SDN Controller Research Articles

Centralized and distributed approaches to control optical point-to-multipoint systems near-real-time

Optical point-to-multipoint (P2MP) connectivity based on digital subcarrier multiplexing (DSCM) has been shown as a solution for the metro-access segment that is able to reduce capital and operational costs and support the capacity and high dynamicity needs of future 6G services. To achieve maximum performance, activation and deactivation of subcarriers must be done near-real-time to provide just the capacity needed to support the input traffic. In this paper, we investigate the applicability of various approaches capable of supporting the near-real-time operation requirement. Starting from the centralized approach that can be carried out on the centralized software-defined networking (SDN) controller, we also explore distributed approaches that might relieve the SDN controller from near-real-time operation. In particular, we explore the performance of deploying a multiagent system (MAS), where intelligent agents run on top of the nodes in the P2MP tree and communicate among them. Illustrative results show that the distributed approaches can achieve a performance close to that of the centralized one, while reducing communication needs. Results also show the importance of traffic/capacity prediction to anticipate the activation of subcarriers.

A Novel SDN-Based Architecture of Task Offloading in Mobile Ad-Hoc Cloud

As the core function of mobile Ad-hoc cloud, task offloading has always been a research hotspot of mobile cloud computing, and the construction, offloading decision, task division and scheduling strategies of mobile Ad-hoc cloud directly affect the performance of offloading. In this paper, we propose a new mobile Ad-hoc cloud architecture based on SDN solving the performance bottleneck of opportunistic task offloading. The proposed solution constructs terminal clusters in Ad-hoc cloud to provide users with offloading service, and makes offloading decision and task allocation through SDN controller to achieve the effectiveness of task allocation and the rationality of resource scheduling. Simulation results show that compared with traditional scheduling method, our method has the advantages in offloading ratio and execution efficiency, and can be more effectively used in dynamic mobile edge network environment, to improve network performance and user service satisfaction.

Adaptive quality of service for packet loss reduction using OpenFlow meters.

Quality of Service (QoS) is a mechanism used in computer networks to prioritize, classify, and treat packets differently based on certain criteria. This helps the switching devices to schedule and reorder packets if there is congestion in the network. Edge routers experience high traffic congestion as a result of traffic aggregation from the internal network devices. A router can have multiple QoS classes configured, and each class could experience traffic at various rates. However, when a QoS class is underperforming or needs more bandwidth, some bandwidth can be borrowed or leased out to another QoS class to ensure the link is utilized to maximum capacity and the highest throughput is achieved. This article proposes a bandwidth allocation and distribution algorithm that purely uses the flow statistics from the OpenFlow switches to allocate bandwidth to different QoS classes optimally based on their current requirement. The algorithm does not guarantee in advance that the packet loss will be minimized but does guarantee the initial minimum bandwidth allocation. It adjusts the flows' rates with the aim to increase their current throughput. The algorithm uses the Software Defined Networking (SDN) controller's flow monitoring component to query the flow statistics from the switch to first approximate the traffic flow rate and then calculate the optimal bandwidth values to assign to each QoS class. The proposed algorithms will be applied to certain switches in the path with the assumption that all the switches are OpenFlow compatible. The algorithm's performance was compared with the Adaptive Quality of Service (AQoS) algorithm over various traffic scenarios. The results show that the proposed algorithm achieves an average of 9% performance gain compared to the AQoS algorithm.

SDN-based detection and mitigation of DDoS attacks on smart homes

The adoption of the Internet of Things (IoT) has proliferated across various domains, where everyday objects like refrigerators and washing machines are now equipped with sensors and connected to the internet. Undeniably, the security of such devices, which were not primarily designed for internet connectivity, is of utmost importance but has been largely neglected. In this paper, we propose a framework for the real-time DDoS attack detection and mitigation in SDN-enabled smart home networks. We capture network traffic during regular operations and during DDoS attacks. This captured traffic is used to train several machine learning (ML) models, including Support Vector Machine (SVM), Logistic Regression, Decision Trees, and K-Nearest Neighbors (KNN) algorithms. These trained models are executed as SDN controller applications and subsequently employed for real-time attack detection. While we utilize ML techniques to protect IoT devices, we propose the use of SNORT, a signature-based detection technique, to secure the SDN controller itself. Real-world experiments demonstrate that without SNORT, the SDN controller goes offline shortly after an attack, resulting in a 100% packet loss. Furthermore, we show that ML algorithms can efficiently classify traffic into benign and attack traffic, with the Decision Tree algorithm outperforming others with an accuracy of 99%.

