Real-Time DDoS Detection by Integrated eBPF Telemetry and Machine Learning-enhanced SIEM

Mitigation of DDoS Attacks in the Data Plane of Software-Defined Networking Using ML Techniques

Distributed Denial-of-Service (DDoS) attacks remain one of the most significant cyber threats faced by Software-Defined Networking (SDN) architectures, essentially because of the salient decoupling of the control and data planes. This study examines the implications of DDoS attacks on the SDN data plane and evaluates the effectiveness of Machine Learning (ML) algorithms in detecting and addressing these attacks in real time. Using the Ryu controller, Mininet network emulator, and OpenFlow protocol, a realistic experimental environment was created to provide an accurate replica of the dynamic SDN behaviour under adverse circumstances. Empirical studies have demonstrated that distributed DDoS attacks, such as SYN, UDP, and ICMP flooding, substantially degrade network performance by reducing throughput, increasing packet loss, and exhausting switch flow table resources. To mitigate these effects, a suite of supervised machine learning classifiers, including Decision Tree, Random Forest, Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and Naïve Bayes (NB), was instantiated and evaluated using traffic features captured on the emulated platform. The key performance indicators used to evaluate the classifiers included accuracy, precision, recall, and F1-score. The findings indicate that the Decision Tree and KNN models achieved detection rates above the 99% mark, with strong precision and recall scores, which in turn highlights their suitability for implementation in SDN-based security systems. This study provides experimental evidence that ML-based intrusion detection mechanisms can significantly enhance the resilience of SDNs to volumetric attacks. These results promote the implementation of adaptive and responsive security modules in SDN controllers, thereby increasing network resilience, particularly in large and dynamically programmable networks.

Detection of distributed denial of service attacks in NFV environments using machine learning-based anomaly detection

Objectives: The rise of Network Function Virtualization (NFV) has created a scalable, flexible alternative to traditional hardware-based networking infrastructures. However, due to the nature of NFV, there is a potential for an increased occurrence of Distributed Denial of Service (DDoS) attacks in a dynamic NFV environment and the need for adaptive security mechanisms capable of identifying DDoS attacks with high levels of accuracy. Through this research, the author intends to develop a machine learning (ML)-based anomaly detection framework that uses ML techniques to detect DDoS attacks accurately within an NFV environment. Methodology: A ML model with the use of CICDDoS2019 (2020): Data (a dataset) includes data preprocessing, feature scaling, and principal component analysis (PCA), which are techniques for reducing the dimensions of the dataset and maintaining important features for analysis of traffic on the network in this article. Five ML models were developed from the training dataset: Isolation Forest, Autoencoder, One-Class Support Vector Machine (SVM), Random Forest (RF) and XGBoost (XG). An ensemble approach was also created to improve detection performance by combining three or more of these (or other) ML techniques. Findings from this research demonstrate that PCA can facilitate a reduction in dimensionality from 29 unique features to 24 unique principal components while preserving almost 95% of the variability in the original feature set. In addition, RF and XG were identified as the two highest-performing modeling algorithms, with each scoring a perfect “100” on all measures of performance (including accuracy, precision, recall, and F1) calculated. One-Class Support Vector Machine (OSVM) scored an average of 96%, and the composite of all three models (ensemble model) averaged 93% with a very limited ability to detect each of the different types of DDoS attacks with the same degree of confidence. Therefore, the results of this study support the use of the developed system for detection purposes for both previously known and unknown forms of DDoS attacks as well as increasing the overall level of reliability and resiliency against attacks targeting NFV infrastructure. Novelty: This research presents a novel hybrid framework for anomaly detection in NFV by integrating supervised, unsupervised, and semi-supervised ML methods within a single NFV security architecture. In addition, the proposed method employs PCA for dimensionality reduction and ensemble learning to improve detection accuracy, adaptation to evolving attack patterns, and computational efficiency of detected anomalies, thereby providing a more effective means of defeating DDoS attacks within virtualized network environments.

