Evaluation of distributed denial of service attacks detection in software defined networks

Abstrak

Software-defined networking (SDN) revolutionizes networking by separating control logic and data forwarding, enhancing security against threats like distributed denial of service (DDoS) attacks. These attacks flood control plane bandwidth, causing SDN network failures. Recent studies emphasize the efficacy of machine learning (ML) and statistical approaches in identifying and mitigating these security risks. However, there has been a lack of focus on employing ensembling techniques, amalgamating diverse ML models, selecting pertinent features, and utilizing oversampling techniques to balance categorical data. Our study evaluates 20 machine-learning models, emphasizing feature engineering and addressing class imbalance using synthetic minority oversampling technique (SMOTE). The results indicate that ensemble methods such as light gradient boosting machine (LGBM) classifier, random forest classifier, XGB classifier, decision tree classifier obtained near-perfect scores (almost 100%) across all metrics, suggesting potential overfitting. Conversely, models like AdaBoost classifier, k-neighbors classifier, and support vector classifier (SVC) exhibited slightly lower (99%) but realistic performance, underscoring the intricacy of accurate prediction in cybersecurity. Simpler models, including logistic regression, linear discriminant analysis, and Gaussian naive Bayes, demonstrated moderate to low accuracy, approximately around 70%. These findings stress the imperative need for a nuanced approach in the selection and fine-tuning of ML models to ensure effective DDoS detection in SDN environments.