Flow-Based DDoS Detection and Mitigation in Software-Defined Networking Using a Hybrid CNN-LSTM-Transformer Model
TL;DR
The findings indicate CNN-LSTM-Transformer model provides an accurate, efficient, and deployment-oriented DDoS defense approach for emulated SDN environments.
Abstract
Background: Software-Defined Networking (SDN) improves network programmability through centralized control, but this architecture also makes the controller vulnerable to Distributed Denial-of-Service (DDoS) attacks that may overload Packet-In processing, exhaust controller resources, and disrupt service availability. Objective: This study aims to develop and evaluate a flow-based DDoS detection and mitigation approach in SDN using a hybrid CNN-LSTM-Transformer model. Methods: The proposed model represents flow records as feature sequences, enabling CNN to capture local feature patterns, LSTM to learn sequential dependencies, and Transformer self-attention to model global inter-feature relationships. Offline evaluation was conducted on CIC-DDoS2019, inSDN, and CIC-IDS2017 using 71 features, stratified 70:20:10 training/validation/testing splits, and three independent seeds. A CNN-LSTM ablation model was used for comparison. Results: The results show the proposed model achieved mean accuracies of 99.87%, 99.98%, and 99.93% on CIC-DDoS2019, inSDN, and CIC-IDS2017, respectively. Compared with CNN-LSTM, the proposed model produced lower mean validation losses and required fewer epochs across all datasets. In real-time validation, UDP, TCP, and ICMP flooding attacks were detected within 0.0693-0.2668s and mitigated using high-priority drop rules, reducing Ryu CPU usage from 52.6%-91.4% during attacks to 0.7%-1.7% after blocking. Conclusion: The findings indicate CNN-LSTM-Transformer model provides an accurate, efficient, and deployment-oriented DDoS defense approach for emulated SDN environments. The proposed model not only achieved high accuracy in offline testing but also demonstrated feasibility in real-time SDN environments with relatively low computational overhead, achieving detection times of 0.0693–0.2668s and reducing Ryu CPU usage from up to 91.4% during attacks to below 1.7% after mitigation.