Explainable Machine Learning for DDoS Attack Detection with Physical Network Validation

Distributed Denial-of-Service (DDoS) attacks remain one of the most disruptive threats to network infrastructure, yet many machine learning (ML)-based detection studies report only offline benchmark performance without verifying whether that performance holds under real network conditions. This study evaluates two explainable ML classifiers, XGBoost and Random Forest, for DDoS detection and examines whether their near-perfect offline accuracy translates into reliable physical-network operation. The study combines offline benchmarking on the CIC-DDoS2019 dataset (293,485 flows) with physical-network validation using a working Intrusion Detection System (IDS) prototype under a controlled SYN-flood attack. Session-disjoint stratified sampling prevented flow-level leakage across attack sessions, while SHapley Additive exPlanations (SHAP) interpreted global and local feature importance. Offline, both classifiers achieved near-perfect performance (accuracy 99.99% for XGBoost, 99.98% for Random Forest; F1 = 0.9999; ROC-AUC up to 1.0000), with no statistically significant difference between them (McNemar's exact test, p = 0.2188), though XGBoost achieved approximately 3.69 times higher inference throughput (1,819,816 flows/s). SHAP identified Min Packet Length, Fwd Packet Length Min, Inbound, Protocol, and Init_Win_bytes_forward as the most influential features. In physical deployment, however, the IDS prototype flagged 6.26% of captured flows (6,935 of 110,762) as ATTACK during the SYN-flood test, and a separate 397-flow ambient-benign subset yielded a 6.80% false positive rate (95% Wilson CI: 4.72–9.71%), with short-duration SSDP/UPnP-style UDP control traffic accounting for 70% of observed false positives. This gap shows that near-perfect offline accuracy does not guarantee low false positives in real deployment, indicating that offline benchmarks alone are insufficient for validating IDS readiness.

Exploring Rapid Detection of DDoS Attack in SDN Using Machine Learning Algorithms With the Classification Technique

Development of an Intelligent DDoS Detection and Mitigation System using Router Log and Flow-based Traffic Analysis with Ensemble Machine Learning

The increasing frequency and advance of Distributed Denial of Service (DDoS) attacks have rendered traditional signature-based detection methods insufficient for protecting modern network infrastructures. This study presents the development of an intelligent DDoS detection and mitigation system that synergizes router log analysis with flow-based traffic monitoring using ensemble machine learning. The proposed system continuously captures and processes router Syslog data and network flow records in real time, extracts statistical features from both data sources, and applies a Hist Gradient Boosting Classifier model for attack classification. The model achieved 99.96% accuracy and 99.97% F1-score on the holdout test set, with only 14 false positives and 24 false negatives out of 86,274 test samples. The system architecture integrates a web-based dashboard providing real-time visualization of network traffic, attack alerts, and mitigation actions. Automated mitigation mechanisms including rate limiting, IP blacklisting, and Access Control List (ACL) updates are triggered upon attack confirmation. Evaluation using the CICDDoS2019 dataset demonstrates the system's effectiveness with high detection accuracy and low false-positive rates. The proposed system provides a scalable, cost-effective, and privacy-preserving solution suitable for deployment in ISP and enterprise networks without reliance on commercial DDoS mitigation appliances.

Cloud-Based Security Analytics SIEM Using ELK Stack and Machine Learning

The increasing frequency and sophistication of cyberattacks have created significant challenges for organizations in protecting their digital infrastructure. Traditional Security Information and Event Management (SIEM) systems primarily depend on predefined rules and signature-based detection techniques, which are often inadequate for identifying emerging or previously unseen attack patterns. To address these limitations, this paper presents a Cloud-Based Security Analytics SIEM Using ELK Stack and Machine Learning for intelligent cyberattack detection and real-time security monitoring. The proposed framework integrates Elasticsearch, Logstash, and Kibana (ELK Stack) with supervised machine learning algorithms to automate log collection, processing, threat classification, and security visualization. The CICIDS2017 dataset, containing approximately 2.5 million network traffic records, 70 selected features, and 15 attack categories, was used to train and evaluate the intrusion detection models. Random Forest, LightGBM, and XGBoost classifiers were developed and compared using multiple performance metrics. Experimental results indicate that the XGBoost model achieved the best overall performance with an accuracy of 99.86% and a Macro F1-score of 89.57%, demonstrating its effectiveness in multiclass cyberattack classification. The trained model was integrated with the ELK-based analytics platform to support automated attack prediction and centralized visualization through Kibana dashboards. The proposed system provides an efficient, scalable, and intelligent approach for enhancing cybersecurity monitoring by combining cloud-based log analytics with machine learning-driven threat detection. The framework can assist Security Operations Centers (SOCs) in improving incident detection, accelerating security analysis, and supporting proactive cyber defense.