Methods and apparatuses for determining security attacks in software-defined networks

A method performed by a controller in a wireless communication system for determining a security attack, the method comprising:

• obtaining a first statistics based on an amount of messages received from at least one packet forwarding entity within a pre-defined time interval, t, wherein the first statistics is a time-domain data;
• obtaining a second statistics based on at least one arriving-time difference, Td, between two consecutive messages;
• detecting an anomaly based on the second statistics;
• determining, if the anomaly is detected, a security attack based on the first statistics;
• initiating a security attack notification to an orchestrator;
• and
• comparing, in the step of detecting the anomaly, the obtained single arriving-time difference, Td, with an obtained pre-trained threshold value, TH, wherein the anomaly is detected, if the single arriving-time difference, Td, is less than the pre-trained threshold value, TH,
• wherein the pre-trained threshold value, TH, is an intersection point of an empirical probability distribution curve obtained from a set of arriving-time difference, Td, in a pre-trained normal packet traffic and an empirical probability distribution curve obtained from a set of arriving-time difference, Td, in a pre-trained attack packet traffic.