Dynamic multiphase DDoS attack identification and mitigation framework to secure SDN-based fog-empowered consumer IoT Networks

Abstract

The rapid growth of Consumer-Internet-of-Things (CIoT) devices has introduced critical vulnerabilities, making them susceptible to Distributed Denial-of-Service (DDoS) attacks. This paper proposes a multi-phase framework for detecting and mitigating DDoS attacks in Software-Defined Networking (SDN)-based fog-enabled IoT networks (SD-FCIoT). The framework combines entropy-based anomaly detection with machine learning for accurate and timely attack identification. Dynamic thresholding using Chebyshev’s inequality ensures adaptability to network changes, while an attribute selection algorithm using symmetrical uncertainty and k-means clustering enhances classification accuracy. Experiments conducted in a simulated SD-FCIoT environment and with the BoT-IoT dataset demonstrate the framework’s effectiveness. Random Forest (RF) achieved 98.71% accuracy for binary classification and excelled in multi-class attack detection, including Ping Flood and TCP-SYN Flood attacks. The attribute selection algorithm improved detection accuracy by 1.22% and reduced false positives. Furthermore, the fog-enabled architecture lowered response time by 35% compared to centralized systems. These results highlight the framework’s scalability and efficiency in securing CIoT networks against diverse DDoS attacks.