A Hybrid Machine Learning and Heuristic-Based Framework for Real-Time DDoS Detection in IoT and 5G Networks

A distributed denial of service (DDoS) attack represents a major threat to service providers. More specifically, a DDoS attack aims to disrupt and deny services to legitimate users by overwhelming the target with a massive number of malicious requests. A cyberattack of this kind is likely to result in tremendous economic losses for businesses and service providers due to increasing both operating and financial costs. In recent years, machine learning (ML) techniques have been widely used to prevent DDoS attacks. Indeed, many defense systems have been transformed into smart and intelligent systems through the use of ML techniques, which allow them to defeat DDoS attacks. This paper analyzes recent studies concerning DDoS detection methods that have adapted single and hybrid ML approaches in modern networking environments. Additionally, the paper discusses different DDoS defense systems based on ML techniques that make use of a virtualized environment, including cloud computing, software-defined network, and network functions virtualization environments. As the development of the Internet of Things (IoT) has been the subject of significant research attention in recent years, the paper also discusses ML approaches as security solutions against DDoS attacks in IoT environments. Furthermore, the paper recommends a number of directions for future research. This paper is intended to assist the research community with the design and development of effective defense systems capable of overcoming different types of DDoS attacks.

The Internet of Things (IoT) is a network of sensors that helps collect data 24/7 without human intervention. However, the network may suffer from problems such as the low battery, heterogeneity, and connectivity issues due to the lack of standards. Even though these problems can cause several performance hiccups, security issues need immediate attention because hackers access vital personal and financial information and then misuse it. These security issues can allow hackers to hijack IoT devices and then use them to establish a Botnet to launch a Distributed Denial of Service (DDoS) attack. Blockchain technology can provide security to IoT devices by providing secure authentication using public keys. Similarly, Smart Contracts (SCs) can improve the performance of the IoT–blockchain network through automation. However, surveyed work shows that the blockchain and SCs do not provide foolproof security; sometimes, attackers defeat these security mechanisms and initiate DDoS attacks. Thus, developers and security software engineers must be aware of different techniques to detect DDoS attacks. In this survey paper, we highlight different techniques to detect DDoS attacks. The novelty of our work is to classify the DDoS detection techniques according to blockchain technology. As a result, researchers can enhance their systems by using blockchain-based support for detecting threats. In addition, we provide general information about the studied systems and their workings. However, we cannot neglect the recent surveys. To that end, we compare the state-of-the-art DDoS surveys based on their data collection techniques and the discussed DDoS attacks on the IoT subsystems. The study of different IoT subsystems tells us that DDoS attacks also impact other computing systems, such as SCs, networking devices, and power grids. Hence, our work briefly describes DDoS attacks and their impacts on the above subsystems and IoT. For instance, due to DDoS attacks, the targeted computing systems suffer delays which cause tremendous financial and utility losses to the subscribers. Hence, we discuss the impacts of DDoS attacks in the context of associated systems. Finally, we discuss Machine-Learning algorithms, performance metrics, and the underlying technology of IoT systems so that the readers can grasp the detection techniques and the attack vectors. Moreover, associated systems such as Software-Defined Networking (SDN) and Field-Programmable Gate Arrays (FPGA) are a source of good security enhancement for IoT Networks. Thus, we include a detailed discussion of future development encompassing all major IoT subsystems.

DDoS (Distributed Denial of Service) attacks consist of a large number of compromised computer systems that launch joint attacks at a targeted victim, such as a server, website, or other network equipment, simultaneously. DDoS has become a widespread and severe threat to the integrity of computer networks. DDoS can lead to system paralysis, making it difficult to troubleshoot. As a key building block in the development of an integrated defense system, it is essential to detect DDoS attacks as early as possible. With the popularization of artificial intelligence, more and more researchers apply machine learning (ML) and deep learning (DL) to the detection of DDoS attacks and have achieved satisfactory accomplishments. The complexity and sophistication of DDoS attacks have kept increasing and evolving since the first DDoS attack was reported in 1996. Regarding the headways in this problem, a new type of DDoS attack, named adversarial DDoS attack, is investigated in this study. The generating adversarial DDoS traffic is carried out using a symmetric Generative Adversarial Networks (GAN) architecture called Cycle-GAN to demonstrate the severe impact of adversarial DDoS attacks. Experiment results reveal that the synthesized traffic can easily penetrate ML-based detection systems, including Random Forest, KNN (k-Nearest Neighbor), SVM (Support Vector Machine), and Naïve Bayes. These alarming results intimate the urgent need for countermeasures against adversary DDoS attacks.

