[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-127171-en":3,"doc-seo-127171-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},127171,549768072016,"River Wang","https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d",8,"Research & Report","Machine Learning Models for DDoS Detection in Software-Defined Networking - A Comparative Analysis","Software-Defined Networking (SDN) improves network control and flexibility but its centralized architecture also increases exposure to Distributed Denial of Service (DDoS) attacks. This study compares Random Forest, Naive Bayes, and Linear Support Vector Classification (LinearSVC) for DDoS detection using the “DDoS SDN dataset” from Kaggle with 104,345 records and 23 features. A 70/30 split supports training and evaluation. Models are assessed via accuracy, precision, recall, F1-score, and ROC analysis, showing Random Forest achieves 97% accuracy and ROC AUC of 1.00. ","Journal of Information Systems and Informatics  \nVol. 6, No. 3, September 2024 e-ISSN: 2656-4882 p-ISSN: 2656-5935  \nDOI: 10.51519/journalisi.v6i3.864 Published By DRPM-UBD  \nMachine Learning Models for DDoS Detection in Software-Defined Networking: A Comparative Analysis  \nFerdiansyah1, Darius Antoni2, Muhammad Valdo3, Mikko4,  \nChairul Mukmin5, Usman Ependi6,*  \n1,2,3,4 Faculty of Computer and Science, Universitas Indo Global Mandiri, Palembang, Indonesia  \n56 Faculty of Science Technology, Universitas Bina Darma, Palembang, Indonesia  \n[Email:](Email:1 ferdi@uigm.ac.id)[1](Email:1 ferdi@uigm.ac.id)[ ferdi@uigm.ac.id](Email:1 ferdi@uigm.ac.id), [2](2 darius.antoni@uigm.ac.id)[ darius.antoni@uigm.ac.id](2 darius.antoni@uigm.ac.id), [3](3 202231066@student.uigm.ac.id)[ 202231066@student.uigm.ac.id](3 202231066@student.uigm.ac.id),  \n[4](4 202231070@student.uigm.ac.id)[ 202231070@student.uigm.ac.id](4 202231070@student.uigm.ac.id), [5](5 chairul.mukmin@binadarma.ac.id)[ chairul.mukmin@binadarma.ac.id](5 chairul.mukmin@binadarma.ac.id),5,*[u.ependi@binadarma.ac.id](u.ependi@binadarma.ac.id)  \nAbstract  \nIn today's digital age, Software-Defined Networking (SDN) has become a pivotal technology that improves network control and flexibility. Despite its advantages, the centralized nature of SDN also makes it susceptible to threats such as Distributed Denial of Service (DDoS) attacks. This study compares the effectiveness of three machine learning models Random Forest, Naive Bayes, and Linear Support Vector Classification (LinearSVC) using the 'DDoS SDN dataset' from Kaggle, which contains 104,345 records and 23 features. An equal 70/30 ratio was used on model. The models were then assessed using measures such as accuracy, precision, recall, and F1-score, and ROC curves. Among the models, Random Forest outperformed the others with a 97% accuracy, precision values of 1.00 (benign traffic) and 0.94 (malicious traffic), and an ROC AUC score of 1.00. In contrast, Naive Bayes and LinearSVC recorded lower accuracies of 63% and 66%, respectively. These findings underscore Random Forest's effectiveness in detecting DDoS attacks within SDN environments.  \nKeywords: DDOS Attack, SDN, Vulnerabilities, Machine Learning.  \n1. INTRODUCTION  \nSoftware-defined networking (SDN) has significantly transformed the landscape of network management by providing a unified control system that enhances the flexibility of configuring network resources. This shift, while advantageous in many ways, has also introduced significant vulnerabilities. One of the most critical of these is the increased susceptibility to cyberattacks, particularly Distributed Denial of Service (DDoS) attacks. These attacks have the potential to overwhelm the SDN controller, leading to severe service disruptions [1][2] . The rising frequency of such attacks highlights the urgent need for effective detection and mitigation strategies that are specifically tailored to the unique architecture of SDN.  \n1790  \nThis work is licensed under a Creative Commons Attribution 4.0 International License.  \np-ISSN: 2656-5935 [http://journal-isi.org/index.php/isi](http://journal-isi.org/index.php/isi) e-ISSN: 2656-4882  \nIn recent years, machine learning has emerged as a promising approach for the rapid identification and management of DDoS attacks [3] . These methods are particularly valuable due to their ability to recognize patterns and detect anomalies in network traffic, making them well-suited to addressing the complexities associated with modern cyber threats. However, despite the potential of machine learning in this area, its application within the context of SDN remains underexplored. This is a significant concern given the distinct architecture and operational dynamics of SDN, which differ markedly from those of traditional network environments.  \nPrevious research has predominantly focused on the application of various machine learning techniques to traditional networking systems. These stu","cbCaivfcTLJeO1C5","https://ap.wps.com/l/cbCaivfcTLJeO1C5","pdf",493864,1,14,"English","en",105,"# Abstract\n# 1. Introduction","[{\"question\":\"Why does SDN increase vulnerability to DDoS attacks?\",\"answer\":\"SDN’s centralized controller architecture can be overwhelmed by Distributed Denial of Service (DDoS) attacks, causing service disruption.\"},{\"question\":\"Which machine learning models are compared for DDoS detection in SDN?\",\"answer\":\"The study compares Random Forest, Naive Bayes, and Linear Support Vector Classification (LinearSVC).\"},{\"question\":\"What dataset and evaluation metrics are used in the comparison?\",\"answer\":\"The “DDoS SDN dataset” from Kaggle (104,345 records, 23 features) is used with a 70/30 train-test split, evaluated using accuracy, precision, recall, F1-score, and ROC curves.\"}]","Machine Learning Models for DDoS Detection in Software-Defined Networking - A Comparative Analysis | PDF",1785937320,35,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"machine-learning-models-for-ddos-detection-in-software-defined-networking-a-comparative-analysis","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/machine-learning-models-for-ddos-detection-in-software-defined-networking-a-comparative-analysis/127171/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-05",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why does SDN increase vulnerability to DDoS attacks?","Question",{"text":75,"@type":76},"SDN’s centralized controller architecture can be overwhelmed by Distributed Denial of Service (DDoS) attacks, causing service disruption.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"Which machine learning models are compared for DDoS detection in SDN?",{"text":80,"@type":76},"The study compares Random Forest, Naive Bayes, and Linear Support Vector Classification (LinearSVC).",{"name":82,"@type":73,"acceptedAnswer":83},"What dataset and evaluation metrics are used in the comparison?",{"text":84,"@type":76},"The “DDoS SDN dataset” from Kaggle (104,345 records, 23 features) is used with a 70/30 train-test split, evaluated using accuracy, precision, recall, F1-score, and ROC curves.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]