Scalable Hybrid ML–DL Framework for Real-Time DDoS Detection in SDN

Öz

Distributed Denial of Service (DDoS) attacks remain a major threat to Software-Defined Networks (SDN), where centralized controllers are vulnerable to flooding traffic. Existing detection methods typically rely on single-stage models, creating trade-offs between speed and robustness. This study introduces a novel hierarchical hybrid framework that leverages SDN’s layered architecture by deploying Random Forest (RF) at the switch for lightweight, real-time filtering and deep learning (DL) models at the controller for deeper inspection. The hybrid RF→MLP pipeline achieves 98.7% accuracy, eliminates false alarms (normal recall = 1.00), and sustains high attack recall (0.97) with negligible latency (0.26 ms/sample). Unlike prior controller-centric or single-stage approaches, this is the first framework to systematically integrate ML and DL across SDN layers, providing a practical and scalable defense-in-depth solution.

Anahtar Kelimeler

• Defense-in-depth
• DDoS detection
• Deep learning models
• Real-time detection
• Software-defined networking

Proje Numarası

N/A

SDN’de Gerçek Zamanlı DDoS Tespiti için Ölçeklenebilir Hibrit ML–DL Yaklaşımı

Öz

Dağıtık Hizmet Engelleme (DDoS) saldırıları, merkezi denetleyicilerin taşma trafiğine karşı savunmasız olduğu Yazılım Tanımlı Ağlar (SDN) için ciddi bir tehdit oluşturmaktadır. Mevcut yöntemler genellikle tek aşamalı modellere dayanmakta ve hız ile sağlamlık arasında ödün vermektedir. Bu çalışma, SDN’nin katmanlı mimarisinden yararlanan yeni bir hiyerarşik hibrit çerçeve sunmaktadır. Anahtar düzeyinde Random Forest (RF) ile hafif ve gerçek zamanlı filtreleme, denetleyici düzeyinde ise Derin Öğrenme (DL) modelleri ile ayrıntılı analiz gerçekleştirilmiştir. Hibrit RF→MLP hattı %98,7 doğruluk elde etmiş, yanlış alarmları ortadan kaldırmış (normal geri çağırma = 1.00) ve saldırı trafiğinde yüksek geri çağırma (0.97) sağlamıştır. Önceki denetleyici merkezli veya tek aşamalı yaklaşımlardan farklı olarak, bu çalışma ML ve DL’i SDN katmanları arasında bütünleştiren ilk yaklaşımdır ve ölçeklenebilir, derinlemesine savunma çözümü sunmaktadır.

Anahtar Kelimeler

• Derinlemesine savunma
• DDoS tespiti
• Derin öğrenme modelleri
• Gerçek zamanlı tespit
• Yazılım tanımlı ağlar (SDN)

Proje Numarası

N/A

Teşekkür

Thanks for your efforts.

Kaynakça

1. 1. Almutairi, M. & Sheldon, F.T. (2025). IoT–Cloud integration security: A survey of challenges, solutions, and directions. Electronics, 14(7), 1394.
2. 2. Yan, Q. & Yu, F.R. (2015). Distributed denial of service attacks in software defined networking with cloud computing. IEEE Communications Magazine, 53(4), 52-59.
3. 3. Mirkovic, J. & Reiher, P. (2004). A taxonomy of DDoS attack and DDoS defense mechanisms. ACM SIGCOMM Computer Communication Review, 34(2), 39-53.
4. 4. Dantas Silva, F.S., Silva, E., Neto, E.P., Lemos, M., Venancio Neto, A.J. & Esposito, F. (2020). A taxonomy of DDoS attack mitigation approaches featured by SDN technologies in IoT scenarios. Sensors, 20(11), 3078.
5. 5. Hirsi, A., Audah, L., Salh, A., Alhartomi, M.A. & Ahmed, S. (2024). Detecting DDoS threats using supervised machine learning for traffic classification in software defined networking. IEEE Access, 99, 166675-166703.
6. 6. Xu, M., Fan, J., Huang, X., Zhou, C., Kang, J., Niyato, D. & Lam, K.Y. (2025). Forewarned is forearmed: A survey on large language model based agents in autonomous cyberattacks. arXiv preprint arXiv:2505.12786.
7. 7. Gupta, B.B. & Dahiya, A. (2021). Distributed denial of service (DDoS) attacks: Classification, attacks, challenges and countermeasures. CRC Press, Boca Raton.
8. 8. Bhatia, S., Behal, S. & Ahmed, I. (2018). Distributed denial of service attacks and defense mechanisms: Current landscape and future directions. In Versatile Cybersecurity, 55-97. Springer, Cham.

