Intelligent Detection and Mitigation of Carpet-Bombing DDoS Attacks in SDN Using Retrieval-Augmented Generation and Large Language Models

2026-05-25

AI Summary

This work addresses the challenge of detecting carpet-bombing distributed denial-of-service (DDoS) attacks in software-defined networks (SDN), whose highly dispersed traffic patterns often evade conventional detection mechanisms. To this end, the authors propose a real-time detection and mitigation framework leveraging retrieval-augmented generation (RAG). The approach integrates interface-level traffic features, semantic embeddings, FAISS-based similarity search, and contextual reasoning from large language models—specifically Gemma-4-31B-IT—to identify malicious activity without requiring supervised training. By innovatively introducing RAG into SDN security, the framework supports dual representations in both natural language and JSON, thereby eliminating reliance on labeled datasets or model retraining. Experimental results demonstrate that the method achieves consistently high detection accuracy and low latency across varying attack intensities, effectively mitigating threats and significantly enhancing SDN robustness.

Abstract

Software-Defined Networking (SDN) provides flexible and programmable network management; however, its centralized control architecture remains highly vulnerable to Distributed Denial-of-Service (DDoS) attacks, particularly Carpet-Bombing DDoS attacks that distribute malicious traffic across multiple targets to evade conventional detection mechanisms. In this paper, a Retrieval-Augmented Generation (RAG)-based framework is proposed for real-time detection and mitigation of Carpet-Bombing DDoS attacks in SDN environments. The proposed framework combines interface-level traffic features representation, semantic embedding generation, FAISS-based similarity retrieval, and Large Language Model (LLM)-driven contextual inference to classify traffic behavior without requiring conventional supervised model training or retraining. To evaluate the effectiveness of the proposed framework, extensive experiments were conducted under multiple Carpet-Bombing DDoS attack scenarios with different attack intensities. In addition, two traffic representation strategies, namely structured JSON-based representation and natural language-based representation (NLR), were investigated using multiple state-of-the-art LLMs. The experimental results demonstrate that the proposed framework achieved highly accurate and stable attack detection performance, while the framework configuration utilizing the Gemma-4-31B-IT model achieved the strongest overall detection results. Furthermore, real-time experiments confirmed the capability of the proposed framework to rapidly detect and mitigate Carpet-Bombing DDoS attacks while maintaining stable SDN network operation. The obtained results highlight the effectiveness of integrating RAG mechanisms with LLM for intelligent and adaptive SDN security analysis.

Problem

• Carpet-Bombing DDoS
• Software-Defined Networking
• DDoS detection
• network security
• traffic analysis

Innovation

• Retrieval-Augmented Generation
• Large Language Models
• Carpet-Bombing DDoS
• Software-Defined Networking
• FAISS-based retrieval