A Hybrid Deep Learning Model with Consensus-Based Feature Selection for DDoS Attacks Detection in SDN

Abstract

Software-Defined Networking (SDN) increases network flexibility by decoupling network control from hardware. However, this also makes networks more vulnerable to Distributed Denial of Service (DDoS) attacks, that can severely disrupt operations. Existing detection methods typically focus on specific DDoS attacks, highlighting the necessity for more comprehensive detection strategies. Our proposed methodology presents a resilient technique for detecting DDoS attacks by employing a hybrid deep learning approach. Utilizing the InSDN dataset tailored for SDN environments, we employ an advanced feature selection process based on a consensus approach to identify the best eight features, enhancing detection accuracy and efficiency. Cross entropy is utilized at the control plane to detect anomalous activity by computing the entropy between source IP (Internet Protocol) and destination IP data to identify DDoS attacks. Our proposed model integrates Long Short-Term Memory (LSTM) and Convolutional Neural Networks (CNN) networks, achieving a detection accuracy of 99.9%. The CNN provides efficient spatial feature extraction, while LSTM captures temporal dependencies, enhancing the model’s capability to detect complex attack patterns. We also implement a comprehensive evaluation framework, including metrics such as model loss, model accuracy, and confusion matrix.