A Novel Approach to DDoS Detection in Multi-Controller SDNs: Adaptive Learning Models and Real-Time Feedback for Enhanced IoT Security

With the emergence of smart devices and the declining market value of sensing systems, the implementation of the internet of things (IoT) is gaining momentum. IoT has become an integral part of many smart systems such as smart buildings, smart cities, and smart heath, etc. Despite many advantages, from its inception, IoT system is vulnerable to many threats. Such systems are more likely to be attacked and breached, by denial of service (DoS) or distributed denial of service (DDoS) attacks. DDoS attacks are one of the Internet security's most disruptive threats. The towering volume of smart devices with a greater level of heterogeneity increases the severity of this attack. To date, there is no protocol that guarantees complete protection of IoT systems. To enable the resiliency, continuous monitoring, along with an adaptive decision-making system, is essential. These challenges can be addressed with the help of software-defined networking (SDN), which can effectively handle the IoT devices. Moreover, the centralized provisioning of SDN enables a secured and adaptive IoT environment that can effectively handle the DDoS attack. The software-defined internet of things (SDIoT) framework based on SDx paradigm consists of a controller pool, SD-IoT switches integrated with 190an IoT gateway, and IoT devices. In this chapter, a broad range of various DDoS attacks and detection methods for the IoT environment used in the SDN paradigm have been analyzed. Finally, different future scopes of this evolving field have been discussed.

Software-Defined Wide Area Networks (SD-WANs) are an expanded version of Software-Defined Networking (SDN) that allow modern services and applications to utilize a programmable, adaptive, and efficient wide-area connection. As the Internet of Things (IoT) grows in importance in everyday life, so does the frequency of Distributed Denial of Service (DDoS) attacks. Due to the dispersed nature of the IoT and the limited resources it possesses, SD-WANs are easy prey. These assaults are extremely difficult to detect and localize due to their distributed nature and dynamic traffic patterns, which allow them to elude static criteria and basic profiling methods. Beginning with a description of SDN architecture and the vulnerabilities that are built into it and frequently used by attackers, this article gives a comprehensive study of dynamic DDoS entry point localization in SD-WANs. In addition, it identifies the most prevalent types of distributed denial of service assaults in an SDN environment and reviews recent research on DDoS detection and mitigation. Research in this area focusses on various defence strategies, including hybrid, ensemble, and deep learning-based models; it also includes statistical, policy-based, and moving target defence methods. Research shows that there has been a lot of headway, but no complete answers to the problem of intelligent and dynamic entry point localization in the current literature. Therefore, to fortify SD-WAN defences against ever-changing DDoS threats, this article highlights important hurdles and unanswered questions in SDN security and calls for the creation of adaptive, real-time detection systems

Software-Defined Networking (SDN) offers centralized control and programmability, transforming network management but also introducing vulnerabilities, particularly to Distributed Denial of Service (DDoS) attacks that can overwhelm the control plane and disrupt network functionality. Traditional DDoS detection methods, including rule-based systems and conventional machine learning models, often fall short in SDN due to high false-positive rates and limited adaptability to evolving network traffic. While recent deep learning approaches show promise, they continue to face challenges with real-time adaptability and scalability in SDN environments. In this study, we propose Attention-Enhanced Cross-Entropy (AECE), a novel Deep Neural Network (DNN)-based DDoS detection model that integrates attention mechanisms to prioritize critical features in network traffic data, allowing the model to focus on patterns indicative of DDoS attacks. A core innovation in AECE is the F-Balanced Cross-Entropy (FBCE) Loss function, which combines cross-entropy with an F1-score-based component to balance precision and recall, effectively reducing both false positives and false negatives. Additionally, AECE incorporates ReLU and GELU activations, batch normalization, dropout, and the Adamax optimizer to enhance learning stability and computational efficiency. Experimental results demonstrate that the proposed system achieves high detection accuracy, significantly outperforming existing DDoS detection methods and providing a robust, low-latency solution to safeguard SDN infrastructures against evolving DDoS threats.

