Federated Learning for DDoS Attack Detection in SDN: A Privacy-Preserving Approach

Abstract

The main objective of this contribution is to provide an in-depth analysis of the vulnerabilities present in the various layers of the SDN environment as well as to propose a novel solution to detect distributed denial-of-service (DDoS) attacks, as they pose serious threat to the stability and availability of softwaredefined networks. In addition, a federated learning framework is introduced to identify DDoS attacks in SDN environments, which simultaneously protects privacy while maintaining high detection accuracy. Our proposed solution reduces the risk of data breaches and protects the confidentiality of sensitive data by training models locally. We have used FL to train three classifiers: Deep neural networks (DNN), convolutional neural networks (CNN) and (LSTM) Long Short-term memory to classify two categories of DDoS attacks, namely: UDP Flood, TCP SYN. Achieving 99.99% accuracy and a 99.99% F1-score on TCP SYN floods, alongside 99.94% and 99.97% on UDP floods, our federated CNN not only exceeds the most robust centralized benchmarks but also outperforms our own federated DNN and LSTM models, establishing a new benchmark for SDN DDoS detection while ensuring complete privacy of raw traffic within each domain.