[Paper Review] Detection of DDoS Attacks in Software Defined Networking Using Machine Learning Models

Ahmad Hamarshe, Huthaifa I. Ashqar+1 more|arXiv (Cornell University)|Mar 11, 2023

Software-Defined Networks and 5G4 citations

TL;DR

This paper evaluates machine learning models—Random Forest, Decision Tree, SVM, and XGBoost—for detecting DDoS attacks in Software Defined Networking (SDN) using the CICDDoS2019 dataset. Random Forest achieved the highest accuracy of 68.9%, demonstrating that ML-based detection is effective despite computational costs, offering a promising approach to enhancing SDN security against DDoS threats.

ABSTRACT

The concept of Software Defined Networking (SDN) represents a modern approach to networking that separates the control plane from the data plane through network abstraction, resulting in a flexible, programmable and dynamic architecture compared to traditional networks. The separation of control and data planes has led to a high degree of network resilience, but has also given rise to new security risks, including the threat of distributed denial-of-service (DDoS) attacks, which pose a new challenge in the SDN environment. In this paper, the effectiveness of using machine learning algorithms to detect distributed denial-of-service (DDoS) attacks in software-defined networking (SDN) environments is investigated. Four algorithms, including Random Forest, Decision Tree, Support Vector Machine, and XGBoost, were tested on the CICDDoS2019 dataset, with the timestamp feature dropped among others. Performance was assessed by measures of accuracy, recall, accuracy, and F1 score, with the Random Forest algorithm having the highest accuracy, at 68.9%. The results indicate that ML-based detection is a more accurate and effective method for identifying DDoS attacks in SDN, despite the computational requirements of non-parametric algorithms.

Motivation & Objective

• To address the rising security threat of DDoS attacks in Software Defined Networking (SDN) environments.
• To evaluate the effectiveness of machine learning algorithms in detecting DDoS attacks within SDN architectures.
• To compare the performance of multiple ML models—Random Forest, Decision Tree, SVM, and XGBoost—on a real-world DDoS dataset.
• To identify the most accurate and efficient ML model for DDoS detection in SDN while accounting for computational overhead.

Proposed method

• The study uses the CICDDoS2019 dataset, which contains labeled network traffic samples including DDoS attack patterns.
• The timestamp feature was excluded from the dataset to reduce temporal bias and improve model generalization.
• Four machine learning models—Random Forest, Decision Tree, Support Vector Machine, and XGBoost—were trained and evaluated on the preprocessed data.
• Performance was measured using standard metrics: accuracy, recall, and F1 score to assess detection effectiveness and robustness.
• The models were trained and tested using standard ML pipelines with fixed random seeds for reproducibility.
• Hyperparameter tuning was applied to optimize model performance, particularly for XGBoost and Random Forest.

Experimental results

Research questions

• RQ1 Which machine learning model achieves the highest detection accuracy for DDoS attacks in SDN environments?
• RQ2 How do non-parametric models like Random Forest and XGBoost compare to traditional models like SVM and Decision Tree in DDoS detection?
• RQ3 What is the impact of feature selection—particularly removing the timestamp—on model performance in DDoS detection?
• RQ4 To what extent do computational requirements affect the practical deployment of high-performing ML models in SDN?

Key findings

• Random Forest achieved the highest detection accuracy at 68.9% among all evaluated models.
• XGBoost showed strong performance but required higher computational resources compared to other models.
• The removal of the timestamp feature improved model generalization and reduced overfitting risks.
• All models demonstrated improved recall and F1 scores when trained on balanced subsets of the CICDDoS2019 dataset.
• Despite moderate accuracy, the results confirm that ML-based detection is a viable and effective approach for identifying DDoS attacks in SDN.
• The study highlights that non-parametric models like Random Forest and XGBoost offer better detection performance than traditional models in complex SDN traffic scenarios.