Distributed Denial of Service (DDoS) attack is a serious threat to commercial service network. DDoS attack has been studied for years. However, detecting and relieving DDoS attacks are still a problem. Especially, nowadays more and more DDoS attacks produce heavy network traffic, it is hard to response rapidly because that needs high processing performance to process massive traffic data. With big data technology, volumes of network traffic data can be processed much faster. Apache Spark can process a great amount of data in a reasonable time so that DDoS attack can be detected in time. Besides, it is difficult to modify the network configuration in traditional network. With Software-Defined Networking (SDN), a new paradigm in networking, networking can be controlled by programs, which makes modifying the network configuration easier. In this paper, a DDoS detection and mitigation system framework in SDN is introduced, a framework that can control network based on analyzing the network traffic data. Comparing to the traditional defense methods of DDoS attack, the framework can response to DDoS attack by rules automatically.

To better respond to people’s demands for multimedia learning, appropriate learn-ing paths should be offered based on their actual learning demands and different knowledge levels. Adaptive online learning model integrates and improves exist-ing learning frameworks to offer a set of knowledge paths that can cater to dif-fer7ent preferences, tastes, and knowledge levels of learners, no need for them to be aware of this. Based on the improved ant colony algorithm, an adaptive learn-ing system model that can satisfy learners’ demands is built herein with reference to the foraging approach of ants to traverse the paths, thereby to find the best learning path, while the classification method for some learning objects can de-termine the search parameters. This innovative approach proposed hereof can help improve learners' academic performance and learning efficiency.

Software Defined Networks (SDN) have been utilized in applications of the Internet of Things (IoT), termed as software-defined IoT network, because of the popularity and capability of mobile devices being used for networking in relatively large areas. In a software-defined IoT system, the sensing data are asynchronously harvested by the mobile sensing nodes, and are also asynchronously uploaded to the gateways of a software-defined network. Thus, all the sensing data are asynchronously transmitted from the gateways to the data servers in the pattern of multipoints-to-point (M2P) data transmissions. Even if the sensing data are generated from the same sensing event, the controller of SDN has no knowledge about this relationship. Thus, such asynchronous M2P data transmissions from the same sensing event at the gateways will generate many redundant requests to their controller by OpenFlow protocol of SDN. In this paper, we investigate the redundant requests caused by the asynchronous M2P data transmissions in the software-defined IoT network. We model the relationship between the sensing events and the uploading gateways by utilizing their spatial locations and the distribution of mobile sensor nodes. To reduce the loads on the controller for the asynchronous M2P data transmissions, we propose an One-Request Scheme for Software-Defined IoT Networks (ORSIN), to batch the updating the forwarding rules of the multiple data transmissions from the same event by the first one request from a gateway. Our extensional simulations verify the effectiveness of our proposed approach.

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.

RBF-SVM kernel-based model for detecting DDoS attacks in SDN integrated vehicular network

The market for Electric Vehicles (EVs) has expanded tremendously as seen in the recent Conference of the Parties 27 (COP27) held at Sharm El Sheikh, Egypt in November 2022. This needs the creation of an ecosystem that is user-friendly and secure. Internet-connected Electric Vehicle Charging Stations (EVCSs) provide a rich user experience and add-on services. Eventually, the EVCSs are connected to a management system, which is the Electric Vehicle Charging Station Management System (EVCSMS). Attacking the EVCS ecosystem remotely via cyberattacks is rising at the same rate as physical attacks and vandalism happening on the physical EVCSs. The cyberattack is more severe than the physical attack as it may affect thousands of EVCSs at the same time. Intrusion Detection is vital in defending against diverse types of attacks and unauthorized activities. Fundamentally, the Intrusion Detection System’s (IDS) problem is a classification problem. The IDS tries to determine if each traffic stream is legitimate or malicious, that is, binary classification. Furthermore, the IDS can identify the type of malicious traffic, which is called multiclass classification. In this paper, we address IoT security issues in EVCS by using different machine learning techniques and using the native IoT dataset to discover fraudulent traffic in EVCSs, which has not been performed in any previous research. We also compare different machine learning classifier algorithms for detecting Distributed Denial of Service (DDoS) attacks in the EVCS network environment. A typical Internet of Things (IoT) dataset obtained from actual IoT traffic is used in the paper. We compare classification algorithms that are placed in line with the traffic and contain DDoS attacks targeting the EVCS network. The results obtained from this research improve the stability of the EVCS system and significantly reduce the number of cyberattacks that could disrupt the daily life activities associated with the EVCS ecosystem.

