Enhancing DDoS Attack Detection in SDN: A Novel Approach with IG-RFFI Feature Selection

Software-Defined Networking (SDN) is an emerging technology that revolutionizes future network design with its dynamic and efficient capabilities. It introduces a new definition of “network” by allowing network components to be programmable. This centralized, programmable architecture empowers network operators to control and design the entire network from one central location. However, while SDN offers extensive network visibility and robustness, it remains susceptible to security risks such as Distributed Denial of Service (DDoS) attacks, capable of causing network-wide disruptions. To counter such threats, many machine learning (ML) models have been developed to mitigate DDoS attacks on SDN. The effectiveness of these models relies heavily on an appropriate training dataset and the selection of relevant features. In this study, we address this challenge by employing the Information Gain (IG) and Random Forest Feature Importance (RFFI) techniques to identify the most significant features in the dataset. Subsequently, we utilize various Machine Learning algorithms to classify the resulting dataset. Based on our results, the SVM algorithm demonstrated the highest detection rate of 98.14%, the lowest false positive rate, and the shortest detection time.