A Survey on the Latest Intrusion Detection Datasets for Software Defined Networking Environments

Software Defined Networking (SDN) threats make network components vulnerable to cyber-attacks, creating obstacles for new model development that necessitate innovative security countermeasures, like Intrusion Detection Systems (IDSs). The centralized SDN controller, which has global view and control over the whole network and the availability of processing and storing capabilities, makes the deployment of artificial intelligence-based IDS in controllers a hot topic in the research community to resolve security issues. In order to develop effective AI-based IDSs in an SDN environment, there must be a high-quality dataset for training the model to offer effective and accurate attack prediction. There are some intrusion detection datasets used by researchers, but those datasets are either outdated or incompatible with the SDN environment. In this survey, an overview of the published work was conducted using the InSDN dataset from 2020 to 2023. Also, research challenges and future work for further research on IDS issues when deployed in an SDN environment are discussed, particularly when employing machine learning and deep learning models. Moreover, possible solutions for each issue are provided to help the researchers carry out and develop new methods of secure SDN.

SDN-Based Secure Common Emergency Service for Railway and Road Co-Existence Scenarios

In the near future, there will be a greater emphasis on sharing network resources between roads and railways to improve transportation efficiency and reduce infrastructure costs. This could enable the development of global Cooperative Intelligent Transport Systems (C-ITSs). In this paper, a software-defined networking (SDN)-based common emergency service is developed and validated for a railway and road telecommunication shared infrastructure. Along with this, the developed application is capable of reducing the chances of distributed denial-of-service (DDoS) situations. A level-crossing scenario is considered to demonstrate the developed solution where railway tracks are perpendicular to the roads. Two cases are considered to validate and analyze the developed SDN application for common emergency scenarios. In case 1, no cross-communication is available between the road and railway domains. In this case, emergency message distribution is carried out by the assigned emergency servers with the help of the SDN controller. In case 2, nodes (cars and trains) are defined with two wireless interfaces, and one interface is reserved for emergency data communication. To add the DDoS resiliency to the developed system the messaging behavior of each node is observed and if an abnormality is detected, packets are dropped to avoid malicious activity.

Game theory-based switch migration strategy for satellite networks

Software-Defined Networking (SDN) separates the control plane and data plane of the network, abstracting the underlying infrastructure of applications and network services and handing it over to the SDN controller for unified management. The introduction of SDN technology into satellite networks effectively addresses control challenges posed by dynamic topologies and intermittent inter-satellite links. Due to factors such as geography and usage patterns, the distribution of remote sensing data traffic is uneven in both space and time. Some remote sensing satellites may acquire large volumes of data within a short period and transmit them back to the ground through intermediate nodes, leading to a sudden surge in load on certain controllers. This situation adversely impacts the performance of remote sensing data transmission. To mitigate this, switch migration operations are required to alleviate the load on overloaded controllers and to achieve the load balance among all controllers. In this paper, a switch migration scheme based on game theory is proposed under a three-layer satellite network architecture, which is designed based on the management costs and ensures timely triggering of the migration operations. Moreover, a game theory-based matching optimization model is formulated in the scheme to address the matching problem between target controllers and migration candidate switches. We further propose a distributed algorithm to seek the Nash equilibrium within the game. Experimental results demonstrate that, compared to other relevant algorithms, this approach can find the near-optimal matching strategy for each target controller and reduce the average latency of these controllers.

BlockSD‐5GNet: Enhancing security of 5G network through blockchain‐SDN with ML‐based bandwidth prediction

AbstractThe fifth generation (5G) of mobile communications is the most exciting emerging technology for researchers and scientists to get the full benefit of a network system. However, 5G networks confront massive threats and vulnerabilities including protection, privacy, and secrecy. To face these challenges in the increasingly interconnected Internet of Things (IoT) scenario, we aim to leverage state‐of‐the‐art technologies as software defined networking (SDN) in conjunction with network function virtualization (NFV), blockchain, and machine learning (ML). Indeed, these technologies convey a robust and secure setting in the networking platform enabling to manage several criticalities related to security, privacy, flexibility, and performance. In light of these considerations, in this article, we propose the “BlockSD‐5GNet” architecture to efficiently improve the security of a 5G network and to exploit the combined advantages of Blockchain, SDN, NFV, and ML. In the proposed architecture, the SDN helps to manage the network by dividing it into data plane and control plane, while the Blockchain guarantees improved security and confidentiality. Therefore, the “BlockSD‐5GNet” architecture can both secure sensitive data and attain reliable data transfer within and between the 5G network‐infrastructure planes. Additionally, an ML module is integrated into the SDN controller to estimate network bandwidth and assist the administrator in taking effective decisions and satisfying high‐bandwidth demand. We assess the performance of the “BlockSD‐5GNet” architecture via an experimental evaluation performed in a simulation environment, and show the effectiveness of the proposed solution in comparison with baseline schemes. Finally, we also demonstrate the capability of different ML models in bandwidth prediction.