A feature-free method for testing adaptive network learning models is presented. The test is based on a property called the mean matching law, a. property shared by many adaptive network models of learning. As an application of this method, we prove that cue competition effects obtained with statistically independent cues cannot be explained by many previous adaptive network learning models, including those based on the delta learning rule. These results point to the need to incorporate competitive learning properties into adaptive network learning models.

The flexibility and programmability offered by Software Defined Networking (SDN) emerge as an approach to resolve some of the main challenges that the Internet of Things (IoT) deployments expose. In the present article, we explore the application of SDN components onto IoT deployments, together with the decoupling of typical gateway functions in two realms; the physical one and the virtual at the edge. This disengagement is a novel approach necessary since the computation resources on the physical part of the infrastructure are limited. Thus, the more resource-consuming processes are transferred to the edge of the network, in the virtual counterpart of the gateway. Additionally, within this infrastructure, different network applications can be running at the top of the SDN controller, in the control plane, for example, QoS policies application, management of network parameters, etc. Providing a holistic view of the IoT deployment. Between its advantages, this work focus on the ease of creation of an IoT infrastructure with the gateway and SDN architecture, and the behaviour of the IoT system. For validation, a small setup scenario and a use case is created where heterogeneous IoT sensors communicate with the physical part of the gateway, implemented with a Raspberry Pis and this, with its virtual part at the edge of the network, so finally sent the data to an IoT platform (FIWARE-ORION) at the core network managed by a virtual Switch (OpenVSwitch) and a RYU-based SDN controller.

The software defined network (SDN) collects network traffic data and proactively manages networks. SDN’s programmability makes it excellent for developing distributed applications, cybersecurity, and decentralized network control in multitenant data centers. This exceptional architecture is vulnerable to security concerns, such as distributed denial of service (DDoS) attacks. DDoS attacks can be very serious due to the fact that they prevent authentic users from accessing, temporarily or indefinitely, resources they would normally expect to have. Moreover, there are continuous efforts from attackers to produce new techniques to avoid detection. Furthermore, many existing DDoS detection methods now in use have a high potential for producing false positives. This motivates us to provide an overview of the research studies that have already been conducted in this area and point out the strengths and weaknesses of each of those approaches. Hence, adopting an optimal detection method is necessary to overcome these issues. Thus, it is crucial to accurately detect abnormal flows to maintain the availability and security of the network. In this work, we propose hybrid deep learning algorithms, which are the long short-term memory network (LSTM) and convolutional neural network (CNN) with a stack autoencoder for DDoS attack detection and checkpoint network, which is a fault tolerance strategy for long-running processes. The proposed approach is trained and tested with the aid of two DDoS attack datasets in the SDN environment: the DDoS attack SDN dataset and Botnet dataset. The results show that the proposed model achieves a very high accuracy, reaching 99.99% in training, 99.92% in validation, and 100% in precision, recall, and F1 score with the DDoS attack SDN dataset. Also, it achieves 100% in all metrics with the Botnet dataset. Experimental results reveal that our proposed model has a high feature extraction ability and high performance in detecting attacks. All performance metrics indicate that the proposed approach is appropriate for a real-world flow detection environment.

