Real-Time DDoS Detection and Mitigation in SDN with an Ensemble Online Learning Approach

Abstract

Software-Defined Networking (SDN) centralizes network control in a software controller, making it a high-value target for Distributed Denial-of-Service (DDoS) attacks. Existing machine learning defences are predominantly trained offline and require costly retraining to remain effective under evolving traffic patterns and concept drift. We present an adaptive online machine learning (OML) framework for realtime DDoS detection and mitigation that is integrated directly into the Ryu SDN controller. The framework combines four complementary incremental classifiers in a majority-vote ensemble and employs Chi-Square feature selection to reduce computational overhead while supporting continuous online adaptation. Evaluated on the real InSDN dataset using a strict prequential (test-then-train) protocol, the proposed approach achieves 99.06% mean accuracy, a 99.30% F1-score, and a 2.11% false alarm rate without requiring offline retraining. Compared with conventional offline classifiers evaluated on the same data stream, the proposed framework provides competitive detection performance while retaining the ability to adapt continuously to changing traffic distributions. A live Mininet deployment with a real-time Flask dashboard further demonstrates end-to-end attack detection and automated OpenFlow-based mitigation within a single polling interval. These results show that online ensemble learning provides an effective and practical foundation for adaptive SDN security in dynamic network environments.