Blockchain-Enabled Intelligent IoT Protocol for High-Performance and Secured Big Financial Data Transaction

In the recent era, the communication network with the support of many wireless technologies is giving benefits for remote access. Such a communication model increases the flexibility for data storage with the management of network resources efficiently with the integration of the Internet of Things (IoT). Although, the industrial Internet of Things (IIoT) has enabled the development of numerous machine learning-based solutions to provide real-time applications. However, most of the solutions are not prepared to cope with heterogeneous services and the huge amount of device data in the digital world. Furthermore, conducting financial transactions over the Internet raises several security issues. Such restrictions compromise the sensitive data of financial institutions and also degrade the trust of network users in the system. Thus, this article presents a secured blockchain model for high-performance computing in a big data environment, which aims to protect the business activities for financial interaction with intelligent services of software-defined network (SDN) architecture. First, to keep the security credentials, the SDN controller creates an association between the IoT devices and maintains local and global records. Second, the machine learning approach is explored using reliable and fault-tolerant methods to support the network scalability and extract the updated routing information for transmitting financial data. The proposed protocol also provides data integrity with a high level of network availability and copes with the financial security of big data by investigating cryptographic approaches. Our proposed protocol is tested using simulation, and various experiments are performed to show its efficacy in terms of network throughput, computing overhead, data delay, response time, and dropped packets as compared to tunicate swarm algorithm-based optimized routing mechanism (TORM) and RouteChain.

DDoS Attack Detection in SDN-Based Instrumented Ad Hoc Networks

The physical characteristics of today's urban intersection structures and the traffic flows caused by unplanned road intersections lead to many negative effects such as time/cash loss, stress, increased fuel consumption, and more. For this reason, many studies are being conducted on traffic management systems, an application of smart cities, in both academic and commercial circles. In recent years, it has been observed that the VANET (Vehicular Ad Hoc Networks) architecture, which easily enables communication between vehicles or with devices on the side of the field, thus transporting relevant traffic data to the center, is frequently used in these studies. When Software Defined Networking emerged as a new technology, it brought many advantages such as high availability, scalability, and performance, but also introduced new security vulnerabilities targeted by attackers. This research primarily focuses on a resource-based detection approach by combining the powers of Software Defined Networking and s-Flow-RT technology against Distributed Denial of Service Attacks. In the simulation study conducted within the scope of this work, an SDN (Software Defined Networking)-based DDoS (Distributed Denial of Service) attack was carried out, and changes in data before and after the attack were examined. Traffic for the DDoS attack was generated with the Hping3 application. The RYU controller (a component-based software-defined networking framework) was selected as the software-defined network controller to create software-defined networks, and the Mininet emulator was used. A traditional computer network's Ubuntu virtual machine was used to carry out the attack in the scope of the work.

A Qualitative and Comparative Performance Assessment of Logically Centralized SDN Controllers via Mininet Emulator

An alternative networking approach called Software Defined Networking (SDN) enables dynamic, programmatically efficient network construction, hence enhancing network performance. It splits a traditional network into a centralized control plane and a configurable data plane. Because the core component overseeing every data plane action is the controller in the control plane, which may contain one or more controllers and is thought of as the brains of the SDN network, controller functionality and performance are crucial to achieve optimal performances. There is much controller research available in the existing literature. Nevertheless, no qualitative comparison study of OpenFlow-enabled distributed but logically centralized controllers exists. This paper includes a quantitative investigation of the performance of several distributed but logically centralized SDN controllers in custom network scenarios using Mininet, as well as a thorough qualitative comparison of them. More precisely, we give a qualitative evaluation of their attributes and classify and categorize 13 distributed but logically centralized SDN controllers according to their capabilities. Additionally, we offer a comprehensive SDN emulation tool, called Mininet-based SDN controller performance assessment, in this study. Using six performance metrics—bandwidth, round-trip time, delay, jitter, packet loss, and throughput—this work also assesses five distributed but logically centralized controllers within two custom network scenarios (uniform and non-uniform host distribution). Our analysis reveals that the Ryu controller outperforms the OpenDayLight controller in terms of latency, packet loss, and round-trip time, while the OpenDayLight controller performs well in terms of throughput, bandwidth, and jitter. Throughout the entire experiment, the HyperFlow and ONOS controllers performed worst in all performance metrics. Finally, we discuss detailed research findings on performance. These experimental results provide decision-making guidelines when selecting a controller.

