Feature-based real-time distributed denial of service detection in SDN using machine learning and Spark

Sep 17, 2026

Software defined networking (SDN) separates the control plane from the data plane, improving flexibility, yet it remains exposed to distributed denial of service (DDoS) attacks because of its centralized controller. This work proposes a real-time DDoS detection model for SDN using Spark as a big data tool and a machine-learning pipeline. Four algorithms are evaluated and the decision tree (DT) is selected for deployment with reported accuracy of 0.936, outperforming state-of-the-art approaches overall.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages11

Reading Time28 min

AccessFree to download

INTRODUCTION

Background and motivation

DDoS detection approaches and limitations

Main contributions

Feature-based real-time distributed denial of service detection in SDN using machine learning and Spark Sama Salam Samaan, Hassan Awheed Jeiad Department of Computer Engineering, University of Technology, Baghdad, Iraq Article history: Received Sep 7, 2022 Revised Nov 2, 2022 Accepted Dec 5, 2022 Keywords: Big data Distributed denial of service detection Machine learning Software defined networking Spark Corresponding Author: Recently, software defined networking (SDN) has been deployed extensively in diverse practical domains, providing a new direction in network management by separating the control plane from the data plane. Nevertheless, SDN is vulnerable to distributed denial of service (DDoS) attacks resulting from its centralized controller. Several studies have been suggested to address the DDoS attacks in SDN utilizing machine learning approaches. However, these approaches are resource-intensive and cause performance degradation since they cannot perform effectively in large-scale SDN networks that generate vast traffic statistics. To handle all these challenges, we build a DDoS attack detection model in SDN using Spark asa big data tool to overcome the limitations of conventional data processing methods. Four machine learning algorithms are employed. The decision tree (DT) is elected to be used for real-time deployment based on the performance results, which indicates that it has the best accuracy of 0.936. The model performance is compared with state-of-the-art and shows an overall better performance. This is an open access article under the CC BY-SA license. Sama Salam Samaan Department of Computer Engineering, University of Technology Baghdad, Iraq Email: [sama.s.samaan@uotechnology.edu.iq](sama.s.samaan@uotechnology.edu.iq) Article Info ABSTRACT 1. INTRODUCTION With the rapid improvements in the IT infrastructure field, networks have become larger, leading to increased complexity. Consequently, fundamental network characteristics such as confidentiality, integrity, authentication, non-repudiation, and information availability become demanding. In recent years, many industries and researchers have shifted their interest to designing more scalable, robust, and secure networks. Software defined networking (SDN) is considered the latest advancement in networking as a step towards building a centralized and dynamic network as opposed to the distributed and static environment of conventional IP-based networks, which are complicated to manage. When there is a need to implement a new policy in a traditional network, the network operator should configure every device using vendor-specific commands. As a result, it becomes very demanding to implement the required policy in existing IP-based networks. Another side of the inflexibility of such networks is the vertical integration in which the control plane and the data plane are tightly coupled, adding more rigidness to the overall architecture and hampers the evolution of network infrastructure. Therefore, SDN is considered a suitable solution to the problems of the existing IP networks mentioned above. SDN isan evolving architecture that presents an aspiration for a competent network infrastructure for the following reasons. First, it ends the vertical integration of the traditional networks by separating the control plane that determines packet routes from the data plane that forwards these packets. Second, by this separation, the control logic of the whole network is laid down in a logically centralized controller. Therefore, networkswitches turn into simple forwarding devices that simplify network management and add rapid implementation, flexibility, and programmability. Although the SDN architecture can enhance network security with a global overview of the entire network, a centralized controller, and the creation of forwarding rules in demand [1], SDN still has some challenges and concerns like scalability, supportability, and

FAQs

Why are DDoS attacks a particular threat in SDN?

SDN relies on a centralized controller for network management. As a result, DDoS attacks targeting the controller or its communication links can hinder the entire network.

What two basic approaches are used for DDoS detection in SDN?

One approach uses thresholds over traffic indicators such as maximum entropy, traffic rate, and packet delay. The other approach uses traffic-flow features with machine learning to classify traffic as benign or attack.

How does the proposed method achieve real-time detection?

The work builds an SDN DDoS detection model using Spark for big-data processing and a machine-learning pipeline. Feature selection and model evaluation are performed, and the decision tree is chosen for real-time deployment due to best accuracy.

Sep 17, 2026

Uploaded by Evangeline