Advanced DDoS Attack Detection and Mitigation in Software-Defined Networking (SDN) Environments - An Integrated Machine Learning Approach

Aug 6, 2026

Upload by Hazel

The research addresses the escalating complexity of Distributed Denial of Service (DDoS) attacks by proposing a machine learning framework for distinguishing normal and malicious network traffic. It relies on engineered features such as unique source counts, flow counts, and packet rates, with Random Forest reaching 95.3% accuracy across evaluated models. A dynamic mitigation module adapts in real time to block or redirect malicious traffic while reducing disruption to legitimate operations. Evaluations further support scalability and relevance to real-world network environments, while noting limitations from synthetic datasets and computational demands.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages7

Reading Time18 min

AccessFree to download

Introduction

Literature Review

GAYANTHA, N., RAJAPAKSE, C. and SENANAYAKE, J. 2025. Advanced DDoS attack detection and mitigation in software-defined networking (SDN) environments: an integrated machine learning approach. In Proceedings of the 8th International research conference on Smart computing and systems Engineering 2025 (SCSE 2025), 3 April 2025, Colombo, Sri Lanka. Piscataway: IEEE [online], pages 1-6. Available from: [https://doi.org/10.1109/SCSE65633.2025.11030982](https://doi.org/10.1109/SCSE65633.2025.11030982) Advanced DDoS attack detection and mitigation in software-defined networking (SDN) environments: an integrated machine learning approach. GAYANTHA, N., RAJAPAKSE, C. and SENANAYAKE, J. 2025 © 2025 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. Advanced DDoS Attack Detection and Mitigation in Software-Defined Networking(SDN) Environments: An Integrated Machine Learning Approach Nadeera Gayantha Dept. of Industrial Management University of Kelaniya Kelaniya, Sri Lanka [gayanth-im19014@stu.kln.ac.lk](gayanth-im19014@stu.kln.ac.lk) Chathura Rajapakse Dept. of Industrial Management University of Kelaniya Kelaniya, Sri Lanka [chathura@kln.ac.lk](chathura@kln.ac.lk) Janaka Senanayake School of Computing, Engineering and Technology Robert Gordon University Aberdeen, United Kingdom [j.senanayake@rgu.ac.uk](j.senanayake@rgu.ac.uk) Abstract—The increasing sophistication of Distributed Denial of Service (DDoS) attacks poses critical challenges to network security, necessitating advanced detection and mitigation strategies. This research presents a machine learning-based framework that effectively distinguishes between normal and malicious traffic u sing e ngineered features s uch a s u nique s ource counts, flow c ounts, a nd p acket r ates. A mong t he m odels evaluated, Random Forest demonstrated the highest accuracy at 95.3%, showcasing its effectiveness in identifying diverse attack patterns. The framework incorporates a dynamic mitigation module that adapts in real-time to block or redirect malicious traffic while minimizing disruption to legitimate operations. Comprehensive evaluation confirms i ts s calability a nd r elevance t o real-world network environments. Despite its strengths, limitations include reliance on synthetic datasets and computational demands. Future work will address these challenges by integrating real-world traffic data, exploring advanced learning techniques, and enhancing resource efficiency. This study offers a scalable and adaptive solution to evolving DDoS threats. Keywords—Anomaly detection, DDoS detection, Machine learning, Network security, SDN I. INTRODUCTION The rising sophistication and prevalence of Distributed Denial of Service (DDoS) attacks have emerged as a critical challenge to the security and reliability of modern networks. In particular, Software-Defined N etworking ( SDN) environments, with their centralized control and programmability, present both opportunities and vulnerabilities in addressing these threats. While SDN offers dynamic traffic management and improved network visibility, it is also susceptible to targeted attacks, such as flow table saturation and control plane disruption, which can undermine the network’s integrity. Traditional approaches to DDoS detection often rely on outdated datasets or simplistic traffic models that fail t o capture the complexity of modern network environments. These limitations hinder the development of robust machine learning (ML) models for real-time anomaly detection and mitigation, especially in SDN-specific s cenarios. To a ddress t hese gaps, this research focuses on integrating SDN programma

FAQs

What is the core detection method proposed for DDoS attacks in SDN environments?

It uses a machine learning-based framework that distinguishes normal traffic from malicious traffic using engineered metrics such as unique source counts, flow counts, and packet rates.

Which model achieved the highest accuracy in the study?

Random Forest achieved the highest accuracy at 95.3%, demonstrating strong performance across diverse attack patterns.

How does the mitigation component respond to detected attacks?

It employs a dynamic mitigation module that adapts in real time to block or redirect malicious traffic while minimizing disruption to legitimate traffic.

Aug 6, 2026

Upload by Hazel