An IoT-based low-cost architecture for smart libraries using SDN

In the evolving landscape of smart libraries, this research pioneers an IoT-based low-cost architecture utilizing Software-Defined Networking (SDN). The increasing demand for more efficient and economical solutions in library management, particularly in the realm of RFID-based processes such as authentication, property circulation, and book loans, underscores the significance of this study. Leveraging the collaborative potential of IoT and SDN technologies, our proposed system introduces a fresh perspective to tackle these challenges and advance intelligent library management. In response to the evolving landscape of smart libraries, our research presents an Internet of Things (IoT)-based low-cost architecture utilizing SDN. The exploration of this architectural paradigm arises from a recognized gap in the existing literature, pointing towards the necessity for more efficient and cost-effective solutions in managing library processes. Our proposed algorithm integrates IoT and SDN technologies to intelligently oversee various library activities, specifically targeting RFID-based processes such as authentication, property circulation management, and book loan management. The system's architecture, encompasses components like the data center, SDN controllers, RFID tags, tag readers, and other network sensors. By leveraging the synergy between RFID and SDN, our innovative approach reduces the need for constant operator supervision in libraries. The scalability and software-oriented nature of the architecture cater to extensive library environments. Our study includes a two-phase investigation, combining practical implementation in a small-scale library with a simulation environment using MATLAB 2021. This research not only fills a crucial gap in current knowledge but also lays the foundation for future advancements in the integration of IoT and SDN technologies for intelligent library management.

A Quantum-Safe Software-Defined Deterministic Internet of Things (IoT) with Hardware-Enforced Cyber-Security for Critical Infrastructures

The next-generation “Industrial Internet of Things” (IIoT) will support “Machine-to-Machine” (M2M) communications for smart Cyber-Physical-Systems and Industry 4.0, and require guaranteed cyber-security. This paper explores hardware-enforced cyber-security for critical infrastructures. It examines a quantum-safe “Software-Defined-Deterministic IIoT” (SDD-IIoT), with a new forwarding-plane (sub-layer-3a) for deterministic M2M traffic flows. A “Software-Defined Networking” (SDN) control plane controls many “Software-Defined-Deterministic Wide-Area Networks” (SDD-WANs), realized with FPGAs. The SDN control plane provides an “Admission-Control/Access-Control” system for network-bandwidth, using collaborating Artificial Intelligence (AI)-based “Zero Trust Architectures” (ZTAs). Hardware-enforced access-control eliminates all congestion, BufferBloat, and DoS/DDoS attacks, significantly reduces buffer-sizes, and supports ultra-reliable-low-latency communications in the forwarding-plane. The forwarding-plane can: (i) Encrypt/Authenticate M2M flows using quantum-safe ciphers, to withstand attacks by Quantum Computers; (ii) Implement “guaranteed intrusion detection systems” in FPGAs, to detect cyber-attacks embedded within billions of IIoT packets; (iii) Provide guaranteed immunity to external cyber-attacks, and exceptionally strong immunity to internal cyber-attacks; (iv) Save USD 100s of billions annually by exploiting FPGAs; and (v) Enable hybrid Classical-Quantum networks, by integrating a “quantum key distribution” (QKD) network with a classical forwarding plane with exceptionally strong cyber-security, determined by the computational hardness of cracking Symmetric Key Cryptography. Extensive experimental results for an SDD-WAN over the European Union are reported.

