A Lightweight Stacking Ensemble Intrusion Detection Framework for Software-Defined Networking Using the InSDN Dataset

Exploring Rapid Detection of DDoS Attack in SDN Using Machine Learning Algorithms With the Classification Technique

Enhancing IoT network security with explainable deep learning-based intrusion detection systems.

A lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware.

A PSO-Optimized gradient boosting framework for flow-based DDoS detection in software-defined networks

Software-Defined Networking (SDN) provides a programmable and centrally managed network architecture, but its centralized control plane introduces significant vulnerability to Distributed Denial of Service (DDoS) attacks. These attacks can overwhelm controller resources and disrupt network availability, making efficient and reliable detection mechanisms essential. This study proposes an optimization-driven ensemble learning framework for DDoS detection in SDN environments by integrating a Gradient Boosting Classifier (GBC) with Particle Swarm Optimization (PSO). PSO is employed to automatically tune key hyperparameters of the ensemble model, improving classification stability and enhancing detection performance while maintaining lightweight inference suitable for real-time deployment in SDN monitoring systems. The proposed framework is evaluated using an SDN-specific dataset generated in a realistic Mininet-based environment with OpenFlow-enabled switches and a Ryu controller. Experimental results under stratified 5-fold cross-validation show near-perfect detection performance, achieving accuracy and F1-score values 0.9999, with consistently high precision and recall. To further assess generalization capability, the model is validated on the CICDDoS2019 benchmark dataset, where it achieves more than 99% accuracy across all evaluation metrics. The results demonstrate strong robustness across heterogeneous traffic distributions while maintaining stable performance. Overall, the findings indicate that PSO-enhanced ensemble learning provides an effective and computationally efficient approach for improving DDoS detection in SDN environments, offering a practical balance between accuracy, robustness, and deployment feasibility.

Evaluation Framework for Cross-Layer Intrusion Detection Based on ML Approaches

This work proposed a modular weight-based framework that evaluates cross-layer Machine Learning (ML) IDS across multiple dimensions, namely, detection effectiveness and generalizability, data quality, and attack coverage and practical deployability, and applied this framework to the state-of-the-art cross-layer ML IDS identified through the PRISMA framework.

Intelligent DDOS Attack Detection and Mitigation Using Machine Learning Techniques

An intelligent DDoS detection and mitigation framework that combines classical Machine Learning (ML) classifiers with Deep Learning (DL) architectures to achieve high-fidelity, low-latency attack identification across heterogeneous network topologies is presented.

A Family-Aware Hierarchical XGBoost Framework for Efficient IoT Intrusion Detection

: Machine learning-based intrusion detection for Internet of Things (IoT) networks remains difficult because modern traffic is highly imbalanced and attack behaviors are heterogeneous. Evaluation pipelines can also overestimate performance when preprocessing is performed before train-test separation. We propose a family-aware hierarchical intrusion detection framework for attack-family prediction. The proposed approach first separates normal and attack traffic, then routes attack samples into empirically defined majority and minority attack-family branches, and finally performs branch-specific family classification. Within each cross-validation fold, training-label counts define the majority/minority routing branches, while scaling, weighting, model fitting, stage diagnostics, and metric computation remain fold-local. The final implementation uses XGBoost as the base learner in the hierarchical stages and compares it with flat LightGBM, XGBoost, Random Forest, Extra Trees, and stacking baselines under matched folds and metrics. On the CICIoT2023 30% stratified development split, the proposed approach achieved a Macro-F1 of 0.8380 and Weighted-F1 of 0.9940, performing close to the best flat Random Forest baseline while improving weak rare-family F1 scores for BruteForce and Web. On Edge-IIoTset, where the full processed dataset is used, the proposed approach achieved a Macro-F1 of 0.9456 and Weighted-F1 of 0.9494, outperforming all individual flat baselines and approaching the flat stacking ensemble. The hierarchy had lower inference time than the evaluated flat baselines under the workstation protocol.