.png){kind=icon}
.png){kind=icon}
Return
Hybrid CNN-LSTM Model for DDoS Detection and Mitigation in Software-Defined Networks
.png){kind=icon}
PRE
AI
A
M
L
M
A
G
S
A
DOI：10.1109/TNSM.2026.3662819.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Software-Defined Networking (SDN) enhances programmability and control but remains highly vulnerable to distributed denial-of-service (DDoS) attacks. Existing solutions often adapt conventional methods without leveraging SDN’s native features or addressing real-time mitigation. This study introduces a novel hybrid deep learning framework for DDoS detection and mitigation in SDN, significantly advancing the state of the art. We develop a custom dataset in a Mininet–Ryu testbed that reflects realistic SDN traffic conditions, and employ a multistage feature selection pipeline to reduce redundancy and highlight the most discriminative flow attributes. A hybrid Convolutional Neural Network–Long Short-Term Memory (CNN-LSTM) model is then applied, capturing both spatial and temporal traffic patterns. The proposed system achieves 99.5% accuracy and a 97.7% F1-score, demonstrating a significant improvement over baseline ML and DL approaches. In addition, a lightweight and scalable mitigation module embedded in the SDN controller dynamically drops or reroutes malicious flows, enabling real-time, low-latency responsiveness. Experimental results across diverse topologies confirm the framework’s scalability and applicability in real-world SDN environments.
Keywords:
CNN-LSTM
deep learning
DDoS attack
machine learning
network security
SDN security
SDN vulnerabilities
Journal
IF:
5.4
Papers:
509
Citations:
9.2K
Organization
Cited Papers