SO‐CPP: Sailfish optimization‐based controller placement in IoT‐enabled software‐defined wireless sensor networks

SummaryOne of the expanding network topologies that is frequently utilized to improve network development by successfully separating the control plane and data plane is software‐defined networking (SDN). In order to function inside complex sensor networks, the SDWSN system frequently relies on centralized controller logic that pulls global network information. In wireless sensor networks (WSNs), using several SDN controllers is known as a promising strategy due to reliability and performance considerations. However, using numerous controllers increases the synchronization overhead between the controllers. Consequently, it is a difficult research challenge to discover the best placement of SDN controllers to enhance the performance of a WSN, subject to the maximum number of controllers calculated based on the synchronization overhead. This research introduces a novel technique to overcome the controller placement problem (CPP) by optimizing multi‐constraints within the sensor networks. For selecting the optimal controllers and placing them in an optimal location, a novel sailfish optimization (SO) strategy is introduced that can enhance the search space and maintain optimal global values throughout the iteration. Then, node clustering is performed using the fuzzy‐C‐means (FCM) clustering technique, which can reduce energy consumption and path delay within the network. The overall latency obtained by the proposed method is about 0.51 and 0.56 ms, and a total run time of 4 ms for both single sink and multi‐sink, respectively. The proposed method is implemented in the MATLAB platform, and different performance metrics are analyzed and compared with existing techniques.

An Adaptive State Consistency Architecture for Distributed Software-Defined Network Controllers: An Evaluation and Design Consideration

The Physically Distributed Logically Centralized (PDLC) software-defined network (SDN) control plane is physically dispersed across several controllers with a global network view for performance, scalability, and fault tolerance. This design, providing control applications with a global network view, necessitates network state synchronization among controllers. The amount of inter-controller synchronization can affect the performance and scalability of the system. The absence of standardized communication protocols for East-bound SDN interfaces underscores the need for high-performance communication among diverse SDN controllers to maintain consistent state exchange. An inconsistent controller’s network view can significantly impact network effectiveness and application performance, particularly in dynamic networks. This survey paper offers an overview of noteworthy AI and non-AI solutions for PDLC SDN architecture in industry and academia, specifically focusing on their approaches to consistency and synchronization challenges. The suggested PDLC framework achieves an adaptive controller-to-controller synchronization rate in a dynamic network environment.

An integrated SDN framework for early detection of DDoS attacks in cloud computing

Cloud computing is a rapidly advancing technology with numerous benefits, such as increased availability, scalability, and flexibility. Relocating computing infrastructure to a network simplifies hardware and software resource monitoring in the cloud. Software-Defined Networking (SDN)-based cloud networking improves cloud infrastructure efficiency by dynamically allocating and utilizing network resources. While SDN cloud networks offer numerous advantages, they are vulnerable to Distributed Denial-of-Service (DDoS) attacks. DDoS attacks try to stop genuine users from using services and drain network resources to reduce performance or shut down services. However, early-stage detection of DDoS attack patterns in cloud environments remains challenging. Current methods detect DDoS at the SDN controller level, which is often time-consuming. We recommend focusing on SDN switches for early detection. Due to the large volume of data from diverse sources, we recommend traffic clustering and traffic anomalies prediction which is of DDoS attacks at each switch. Furthermore, to consolidate the data from multiple clusters, event correlation is performed to understand network behavior and detect coordinated attack activities. Many existing techniques stay behind for early detection and integration of multiple techniques to detect DDoS attack patterns. In this paper, we introduce a more efficient and effectively integrated SDN framework that addresses a gap in previous DDoS solutions. Our framework enables early and accurate detection of DDoS traffic patterns within SDN-based cloud environments. In this framework, we use Recursive Feature Elimination (RFE), Density Based Spatial Clustering (DBSCAN), time series techniques like Auto Regressive Integrated Moving Average (ARIMA), Lyapunov exponent, exponential smoothing filter, dynamic threshold, and lastly, Rule-based classifier. We have evaluated the proposed RDAER model on the CICDDoS 2019 dataset, that achieved an accuracy level of 99.92% and a fast detection time of 20 s, outperforming existing methods.

Failure recovery in the MANTRA architecture with an IPoWDM SONiC node and 400ZR/ZR+ pluggables

The utilization of IP over wavelength division multiplexing (IPoWDM) boxes in optical networks introduces coordination issues at the control plane level between the optical and packet domains. Indeed, IPoWDM boxes are technically packet devices, but the configuration of coherent optical pluggables requires knowledge of optical network state information (e.g., wavelength availability). MANTRA (metaverse ready architectures for open transport) aims to define a new SDN control architecture for managing IPoWDM, enhancing coordination between the packet and optical controllers. Within MANTRA, two distinct architectures were presented: Dual and Single. However, only the roles related to controller management are defined, while clear procedures are not specified for dealing with resource provisioning and failure recovery. This leads to the need for the definition and implementation of tailored procedures. Besides the characterization of the coherent optical pluggables performance, this paper presents and compares three procedures based on MANTRA to coordinate and control IPoWDM nodes in a multi-layer network performing failure recovery. The considered solutions have been designed and experimentally validated with a focus on the achievable traffic recovery performance considering IPoWDM configuration and communication within the SDN control architecture. An experimental testbed, comprising a sliced IPoWDM node running an extended version of the open-source SONiC network operating system, has been deployed to validate these solutions, with a comprehensive analysis of the time required to recover a real traffic flow that spans both the packet and optical domains.

