Software-Defined Networking (SDN) has transformed network architectures by decoupling control and data planes, providing centralized management and dynamic resource allocation. However, this centralization makes SDN highly susceptible to Distributed Denial of Service (DDoS) attacks, which can overwhelm the controller, degrade performance, and disrupt network availability. Traditional machine learning models often struggle with generalization to unseen attack patterns due to their reliance on fixed feature representations and static decision boundaries. This limitation can be overcome by Large Language Models (LLMs), which leverage contextual understanding and adaptive learning to dynamically model complex, evolving traffic behaviors, enhancing robustness against novel DDoS strategies. To address these challenges, this study investigates the use of transformer-based LLMs for effective DDoS detection. The CICDDoS2019 dataset was utilized, with a stratified sampling approach preserving the distribution of benign and attack traffic. The multi-feature selection process was used to identify the ten most critical traffic features, which were transformed into natural language representations for model compatibility. Three LLMs– BERT, RoBERTa, and FNet–were fine-tuned and compared against classical models including Logistic Regression and K-Nearest Neighbour. Experimental results demonstrate that FNet delivered highly competitive performance 99.5% accuracy with significant advantages in training speed and scalability, due to its efficient Fourier-transform-based architecture. Furthermore, FNet achieved an AUC of 0.99, confirming its robustness in distinguishing between benign and malicious traffic flows.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Detection of DDoS Attacks in SDN Using Feature Optimization and FNet-Based Transformer Models

  • Amit Kachavimath,
  • Satish Vaishyar,
  • Ayush Chugani,
  • Samarth Joshi,
  • Sanjana A. More,
  • G. Narayan

摘要

Software-Defined Networking (SDN) has transformed network architectures by decoupling control and data planes, providing centralized management and dynamic resource allocation. However, this centralization makes SDN highly susceptible to Distributed Denial of Service (DDoS) attacks, which can overwhelm the controller, degrade performance, and disrupt network availability. Traditional machine learning models often struggle with generalization to unseen attack patterns due to their reliance on fixed feature representations and static decision boundaries. This limitation can be overcome by Large Language Models (LLMs), which leverage contextual understanding and adaptive learning to dynamically model complex, evolving traffic behaviors, enhancing robustness against novel DDoS strategies. To address these challenges, this study investigates the use of transformer-based LLMs for effective DDoS detection. The CICDDoS2019 dataset was utilized, with a stratified sampling approach preserving the distribution of benign and attack traffic. The multi-feature selection process was used to identify the ten most critical traffic features, which were transformed into natural language representations for model compatibility. Three LLMs– BERT, RoBERTa, and FNet–were fine-tuned and compared against classical models including Logistic Regression and K-Nearest Neighbour. Experimental results demonstrate that FNet delivered highly competitive performance 99.5% accuracy with significant advantages in training speed and scalability, due to its efficient Fourier-transform-based architecture. Furthermore, FNet achieved an AUC of 0.99, confirming its robustness in distinguishing between benign and malicious traffic flows.