The complexity of handling modern apps is causing older network architectures to struggle. As a result, Software Defined Networking (SDN) has developed into a paradigm-shifting network framework that enables administrators to exercise programmable control over whole network infrastructures. This development makes it easier to configure and operate large networks, but it also adds vulnerabilities, including the possibility of Distributed Denial of Service (DDoS) assaults that could take down the SDN controller. Integrating security tools like firewalls, intrusion detection and prevention systems, and anti-DDoS solutions is crucial to reducing this danger. In the context of SDN, leveraging the analytical power of Machine Learning (ML) algorithms to analyse network traffic patterns is a key tactic for fending off DDoS attacks. Effective defence systems are supported by these ML models, which can distinguish between normal network behaviour and DDoS assault traffic with ease. Decision trees (DT), support vector machines (SVM), and artificial neural networks (ANN) are examples of supervised ML techniques that have evolved into crucial tools in this field. These algorithms are developed utilising datasets with annotations that include examples of both legitimate and malicious network traffic. Once trained, the models may be used to instantly categorise incoming traffic, making it easier to identify and contain any DDoS attacks in real-time.

Fiber optic networks (FONs) are considered the backbone of telecom companies worldwide. However, the network elements of FONs are scattered over a wide area and managed through a centralized controller based on intelligent devices and the internet of things (IoT), with actuators used to perform specific tasks at remote locations. During the COVID-19 pandemic, many telecom companies advised their employees to manage the network using the public internet (e.g., working from home while connected to an IoT network). Theses IoT devices mostly have weak security algorithms that are easily taken-over by hackers, and therefore can generate Distributed Denial of Service (DDoS) attacks in FONs. A DDoS attack is one of the most severe cyberattack types, and can negatively affect the stability and quality of managing networks. Nowadays, software-defined networks (SDN) constitute a new approach that simplifies how the network can be managed through a centralized controller. Moreover, machine learning algorithms allow the detection of incoming malicious traffic with high accuracy. Therefore, combining SDN and ML approaches can lead to detecting and stopping DDoS attacks quickly and efficiently, especially compared to traditional methods. In this paper, we evaluated six ML models: Logistic Regression, K-Nearest Neighbor, Support Vector Machine, Naive Bayes, Decision Tree, and Random Forest. The accuracy reached 100% while detecting DDoS attacks in FON with two approaches: (1) using SVM with three features (SOS, SSIP, and RPF) and (2) using Random Forest with five features (SOS, SSIP, RPF, SDFP, and SDFB). The training time for the first approach was 14.3 s, whereas the second approach only requires 0.18 s; hence, the second approach was utilized for deployment.

The increasing use of Internet of Things (IoT) devices has led to a rise in Distributed Denial of Service (DDoS) and Denial of Service (DoS) attacks on these networks. These attacks can have severe consequences, resulting in the unavailability of critical services and financial losses. In this paper, we propose an Intrusion Detection System (IDS) based on a Conditional Tabular Generative Adversarial Network (CTGAN) for detecting DDoS and DoS attacks on IoT networks. Our CGAN-based IDS utilizes a generator network to produce synthetic traffic that mimics legitimate traffic patterns, while the discriminator network learns to differentiate between legitimate and malicious traffic. The syntactic tabular data generated by CTGAN is employed to train multiple shallow machine-learning and deep-learning classifiers, enhancing their detection model performance. The proposed approach is evaluated using the Bot-IoT dataset, measuring detection accuracy, precision, recall, and F1 measure. Our experimental results demonstrate the accurate detection of DDoS and DoS attacks on IoT networks using the proposed approach. Furthermore, the results highlight the significant contribution of CTGAN in improving the performance of detection models in machine learning and deep learning classifiers.

Software Defined Network (SDN) is the new era of networking technology based on a centralized controller that separates the switch hardware from its operating software. The most important challenge is the security of SDN and the most prominent attack is the Distributed Denial of Service (DDoS) attack. Some of the research work done so far detects DDoS attacks using a threshold, which is usually assumed without proper scientific reason and hence may not be always accurate. The mitigation techniques used by some researchers block the host from sending the network traffic beyond a threshold, by installing drop rules in the flow table of the switch connected to that host. Doing so will not only block the attack traffic but also the genuine ones from other applications of that host. In this paper, we propose a model that calculates the threshold limit for the type of applications sending data to a particular switch, in real-time using a machine learning (ML) model, and determines whether that application traffic is DDoS traffic. After the detection, only application type sending DDoS traffic is blocked while other genuine applications are allowed to send the network traffic without any interruption. The use of a dynamic threshold, based on the current network traffic, will help in detecting DDoS efficiently.