9. 9. Shaar, F. & Efe, A. (2018). DDoS attacks and impacts on various cloud computing components. International Journal of Information Security Science, 7(1), 26-48.
10. 10. Kaljic, E., Maric, A., Njemcevic, P. & Hadzialic, M. (2019). A survey on data plane flexibility and programmability in software defined networking. IEEE Access, 7, 47804-47840.
11. 11. Zhang, Q.Y., Wang, X.W., Huang, M., Li, K.Q., & Das, S.K. (2018). Software defined networking meets information centric networking: A survey. IEEE Access, 6, 39547-39563.
12. 12. Janabi, A.H., Kanakis, T. & Johnson, M. (2024). Survey: Intrusion detection system in software defined networking. IEEE Access, 12(99), 164097-164120.
13. 13. Rahouti, M., Xiong, K., Xin, Y., Jagatheesaperumal, S.K., Ayyash, M. & Shaheed, M. (2022). SDN security review: Threat taxonomy, implications, and open challenges. IEEE Access, 10, 45820-45854.
14. 14. Azam, Z., Islam, M.M. & Huda, M.N. (2023). Comparative analysis of intrusion detection systems and machine learning based model analysis through decision tree. IEEE Access, 11, 80348-80391.
15. 15. Chen, Q., Zhang, W. & Lou, Y. (2020). Forecasting stock prices using a hybrid deep learning model integrating attention mechanism, multilayer perceptron, and bidirectional long short term memory neural network. IEEE Access, 8, 117365-117376.
16. 16. Shethiya, A.S. (2024). Smarter systems: Applying machine learning to complex, real time problem solving. Integrative Journal of Science and Technology, 1(1).
17. 17. Aladaileh, M.A., Anbar, M., Hasbullah, I.H., Chong, Y.W. & Sanjalawe, Y.K. (2020). Detection techniques of distributed denial of service attacks on software defined networking controller – A review. IEEE Access, 8, 143985-143995.
18. 18. Bhayo, J., Jafaq, R., Ahmed, A., Hameed, S. & Shah, S.A. (2022). A time efficient approach toward DDoS attack detection in IoT network using SDN. IEEE Internet of Things Journal, 9(5), 3612-3630.
19. 19. Tan, L., Pan, Y., Wu, J., Zhou, J., Jiang, H. & Deng, Y. (2020). A new framework for DDoS attack detection and defense in SDN environment. IEEE Access, 8, 161908-161919.
20. 20. Ali, T.E., Chong, Y.W. & Manickam, S. (2023). Machine learning techniques to detect a DDoS attack in SDN: A systematic review. Applied Sciences, 13(5), 3183.
21. 21. Lima Filho, F.S.D., Silveira, F.A., de Medeiros Brito Junior, A., Vargas Solar, G. & Silveira, L.F. (2019). Smart detection: An online approach for DoS/DDoS attack detection using machine learning. Security and Communication Networks, 2019(1), 1574749.
22. 22. Mohmand, M.İ, Hussain, H., Ayaz, A., Ullah, U., Zakarya, M., Ahmed, A., Raza, M., Rahman, I. & Haleem, M. (2022). A machine learning based classification and prediction technique for DDoS attacks. IEEE Access, 10, 21443–21454.
23. 23. Ali, T.E., Chong, Y.W. & Manickam, S. (2023). Comparison of ML/DL approaches for detecting DDoS attacks in SDN. Applied Sciences, 13, 3033.
24. 24. Yungaicela-Naula, N.M., Vargas-Rosales, C. & Perez-Diaz, J.A. (2021). SDN-based architecture for transport and application layer DDoS attack detection by using machine and deep learning. IEEE Access, 9, 108495-108512.
