Lightweight Machine Learning-Based DDoS Detection and Resilient Mitigation in Software Defined Networks

Abstract

Software Defined Networking (SDN) improves programmability and operational flexibility by separating the control plane from the data plane and centralising network control. However, the same architectural features that make SDN attractive also create a concentrated attack surface, particularly at the controller and its interactions with forwarding devices. Distributed Denial of Service (DDoS) attacks remain among the most disruptive threats in SDN because they can overwhelm control-plane resources, trigger excessive flow setup operations, and degrade forwarding performance across the network. This paper proposes a lightweight machine learning-based framework for the real-time detection and mitigation of DDoS attacks in SDN environments. The framework relies on low-cost flow-level statistics that are directly available to the controller and employs a Random Forest classifier to balance detection capability with low inference overhead. Unlike many prior approaches that prioritise classification accuracy without explicitly considering deployment constraints, the proposed design tightly couples controller-side classification with immediate mitigation actions such as flow blocking and rate limiting. Experimental evaluation in a Mininet-based SDN environment demonstrates strong classification performance while maintaining bounded controller-side overhead suitable for latency-sensitive SDN deployments. The work contributes a practical controller-integrated architecture that combines lightweight machine learning, rapid mitigation, and operational deployment considerations for AIdriven cyber defence in programmable networks.