ML-Based DDoS Detection for SDN
Final year research project targeting a real gap in SDN-native security: how to detect DDoS without relying on brittle threshold rules or signature databases.
Traditional DDoS detection in SDN environments relies on threshold rules that miss subtle attacks and false-positive under normal traffic bursts. Signature-based tools don't generalize to novel attack patterns.
Feature-engineered flow-level dataset from Mininet-emulated SDN topology. Trained and compared multiple classifiers (Random Forest, Gradient Boosting, SVM) on labeled benign vs attack traffic. Random Forest won on the accuracy/interpretability trade-off with 99.20% test accuracy.
Workflow breakdown
Phase 1 — Topology & dataset generation
Built the emulated SDN environment and collected labeled traffic.
- Mininet topology with Ryu controller, 8 hosts across 3 switches
- Benign traffic: synthetic mixed workload (HTTP, ICMP, DNS) at realistic rates
- Attack traffic: SYN flood, ICMP flood, UDP flood variants
- Flow statistics collected via OpenFlow at 5-second intervals
Phase 2 — Feature engineering
Extracted 12 flow-level features from raw OpenFlow stats.
- Packet count, byte count, flow duration per flow
- Packet rate + byte rate deltas across time windows
- Protocol distribution ratios per switch
- Source-IP entropy per window (key discriminator for flood attacks)
Phase 3 — Model comparison & selection
Trained and benchmarked three classifiers on the balanced dataset.
- Random Forest (100 trees): 99.20% test accuracy
- Gradient Boosting: 98.7% test accuracy
- SVM (RBF kernel): 96.4% test accuracy
- Random Forest picked for accuracy + feature-importance interpretability
Why this matters
Signature-free detection generalizes to attack variants the training set never saw
Feature-importance output tells network operators why a flow was flagged — not a black box
Runs at flow-collection cadence, not per-packet — deployable inside a real SDN controller