Machine Learning and Deep Learning Techniques for Distributed Denial of Service Anomaly Detection in Software Defined Networks - Current Research Solutions

The rapid evolution and adoption of Software Defined Networks (SDNs) have significantly enhanced network management and flexibility. However, the increased centralization of network control in SDNs has also introduced new security vulnerabilities, particularly Distributed Denial of Service (DDoS) attacks. This paper focuses on the application of both unsupervised and supervised machine learning techniques to detect and classify network traffic into two categories: normal and DDoS attack.

In the realm of unsupervised learning, K-Means clustering, Principal Component Analysis (PCA), and K-Best feature selection techniques are employed to identify patterns and anomalies in network traffic data without prior labeling. These techniques help in reducing the dimensionality of the data and selecting the most relevant features for the detection process.

For supervised learning, a comprehensive analysis is conducted using Decision Trees, Random Forests, and ensemble methods such as Stacking and Voting classifiers. Decision Trees and Random Forests offer interpretability and robustness in classification tasks, while Stacking and Voting classifiers leverage the strengths of multiple models to improve detection accuracy.

Through rigorous evaluation and comparison, this study aims to identify the most effective machine learning approaches for detecting DDoS attacks in SDNs. The findings contribute to the development of more resilient and adaptive security solutions for modern network infrastructures, ensuring the integrity and availability of network services.

Keywords: Software Defined Networks (SDN), Distributed Denial of Service (DDoS) attacks, unsupervised learning, supervised learning, K-Means, PCA, K-Best feature selection, Decision Tree, Random Forest, Stacking classifier, Voting classifier.