An adaptive fault detection model based on variational auto-encoders and unsupervised transfer learning

Aiming at the problem of insufficient generalization of fault detection in traditional machine learning, an SDN controller fault detection method based on unsupervised transfer learning is proposed. The method mainly includes two parts. (1) A Gaussian mixture variational autoencoder based on the autoregressive flow is proposed. First, the encoder and decoder of variational autocoding are improved with gated recurrent units, and the improved variational autocoding can process time series data. Secondly, the gated recurrent unit is improved by using the gravitational search algorithm, which speeds up the search of the weight of the gated recurrent unit. Further, considering that the latent space of the variational autoencoder is a single Gaussian distribution, and the complex data in reality is often too simple to be represented by a single Gaussian distribution. (2) Aiming at the problem of poor generalization of fault detection models in practical scenarios, a domain adaptive fault detection algorithm based on multi-kernel maximum mean difference and intra-class distance constraints is proposed. Map the features into the manifold space to eliminate the distortion of the features in the original space. After mapping, the distance between fields needs to be measured, and the maximum mean difference of a single kernel cannot determine which kernel function is more suitable for the current task in practical applications. Therefore, the maximum mean difference based on multi-core is introduced to measure between the two fields. The experimental results show that the algorithm proposed improves the accuracy about 5% compared with the previous algorithm.

Internet of medical things and blockchain-enabled patient-centric agent through SDN for remote patient monitoring in 5G network

During the COVID-19 pandemic, there has been a significant increase in the use of internet resources for accessing medical care, resulting in the development and advancement of the Internet of Medical Things (IoMT). This technology utilizes a range of medical equipment and testing software to broadcast patient results over the internet, hence enabling the provision of remote healthcare services. Nevertheless, the preservation of privacy and security in the realm of online communication continues to provide a significant and pressing obstacle. Blockchain technology has shown the potential to mitigate security apprehensions across several sectors, such as the healthcare industry. Recent advancements in research have included intelligent agents in patient monitoring systems by integrating blockchain technology. However, the conventional network configuration of the agent and blockchain introduces a level of complexity. In order to address this disparity, we present a proposed architectural framework that combines software defined networking (SDN) with Blockchain technology. This framework is specially tailored for the purpose of facilitating remote patient monitoring systems within the context of a 5G environment. The architectural design contains a patient-centric agent (PCA) inside the SDN control plane for the purpose of managing user data on behalf of the patients. The appropriate handling of patient data is ensured by the PCA via the provision of essential instructions to the forwarding devices. The suggested model is assessed using hyperledger fabric on docker-engine, and its performance is compared to that of current models in fifth generation (5G) networks. The performance of our suggested model surpasses current methodologies, as shown by our extensive study including factors such as throughput, dependability, communication overhead, and packet error rate.

Research on neural networks in computer network security evaluation and prediction methods

Anomaly detection in networks to identify intrusions is a common and successful security measure used in many different types of network infrastructure. Network data traffic has increased due to the proliferation of viruses and other forms of cyber-attacks as network technology and applications have developed quickly. The limitations of classical intrusion detection, such as poor detection accuracy, high false negatives, and dependence on dimensionality reduction methods, become more apparent in the face of massive traffic volumes and characteristic information. That’s why IoT infrastructures often use Software-Defined Networking (SDN), allowing for better network adaptability and control. Hence, this paper’s convolutional neural network-based Security Evaluation Model (CNN-SEM) is proposed to secure the source SDN controller from traffic degradation and protect the source network from DDoS assaults. The proposed CNN-SEM system might defend against DDoS assaults once discovered by applying and testing a Convolutional Neural Network (CNN). The model can automatically extract the useful aspects of incursion samples, allowing for precise classification of such data. The detection and mitigation modules evaluate the proposed SDN security system’s performance, and the findings showed promise against next-generation DDoS assaults. The experimental results show the CNN-SEM achieves a high accuracy ratio of 96.6%, a detection ratio of 97.1%, precision ratio of 97.2%, a performance ratio of 95.1% and an enhanced security rate of 98.1% compared to other methods.