A closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement is presented, evaluating its performance against this stringent temporal constraint rather than relying exclusively on detection accuracy.
Abstract
Autonomous response has evolved into a timing-critical challenge rather than solely a matter of detection accuracy. In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds, a window that precludes any human-in-the-loop workflow. This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement, evaluating its performance against this stringent temporal constraint rather than relying exclusively on detection accuracy. An automated data pipeline collects IP flows and aggregates them into labeled training data, while a prevention module selects and trains candidate classifiers and issues blocking rules directly to the SDN controller. In a SYN flooding denial of service case study, the deployed K-Nearest Neighbors classifier achieved an F1 score of 96.7% and the cycle from flow availability to enforced block completed in 21 seconds, below the fastest breakout time reported to date.
The recent trend of Software-Defined Networking (SDN) has posed significant cybersecurity challenges as a result of its centralized control architecture, dynamic traffic behavior, and high programmability. Although these attributes improve network flexibility and management, they also increase vulnerability to Distributed Denial-of-Service (DDoS) attacks that can overwhelm network resources and disrupt services. Traditional signature- and rule-based detection methods may struggle with evolving traffic patterns and generate excessive false alarms. Machine learning offers a more promising solution that can learn the complex traffic patterns and separate malicious traffic from normal traffic. Most machine learning models, however, are black-box models that provide only superficial insight into the model predictions. Explainable Artificial Intelligence (XAI) addresses this limitation by identifying influential traffic features and providing interpretable evidence for detection decisions. This research develops an explainable machine learning-based framework for accurate, transparent, and reliable DDoS attack detection in an SDN environment. Several machine learning models are assessed, and XAI techniques are applied to explain the results of the predictions at global and instance levels. Gradient Boosting, Logistic Regression, AdaBoost, and Gaussian Naive Bayes were evaluated on 104,345 network-flow records using a 70:30 training–testing split. Gradient Boosting achieved the strongest performance, with 99.88% training accuracy, 99.87% testing accuracy, a testing F1-score of 99.84%, and a 0.20% miss rate. SHAP identified the most influential traffic features, while LIME linked individual predictions to feature-specific contributions. The proposed framework therefore combines reliable DDoS detection with transparent, analyst-oriented decision support for SDN security monitoring.
J. Malik, N. Naz, Muhammad Saleem et al.· Italian National Conference...· 0 citations
Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.
This paper evaluates an ultra-compact five-feature polling scheme (F1–F5) designed to preserve statistical symmetry between control-plane monitoring and telemetry overhead within a dynamic Mininet–Ryu testbed and reveals that tree-based ensembles consistently outperform deep learning approaches.
: Machine learning has radically transformed network security, enabling intrusion detection systems capable of identifying malicious traffic with near-perfect accuracy on standard benchmarks. However, these systems remain critically vulnerable to adversarial examples—subtly manipulated inputs designed to escape detection—where performance can severely drop under minimal perturbation. This paper introduces the Hierarchical Adversarially-Driven Escalation System (hades), a framework that addresses this vulnerability through three coordinated mechanisms. First, dedicated detectors are trained for each network protocol, enabling each model to specialize in specific traffic patterns it will face in practice. Second, these detectors are continuously hardened by simulating an arms race between an attacking agent, which learns to find the most damaging evasion strategies, and a defending model that adapts in response, thus producing classifiers that remain robust across a wide range of attack types. Third, incoming traffic is routed through a cost-aware pipeline that reserves expensive analysis for uncertain or suspicious flows, keeping average processing time at 5.4 ms per batch on normal traffic. hades is evaluated on CIC-IDS-2018, a large-scale real-world network dataset, and maintains near-perfect detection accuracy under both normal and adversarial conditions, with robustness verified across nine distinct attack strategies and 95% bootstrap confidence intervals of maximum width 0.0007.
A. Derhab, Adlen Kerboua, N. Seddari et al.· Computer Modeling in Enginee...· 0 citations
Network infrastructure faces mounting pressure from increasingly sophisticated cyber attacks targeting systems reliant on digital connectivity. Activities such as Denial of Service, Probe, Remote-to-Local, and User-to-Root represent persistent threats that are challenging to intercept manually owing to high traffic volumes and rapidly evolving intrusion strategies. This work constructs a web-based Intrusion Detection System prototype by training an entropy-based Decision Tree classifier, conceptually grounded in the C4.5 framework, on the NSL-KDD benchmark. Development adheres to the six-phase CRISP-DM process encompassing business understanding, data preparation, model construction, performance evaluation, and system deployment. Preprocessing involves duplicate record elimination, categorical attribute encoding, and consolidation of multi-class attack labels into a binary Normal/Anomaly scheme. Ten-fold cross-validation yields 99.34% accuracy and 99.35% precision for the Decision Tree, representing a substantial margin over Naive Bayes which attains only 66.67% accuracy. A separate Gain Ratio analysis designates src_bytes as the most informative feature with a value of 0.5366, positioning it as the decision tree root node. The prototype is served through a Streamlit web application that accepts CSV dataset uploads, executes batch anomaly classification, presents detection outcomes through interactive visualizations, and produces exportable reports in both CSV and PDF formats. The system offers an interpretable and practically accessible batch-detection tool, continuous real-time monitoring and evaluation on contemporary intrusion benchmarks are identified as priorities for subsequent research.
Daniel Erick Witopo, Hartana Wijaya· bit-Tech· 0 citations
Large-scale DDoS attacks remain a serious threat to today's networked systems, which aim to make services unavailable by sending a massive amount of traffic. The traditional detection methods are mostly about attack categorization and are not that context-aware or actionable in providing support to security analysts. We propose SentinelsGuard AI, a self-learning DDoS classification and mitigation system that is built from a combination of machine learning, retrieval-augmented knowledge, and LLM-based reasoning in one platform. The proposed system is realized as a Flask-based web application, which processes the network flow statistics data, extracted from incoming traffic, and transforms the data to generate representative features of the network flows, before detecting the attacks using the XGBoost classifier. After classification, the framework accesses domain-specific attack intelligence from a structured Retrieval-Augmented Generation (RAG) knowledge base with profiles of multiple categories of DDoS attacks. This contextual information is used with LLM-enabled reasoning to derive comprehensible security explanations, determine the severity of the attack, and suggest the firewall mitigation rules that can be applied. The framework stores analysis data in a SQLite database for operational monitoring, and displays security events in an interactive dashboard that includes traffic visualization, attack logs, and threat summaries. The architecture proposed brings statistical learning together with contextual knowledge of cybersecurity and attempts to bridge the gap between automatic attack detection and explainable incident response. It integrates all the key features of a classification-based network security decision support platform into a single stream, enabling a classification-based approach to network security to become more interpretable and usable in reality: persistent logging, visualization, knowledge retrieval, reasoning, and system recommendation of mitigations.
K. V. Sai Phani, P. Karthik, Farooq Sunar Mahammad et al.· 2026 International Conferenc...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
