Scholarlink

<p>Software-Defined Networks (SDNs) have become a key component of modern networks by providing centralized control and efficient traffic management. However, they are highly vulnerable to Distributed Denial-of-Service (DDoS) attacks, which can degrade network performance and disrupt services. This challenge is particularly critical in next-generation networks, such as 5G and 6G, where security, low latency, and high scalability are essential. In this study, a network-based DDoS detection framework is proposed, integrating Federated Learning (FL) and P4 programmability to enhance network resilience against such attacks. FL enables edge switches to train local models without transmitting raw data, preserving privacy and reducing network overhead. Meanwhile, P4 programmability facilitates rapid metadata extraction and in-network traffic processing, thereby reducing latency and improving response time. To evaluate the performance of the proposed system, two architectures have been tested: an independent architecture based on packet mirroring and a collaborative architecture focused on traffic feature extraction. Multi-Layer Perceptron (MLP) and Convolutional Neural Network (CNN) models are trained using the CIC-DDoS2019 dataset. To address class imbalance in attack detection, Focal Loss is employed, while Min–Max normalization is used to scale the input features. Evaluation results indicate that the MLP model, in collaborative mode, achieves superior performance with over 98% precision, sensitivity, and F1-score while maintaining a processing delay of 329&#xa0;ms. Additionally, the P4 metadata extraction method consistently maintains processing times below 300&#xa0;ms across different attack intensities, demonstrating significant improvements over traditional standalone approaches. Scalability tests confirm that even with an increase in network regions up to four and the number of switches up to 16 per region, detection accuracy remains above 90%.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Efficient DDoS detection in advanced mobile networks using P4 programmability and federated learning

  • 期刊论文

  • 发表日期：

    2025年9月11日

查看全文
  • Reza Mohammadifar,
  • Reza Javidan,
  • Reza Akbari

摘要

Software-Defined Networks (SDNs) have become a key component of modern networks by providing centralized control and efficient traffic management. However, they are highly vulnerable to Distributed Denial-of-Service (DDoS) attacks, which can degrade network performance and disrupt services. This challenge is particularly critical in next-generation networks, such as 5G and 6G, where security, low latency, and high scalability are essential. In this study, a network-based DDoS detection framework is proposed, integrating Federated Learning (FL) and P4 programmability to enhance network resilience against such attacks. FL enables edge switches to train local models without transmitting raw data, preserving privacy and reducing network overhead. Meanwhile, P4 programmability facilitates rapid metadata extraction and in-network traffic processing, thereby reducing latency and improving response time. To evaluate the performance of the proposed system, two architectures have been tested: an independent architecture based on packet mirroring and a collaborative architecture focused on traffic feature extraction. Multi-Layer Perceptron (MLP) and Convolutional Neural Network (CNN) models are trained using the CIC-DDoS2019 dataset. To address class imbalance in attack detection, Focal Loss is employed, while Min–Max normalization is used to scale the input features. Evaluation results indicate that the MLP model, in collaborative mode, achieves superior performance with over 98% precision, sensitivity, and F1-score while maintaining a processing delay of 329 ms. Additionally, the P4 metadata extraction method consistently maintains processing times below 300 ms across different attack intensities, demonstrating significant improvements over traditional standalone approaches. Scalability tests confirm that even with an increase in network regions up to four and the number of switches up to 16 per region, detection accuracy remains above 90%.