Comprehensive Performance Evaluation of Machine Learning Algorithms for detecting DDoS attacks in SDN

Abstract

<div align="center">Software-Defined Networking (SDN) revolutionizes networking by separating control logic and data forwarding, enhancing security against threats like Distributed Denial of Service (DDoS) attacks. These attacks flood control plane bandwidth, causing SDN network failures. Recent studies emphasize the efficacy of machine learning and statistical approaches in identifying and mitigating these security risks. However, there has been a lack of focus on employing ensembling techniques, amalgamating diverse machine learning models, selecting pertinent features, and utilizing oversampling techniques to balance categorical data. Our study evaluates 20 machine-learning models, emphasizing feature engineering and addressing class imbalance using Synthetic Minority Oversampling TEchnique (SMOTE). The results indicate that Ensemble methods such as LGBM Classifier, Random Forest Classifier, XGB Classifier, Decision Tree Classifier attained near-perfect scores (almost 100%) across all metrics, suggesting potential overfitting. Conversely, models like AdaBoost Classifier, K-Neighbors Classifier, and SVC exhibited slightly lower (99%) but realistic performance, underscoring the intricacy of accurate prediction in cybersecurity. Simpler models, including Logistic Regression, Linear Discriminant Analysis, and Gaussian Naive Bayes, demonstrated moderate to low accuracy, approximately around 70%. These findings stress the imperative need for a nuanced approach in the selection and fine-tuning of machine learning models to ensure effective DDoS detection in SDN environments.</div>