Distributed Denial of Service (DDoS) attacks represent a major threat to network security.. In response, this paper examines the potential of countering DDoS attacks through the integration of Software-Defined Networking (SDN). SDN separates the network control logic from the underlying routers and switches, which facilitates the communication between software components. Moreover, the synergy of SDN with Machine Learning (ML) and Deep Learning (DL) technologies provide a promising approach for effective threat mitigation. This systematic review explores the evolving landscape of information security defense frameworks within the context of Internet of Things (IoTs) security. Over the past five years, numerous articles have contributed to the understanding of SDN based DDoS defense architecture. This review encompasses various aspects, including the design of SDN based DDoS frameworks, implementation steps, data analysis methods, DDoS data sources, and application scenarios of defense frameworks. Performance and characteristics of different defense technologies are analyzed, addressing common challenges in the research field. This study provides a valuable reference for researchers to develop efficient and reliable DDoS defense frameworks in SDN mode

Software-Defined Networking (SDN) is a promising solution for large-scale network management that offers extensive opportunities for optimization. However, the centralized control inherent in SDN also exposes networks to security threats, notably Distributed Denial of Service (DDoS) attacks. To address these challenges, machine learning (ML) techniques have emerged as potent tools for anomaly detection and mitigation. This paper proposes a novel approach for traffic classification within SDN environments that distinguishes between benign and malicious traffic using supervised ML techniques. This study introduces a unique dataset tailored for DDoS attack detection, overcoming the limitations of existing datasets, such as unrealistic topologies and lack of public availability. Benchmarking against the CICDDoS2019 dataset validated the efficacy and relevance of the custom dataset. This research has significant implications for real-world applications, offering improved capabilities for detecting and mitigating DDoS attacks in SDN infrastructure. Experimental results demonstrated the effectiveness of the proposed random forest model, achieving a remarkable accuracy of 98.97% and a minimal False Alarm Rate (FAR) of 0.023. These findings underscore the potential of ML-based approaches in enhancing network security and resilience against DDoS attacks in SDN environments, paving the way for future advancements in network-defense strategies.

Both malevolent activities can cause network traffic spikes, namely Distributed Denial-of-Service (DDoS) attacks, and flash crowd events triggered by many people rushing to check out viral content or breaking news. Traditional intrusion detection systems often treat these events similarly, resulting in false positives that can disrupt legitimate user access. A new methodology is introduced in this study using a multiclass machine learning framework for classifying network traffic into three groups, namely: legitimate, DDoS and flash events. We introduce a synthetically generated flash crowd dataset designed to simulate high-volume, legitimate network traffic, alongside two widely used DDoS datasets: CIC-DDoS2019 and CIC-IDS2017. Across all datasets, a consistent set of characteristics driven by entropy and based on flow is retrieved. Five machine learning models—K-Nearest Neighbors (KNN), Random Forest, Support Vector Machine (SVM), XGBoost and Logistic Regression—are trained and evaluated using a multiclass classification approach. The novelty of this work is in modelling flash crowd behavior explicitly into the training of the IDS, which, in turn allows a model to capture the subtle differences between the attack traffic and valid bursts. Unlike previous work where only malicious vs. non-malicious traffic is considered, our method explicitly takes into account the presence of contextually valid anomalies that conventional IDS usually mislabels. Experimental findings indicate that Random Forest achieves the best overall accuracy and better class-wise discrimination, whereas SVM is robust for dealing with overlapping feature distributions, such as DDoS vs. flash traffic. The study highlights the importance of incorporating real-world traffic dynamics into training data to build more accurate and reliable intrusion detection systems.

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.

With the emergence of smart devices and the declining market value of sensing systems, the implementation of the internet of things (IoT) is gaining momentum. IoT has become an integral part of many smart systems such as smart buildings, smart cities, and smart heath, etc. Despite many advantages, from its inception, IoT system is vulnerable to many threats. Such systems are more likely to be attacked and breached, by denial of service (DoS) or distributed denial of service (DDoS) attacks. DDoS attacks are one of the Internet security's most disruptive threats. The towering volume of smart devices with a greater level of heterogeneity increases the severity of this attack. To date, there is no protocol that guarantees complete protection of IoT systems. To enable the resiliency, continuous monitoring, along with an adaptive decision-making system, is essential. These challenges can be addressed with the help of software-defined networking (SDN), which can effectively handle the IoT devices. Moreover, the centralized provisioning of SDN enables a secured and adaptive IoT environment that can effectively handle the DDoS attack. The software-defined internet of things (SDIoT) framework based on SDx paradigm consists of a controller pool, SD-IoT switches integrated with 190an IoT gateway, and IoT devices. In this chapter, a broad range of various DDoS attacks and detection methods for the IoT environment used in the SDN paradigm have been analyzed. Finally, different future scopes of this evolving field have been discussed.

