A Lightweight Machine Learning Framework for DDoS Attack Detection in SDN
摘要
Distributed Denial of Service (DDoS) attacks pose a severe risk to Software-Defined Networking (SDN), where the centralized control plane is a prime target. While effective detection methods exist, their complexity can create barriers for educational and introductory research settings. This paper introduces a lightweight framework, defined by its conceptual simplicity and low computational overhead, that merges entropy-based statistical analysis with simple Machine Learning (ML) classifiers to identify DDoS attacks. The framework is designed primarily for pedagogical purposes to demonstrate core security concepts in SDN. Using the public Kaggle DDoS SDN dataset, the system trains models on fundamental flow features. A comparative analysis shows that even basic models like Random Forest achieve high accuracy (approx. 99%) on this dataset, highlighting the educational value of demonstrating that effective detection is possible without resorting to highly complex deep learning models. To bridge theory with practice, the project outlines a simplified testbed using Mininet and a POX controller, where attack traffic is simulated with tools like ‘hping3 ‘. This work provides an accessible, foundational framework for learners to explore DDoS mitigation in SDN, emphasizing clarity and hands-on learning over production-level performance.