Detection of DDoS Attacks in SDN Using Feature Optimization and FNet-Based Transformer Models
摘要
Software-Defined Networking (SDN) has transformed network architectures by decoupling control and data planes, providing centralized management and dynamic resource allocation. However, this centralization makes SDN highly susceptible to Distributed Denial of Service (DDoS) attacks, which can overwhelm the controller, degrade performance, and disrupt network availability. Traditional machine learning models often struggle with generalization to unseen attack patterns due to their reliance on fixed feature representations and static decision boundaries. This limitation can be overcome by Large Language Models (LLMs), which leverage contextual understanding and adaptive learning to dynamically model complex, evolving traffic behaviors, enhancing robustness against novel DDoS strategies. To address these challenges, this study investigates the use of transformer-based LLMs for effective DDoS detection. The CICDDoS2019 dataset was utilized, with a stratified sampling approach preserving the distribution of benign and attack traffic. The multi-feature selection process was used to identify the ten most critical traffic features, which were transformed into natural language representations for model compatibility. Three LLMs– BERT, RoBERTa, and FNet–were fine-tuned and compared against classical models including Logistic Regression and K-Nearest Neighbour. Experimental results demonstrate that FNet delivered highly competitive performance 99.5% accuracy with significant advantages in training speed and scalability, due to its efficient Fourier-transform-based architecture. Furthermore, FNet achieved an AUC of 0.99, confirming its robustness in distinguishing between benign and malicious traffic flows.