A Machine Learning Framework for DDoS Attack Detection in SDN-Enabled Mobile Wireless Networks
This article received funding through Kennesaw State University's Faculty Open Access Publishing Fund, supported by the KSU Libraries and KSU Office of Research.
Abstract
Attacks on network components and devices pose a significant threat to service continuity, necessitating robust detection mechanisms. This paper presents a Distributed Denial of Service (DDoS) attack detection framework tailored for heterogeneous mobile wireless networks within a Software-Defined Networking architecture. A two-tier model is proposed: localized attack detection at access points (APs) using a Multi-Layer Perceptron (MLP) classifier, and centralized detection under mobility at the controller using a Long Short-Term Memory (LSTM) model. The system incorporates novel traffic features such as flow count, speed of source IP, source and destination IP address entropy, proportion of bidirectional flows, and handover frequency, which together enhance detection in mobile environments. An LSTM model analyzes inter-AP traffic correlation over time to address mobility-driven DDoS attack amplification. The proposed approach is evaluated under diverse traffic types (TCP, UDP, ICMP) and varying attack intensities. The MLP model selected for integration into the framework demonstrates consistently strong detection capability across the evaluated scenarios, achieving accuracy values in the range of 95%–99% and showing improved performance relative to existing state-of-the-art schemes. Furthermore, multi-run statistical validation confirms stable behavior under randomized initialization and mobility-driven conditions, while controller-level correlation analysis enhances robustness against mobility-driven attack propagation.