The exponential growth of interconnected systems across the Internet of Things (IoT), Software-Defined Networks (SDN), and cloud environments has led to a drastic increase in the scale and advancement of Distributed Denial of Service (DDoS) attacks. Conventional defences based on machine learning are often static, traffic-centric, and lack adaptivity to dynamic network behaviour, resulting in high false-positive rates and delay in mitigation responses. To address these challenges, this paper presents a conceptual framework for an AI-driven, context-aware DDoS detection and mitigation system. The proposed approach employs a optimized Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) model for efficient, real-time detection of DDoS attacks. The model captures spatial and temporal correlations in traffic while incorporating contextual parameters such as Quality of Service (QoS), Service Level Agreement (SLA) priority, and workload telemetry. These contextual attributes enable the model to distinguish legitimate network fluctuations from malicious activities, so that the false positive rate will be reduced without compromising accuracy. For adaptive response, a Reinforcement Learning (RL)-based mitigation layer—exploiting Deep Q-Network (DQN) and Actor–Critic (AC) variants—continuously learns optimal mitigation actions based on real-time feedback. The interaction between detection and mitigation components forms a context-aware feedback loop, enabling dynamic policy refinement and continuous system improvement. Comprehensive literature analysis reveals that existing AI-based DDoS defense mechanisms lack integration between detection and mitigation, and often overlook contextual intelligence. The proposed framework bridges this gap by introducing a self-adaptive, feedback-driven defense system capable of maintaining detection precision, low latency, and QoS preservation in heterogeneous environments.

Distributed denial of service (DDoS) attacks pose a significant security risk, particularly with the increasing reliance on cloud computing and information technology (IT). These attacks not only allow unauthorized users to access services but also deny legitimate users the ability to utilize them. Traditional antivirus solutions and firewalls prove insufficient in detecting DDoS attacks within large networks. Intrusion detection systems (IDS) are essential for detecting unauthorized or malicious activities and ensuring the confidentiality, integrity, and availability of services. However, traditional IDS often rely on predefined signatures and patterns, making them susceptible to evasion tactics. In response, this research introduces a deep learning (DL)-based IDS that integrates convolutional neural networks (CNN) with principal component analysis (PCA) and explores the application of vision transformers (ViT). The proposed hybrid model was tested on the CICDDoS2019 dataset, achieving a notable improvement in detection accuracy. Specifically, the CNN-based model initially identified DDoS attacks with an accuracy of 99.72%. Upon integrating ViT, the model’s accuracy further improved to 99.99%. This innovative approach signifies a considerable advancement in the detection capabilities for DDoS attacks and underscores the potential for integrating more sophisticated DL models into cybersecurity defenses.

Distributed denial-of-service (DDoS) attacks continue to grow at a rapid rate plaguing Internet Service Providers (ISPs) and individuals in a stealthy way. Thus, intrusion detection systems (IDSs) must evolve to cope with these increasingly sophisticated and challenging security threats. Traditional IDSs are prone to zero-day attacks since they are usually signature-based detection systems. The recent advent of machine learning and deep learning (ML/DL) techniques can help strengthen these IDSs. However, the lack of up-to-date labeled training datasets makes these ML/DL based IDSs inefficient. The privacy nature of these datasets and widespread emergence of adversarial attacks make it difficult for major organizations to share their sensitive data. Federated Learning (FL) is gaining momentum from both academia and industry as a new sub-field of ML that aims to train a global statistical model across multiple distributed users, referred to as collaborators, without sharing their private data. Due to its privacy-preserving nature, FL has the potential to enable privacy-aware learning between a large number of collaborators. This paper presents a novel framework, called MiTFed, that allows multiple software defined networks (SDN) domains ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$i.e.,$</tex-math></inline-formula> collaborators) to collaboratively build a global intrusion detection model without sharing their sensitive datasets. In particular, MiTFed consists of: (1) a novel distributed architecture that allows multiple SDN based domains to securely collaborate in order to cope with sophisticated security threats while preserving the privacy of each SDN domain; (2) a novel Secure Multiparty Computation (SMPC) scheme to securely aggregate local model updates; and (3) a blockchain based scheme that uses Ethereum smart contracts to maintain the collaboration in a fully decentralized, trustworthy, flexible, and efficient manner. To the best of our knowledge, MiTFed is the first framework that leverages FL, blockchain and SDN technologies to mitigate the new emerging security threats in large scale. To evaluate MiTFed, we conduct several experiments using real-world network attacks; the experimental results using the well-known public network security dataset NSL-KDD show that MiTFed achieves efficiency and high accuracy in detecting the new emerging security threats in both binary and multi-class classification while preserving the privacy of collaborators, making it a promising framework to cope with the new emerging security threats in SDN.