitable method for DDOS detection. Using entropy, it is possible to see its value drop when a large number of packets are attacking one host or a subnet of hosts. Statistics Collection for Entropy One of the functions of the controller is collecting statistics from the switch tables. The controller monitors the existing flows and if there is an inactive flow for a period of time, it will remove that flow. In this paper, we will make use of that property and add another set of statistics collection to the controller. Since the approximate number of hosts in the network is known, we added the destination IP address of the new incoming packets to be collected into windows of size 50. The entropy of each window is calculated and compared to an experimental threshold. If the entropy is lower than the threshold, an attack is detected. These functions are small (in terms of the amount of code added) and transparent to the other functionalities of the controller. These two properties make the solution applicable to different controllers with minimal changes. Downloaded: 4/15/2022 9:44:49 AM Nova Southeastern University IP Address: 137.52.76.29 Analysis of Issues in SDN Security and Solutions Window Size The window size should be set to be smaller or equal to the number of hosts in order to provide accurate calculations. In this project, we set the window size at 50. The main reason for choosing 50 is the limited number of incoming new connection to each host in the network. In SDN, once a connection is established, the packets will not pass through the controller unless there is a new request. A second reason is the fact that a limited number of switches and hosts can be connected to each