Information Gain-Based Detection of Low and High Severity DDoS Attacks in SDN with Automated Mitigation Responses

Distributed Denial of Service (DDoS) attacks continue to be a significant danger to network infrastructure, especially in Software-Defined Networking (SDN) environments, because of their centralized management mechanisms. This study presents a dynamic, multi-tiered DDoS detection and mitigation framework utilizing entropy and Information Gain (IG) for real-time severity assessment. In contrast to conventional single-threshold models, our methodology differentiates between normal, low-intensity, and high-intensity DDoS attacks by analyzing statistical traffic entropy fluctuations and IG thresholds. Low-severity attacks are diverted to honeypots for isolation and examination, but high-severity threats activate automatic port-blocking protocols at the switch level. The proposed method demonstrates significant responsiveness in mitigation while causing minimum disturbance to legal traffic. Our architecture offers a strong, automated defensive strategy that corresponds with the evolving characteristics of contemporary network threats. This research represents a substantial advancement in intelligent, SDN-based DDoS mitigation. It establishes a basis for future integration with deep learning and cloud-native architectures to manage encrypted and large-scale traffic environments.