Machine learning methods for DDoS attack detection in software-defined networks

Distributed Denial of Service (DDoS) attacks remain among the most serious threats to Software-Defined Networks (SDNs), where centralised control makes timely detection essential. This paper presents a leakage-controlled comparison of six supervised classifiers, namely Logistic Regression (LR), Support Vector Machine (SVM), K-Nearest Neighbours (KNN), Decision Tree (DT), Random Forest (RF) and Extreme Gradient Boosting (XGBoost), and quantifies the effect of Mutual Information (MI) feature selection on detection performance and computational cost. Two open datasets are used: DDoS-SDN (104,345 flow records, binary) and APA-DDoS (151,200 packet records; benign, DDoS-ACK and DDoS-PSH-ACK). All preprocessing and feature selection are fitted on training data only, and models are evaluated on a stratified held-out test set using accuracy, precision, recall, specificity, F1-score, ROC-AUC and PR-AUC, supported by ten-fold cross-validation, McNemar tests with Holm correction and repeated timing. On DDoS-SDN with all 19 behavioural features, XGBoost reaches 100% test accuracy and RF 99.47%; the MI Top-12 subset retains near-full accuracy (XGBoost 99.99%, RF 99.40%), and the Top-5 subset raises KNN accuracy from 98.47% to 99.97% while reducing its latency from 0.76 to 0.007 ms per flow. A time-ordered split lowers accuracy by 6.7–17.8 percentage points for the non-linear classifiers, showing that random-split results overstate performance on later traffic. On APA-DDoS, a feature-level audit shows that the capture timestamp encodes the class label and that the TCP PSH flag defines the two attack classes. Once identifier and constant attributes are removed, the nine remaining features take only 65 unique combinations of values across all 151,200 records, and without the PSH flag no classifier can exceed 75.78% accuracy. APA-DDoS is therefore reported as a dataset audit rather than used to rank classifiers.