Developing realistic distributed denial-of-service (DDoS) attack dataset for software-defined networking (SDN)

Purpose With the rapid proliferation of Internet-connected devices, software-defined networking (SDN) has become an attractive paradigm for efficient network management compared to traditional network infrastructure. Nevertheless, SDN networks remain susceptible to distributed denial-of-service (DDoS) attacks, significantly degrading network performance and reliability. This research seeks to overcome the current limitation posed by the absence of realistic SDN-based datasets for DDoS detection and proposes an enhanced detection methodology tailored explicitly for SDN networks. Design/methodology/approach This research introduces SDN-DDoS2025, a novel dataset developed by adapting the CIC-DDoS2019 dataset to an SDN environment while preserving flow- and traffic-level characteristics unique to SDN. Comprehensive exploratory data analysis (EDA) is performed to thoroughly investigate feature distributions, trends and correlations within the dataset. Furthermore, a hybrid deep learning model integrating one-dimensional convolutional neural networks with long short-term memory layers (CNN-LSTM) is proposed, demonstrating enhanced efficiency and effectiveness in detecting DDoS attacks. Findings The experimental results reveal that the proposed CNN-LSTM hybrid model outperforms recent benchmark methods on both the original CIC-DDoS2019 and the newly introduced SDN-DDoS2025 datasets. The model attains superior detection accuracy and demonstrates robust generalization capabilities, handling real-world SDN traffic patterns. Originality/value This research presents the first SDN-specific dataset derived from the CIC-DDoS2019 benchmark, incorporating realistic SDN-oriented features and proposes a robust deep learning architecture specifically designed for effective DDoS detection in SDN contexts. By integrating dataset generation, comprehensive EDA and advanced deep learning modeling, this research addresses a significant research gap within the SDN security domain.