Scalable Hybrid ML–DL Framework for Real-Time DDoS Detection in SDN

Abstract

Distributed Denial of Service (DDoS) attacks remain a major threat to Software-Defined Networks (SDN)

where centralized controllers are vulnerable to flooding traffic. Existing detection methods typically rely on single-stage models

creating trade-offs between speed and robustness. This study introduces a novel hierarchical hybrid framework that leverages SDN’s layered architecture by deploying Random Forest (RF) at the switch for lightweight

real-time filtering and deep learning (DL) models at the controller for deeper inspection. The hybrid RF→MLP pipeline achieves 98.7% accuracy

eliminates false alarms (normal recall = 1.00)

and sustains high attack recall (0.97) with negligible latency (0.26 ms/sample). Unlike prior controller-centric or single-stage approaches

this is the first framework to systematically integrate ML and DL across SDN layers

providing a practical and scalable defense-in-depth solution.