25. 25. Nugraha, B. & Murthy, R.N. (2020). Deep learning-based slow DDoS attack detection in SDN-based networks. In Proceedings of IEEE NFV-SDN, 51-56.
26. 26. Wei, Y., Jang-Jaccard, J., Sabrina, F., Singh, A., Xu, W. & Camtepe, S. (2021). AE-MLP: A hybrid deep learning approach for DDoS detection and classification. IEEE Access, 9, 146810-146821.
27. 27. Hosseini, S. & Azizi, M. (2019). The hybrid technique for DDoS detection with supervised learning algorithms. Computer Networks, 158, 35-45.
28. 28. Zainudin, A., Ahakonye, L.A.C., Akter, R., Kim, D.S. & Lee, J.M. (2023). An efficient hybrid-DNN for DDoS detection and classification in software-defined IIoT networks. IEEE Internet of Things Journal, 10(10), 8491-8504.
29. 29. Sripriyanka, I.G. & Mahendran, A. (2024). Securing IoMT: A hybrid model for DDoS attack detection and COVID-19 classification. IEEE Access, 12, 17328-17348.
30. 30. McClurg, J. (2021). Correct-by-construction network programming for stateful dataplanes. In Proceedings of the ACM SIGCOMM Symposium on SDN Research (SOSR), 66-79.
31. 31. Ja’afreh, M.A., Adhami, H., Alchalabi, A.E., Hoda, M. & El Saddik, A. (2022). Toward integrating software defined networks with the Internet of Things: A review. Cluster Computing, 25(3), 1619-1636.
32. 32. Vergara, M., Ramos, L., Rivera-Campoverde, N.D. & Rivas-Echeverría, F. (2023). Engine-FaultDB: A novel dataset for automotive engine fault classification and baseline results. IEEE Access, 11, 126155-126171.
33. 33. Sahin, E.K. (2020). Assessing the predictive capability of ensemble tree methods for landslide susceptibility mapping using XGBoost, gradient boosting machine, and random forest. SN Applied Sciences, 2(7), 1308.
34. 34. Ebrahimy, H., Mirbagheri, B., Matkan, A.A. & Azadbakht, M. (2022). Effectiveness of the integration of data balancing techniques and tree-based ensemble machine learning algorithms for spatially-explicit land cover accuracy prediction. Remote Sensing Applications: Society and Environment, 27, 100785.
35. 35. Namdari, A. & Durrani, T.S. (2021). A multilayer feedforward perceptron model in neural networks for predicting stock market short-term trends. Operations Research Forum, 2(3), 38.
36. 36. Liu, Y., Pu, H. & Sun, D.W. (2021). Efficient extraction of deep image features using convolutional neural network (CNN) for applications in detecting and analysing complex food matrices. Trends in Food Science & Technology, 113, 193-204.
37. 37. Özdemir, C. (2023). Derin öğrenme modelleri ve veri ön işleme yöntemleri ile çeltik yaprak hastalıklarının erken teşhisi. Çukurova Üniversitesi Mühendislik Fakültesi Dergisi, 38(3), 807-817.
38. 38. Nguyen-Duc, P., Nguyen, H.D., Nguyen, Q.H., Phan-Van, T. & Pham-Thanh, H. (2024). Application of long short-term memory (LSTM) network for seasonal prediction of monthly rainfall across Vietnam. Earth Science Informatics, 17(5), 3925-3944.
39. 39. Korkmaz, C. ve Kacar, İ. (2024). Zaman serisinin kestirimi için uzun-kısa süreli bellek ağı yaklaşımı. Çukurova Üniversitesi Mühendislik Fakültesi Dergisi, 39(4), 1053-1066.