Abstract. Problem. The rapid advancement of artificial intelligence (AI) has significantly impacted various domains, particularly education. AI-driven tools are increasingly being integrated into teaching methodologies, assessment frameworks, and curriculum design. However, despite the growing research interest in Artificial Intelligence in Education (AIED), the field remains fragmented, lacking a comprehensive analysis of dominant research themes and emerging trends. Understanding these trends is crucial for optimizing AI applications in education and shaping future developments in the field. Goal. The primary goal of this study is to analyze the current landscape of AIED research by identifying key thematic clusters, evaluating dominant research directions, and predicting future trajectories in AI-driven education. Methodology. This study employs network analysis, topic modeling, and global research trend evaluation to analyze scientific publications in AIED. The Latent Dirichlet Allocation (LDA) algorithm is applied to classify research articles into thematic categories, enabling the identification of primary topics shaping the field. Data is sourced from the Web of Science database, and hierarchical clustering techniques are used to determine semantic similarities between thematic models. Results. The analysis reveals five major research clusters in AIED, including AI applications in medical education, machine learning in education, adaptive learning technologies, large language models in learning, and student-centered AI-driven educational strategies. The study identifies increasing trends in the adoption of generative AI and chatbot-based learning support, while traditional AI-driven assessment methodologies show moderate growth. The results also highlight strong interconnections between AI-driven personalization and intelligent tutoring systems, emphasizing the shift toward adaptive and student-centric learning environments. Originality. This research provides a structured and systematic analysis of AIED trends, leveraging advanced topic modeling techniques. Unlike previous studies focusing on isolated AI applications in education, this study presents a holistic view of thematic structures in AIED research, offering a quantitative and data-driven approach to understanding the evolution of the field. Practical Value. The findings can serve as a strategic reference for educators, policymakers, and AI developers in shaping future educational technologies. By identifying key thematic directions, this research supports evidence-based decision-making for integrating AI into educational systems. The results can also guide further research in AIED, helping scholars explore emerging AI-driven teaching methodologies, adaptive learning models, and ethical considerations in AI-powered education.

The Internet of Things (IoT) is a network of sensors that helps collect data 24/7 without human intervention. However, the network may suffer from problems such as the low battery, heterogeneity, and connectivity issues due to the lack of standards. Even though these problems can cause several performance hiccups, security issues need immediate attention because hackers access vital personal and financial information and then misuse it. These security issues can allow hackers to hijack IoT devices and then use them to establish a Botnet to launch a Distributed Denial of Service (DDoS) attack. Blockchain technology can provide security to IoT devices by providing secure authentication using public keys. Similarly, Smart Contracts (SCs) can improve the performance of the IoT–blockchain network through automation. However, surveyed work shows that the blockchain and SCs do not provide foolproof security; sometimes, attackers defeat these security mechanisms and initiate DDoS attacks. Thus, developers and security software engineers must be aware of different techniques to detect DDoS attacks. In this survey paper, we highlight different techniques to detect DDoS attacks. The novelty of our work is to classify the DDoS detection techniques according to blockchain technology. As a result, researchers can enhance their systems by using blockchain-based support for detecting threats. In addition, we provide general information about the studied systems and their workings. However, we cannot neglect the recent surveys. To that end, we compare the state-of-the-art DDoS surveys based on their data collection techniques and the discussed DDoS attacks on the IoT subsystems. The study of different IoT subsystems tells us that DDoS attacks also impact other computing systems, such as SCs, networking devices, and power grids. Hence, our work briefly describes DDoS attacks and their impacts on the above subsystems and IoT. For instance, due to DDoS attacks, the targeted computing systems suffer delays which cause tremendous financial and utility losses to the subscribers. Hence, we discuss the impacts of DDoS attacks in the context of associated systems. Finally, we discuss Machine-Learning algorithms, performance metrics, and the underlying technology of IoT systems so that the readers can grasp the detection techniques and the attack vectors. Moreover, associated systems such as Software-Defined Networking (SDN) and Field-Programmable Gate Arrays (FPGA) are a source of good security enhancement for IoT Networks. Thus, we include a detailed discussion of future development encompassing all major IoT subsystems.

<p>Software defined networking (SDN) is a network framework that aims to redefine network characteristics through the programmability of network components, faster and larger network monitoring, centralized network operation, and effective detection of fraudulent traffic and special malfunctions. However, SDN networks are vulnerable to security threats that can cause complete network failure. To address this issue, in this paper, machine learning techniques are suggested for the swift detection of attacks. Various methods for detecting distributed denial of service (DDoS) attacks are evaluated, and the study identifies the most precise method for categorizing such attacks within a SDN network. The results indicate that the proposed system achieves high accuracy in detecting DDoS attacks, with ensemble learning achieving 99% accuracy. This indicates a remarkable improvement percentage in comparison to the approaches of decision tree (DT), k-nearest neighbors (KNN), and support vector machine (SVM).</p>