Enhancing DDoS Attack Detection and Mitigation in SDN Using Advanced Machine Learning Techniques
Nathaniel Frederick, Aitizaz Ali
Abstract
The introduction of Software-Defined Networking (SDN) as a new infrastructure has demonstrated significant advantages over traditional networks in terms of scalability, flexibility, and security. However, SDN networks are also more susceptible to Distributed Denial of Service (DDoS) attacks, which can lead to a loss of system availability. Therefore, in this research, a machine learning-based model is developed to detect and prevent DDoS attacks in SDN environments. Our approach extends traditional flow-based features by incorporating additional parameters such as average flow packet size and recent flow history, among others, to enhance detection accuracy. Six machine learning models—Logistic Regression (LR), Naïve Bayes (NB), K-Nearest Neighbors (KNN), Support Vector Machine (SVM), Decision Tree (DT), and Random Forest (RF)—were evaluated using the CIC-DDoS2019 dataset. The results show that the Random Forest model achieved the highest detection rate with the lowest false positive rate compared to the other models, while also having minimal impact on normal traffic. The proposed system functions as an Intrusion Prevention System (IPS) by sampling flow parameters from Open Flow switches at intervals. Upon detecting an attack, the system applies traffic policing measures. Experimental results confirm that the Random Forest model achieved a high F1-score of 99.87%, making it a promising candidate for real-time DDoS detection and mitigation in SDN networks.