Optimizing DDoS Detection in SDNs Through Machine Learning Models

2024-12-22

International Conference on Computational Intelligence and Communication Networks

AI Summary

To address low detection accuracy in SDN-based DDoS attack detection—caused by class imbalance and poor model calibration—this study systematically constructs and evaluates five machine learning models (XGBoost, Random Forest, SVM, KNN, and MLP) for binary classification using OpenFlow flow-level features. The work innovatively demonstrates, for the first time, that XGBoost achieves superior probability calibration (lowest Brier Score: 0.0012) in SDN flow-level DDoS detection, significantly outperforming all baselines. XGBoost and Random Forest both attain 100% accuracy and AUC; MLP achieves 99.93% accuracy. Experiments further reveal that balanced datasets critically enhance model robustness and resilience against generative zero-day attacks. The study establishes a reproducible benchmark framework and methodological foundation for high-reliability, real-time DDoS detection in SDN environments.

Technology Category

• Machine Learning: Calibration & Uncertainty Quantification
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Computer Vision: Diffusion Models for Vision

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Web Mining and Content Analysis: Machine learning and data science for the Web

Abstract

The emergence of Software-Defined Networking (SDN) has changed the network structure by separating the control plane from the data plane. However, this innovation has also increased susceptibility to DDoS attacks. Existing detection techniques are often ineffective due to data imbalance and accuracy issues; thus, a considerable research gap exists regarding DDoS detection methods suitable for SDN contexts. This research attempts to detect DDoS attacks more effectively using machine learning algorithms: RF, SVC, KNN, MLP, and XGB. For this purpose, both balanced and imbalanced datasets have been used to measure the performance of the models in terms of accuracy and AUC. Based on the analysis, we can say that RF and XGB had the perfect score, 1.0000, in the accuracy and AUC, but since XGB ended with the lowest Brier Score which indicates the highest reliability. MLP achieved an accuracy of 99.93%, SVC an accuracy of 97.65% and KNN an accuracy of 97.87%, which was the next best performers after RF and XGB. These results are consistent with the validity of SDNs as a platform for RF and XGB techniques in detecting DDoS attacks and highlights the importance of balanced datasets for improving detection against generative cyber attacks that are continually evolving.

Problem

• Enhancing DDoS detection in SDNs using machine learning models
• Addressing data imbalance and accuracy issues in current detection methods
• Evaluating RF, XGB, and other ML algorithms for optimal attack detection

Innovation

• Uses RF and XGB for perfect DDoS detection accuracy
• Compares multiple ML models on balanced datasets
• Highlights SDN compatibility with ML-based security