DDoS Attack Detection in Software Defined Networking Using Machine Learning Techniques
Fazeela Mughal1
Ghulam Musa Raza2
Muhammad Waseem Raza3
Byung-Seo Kim4*
-
School of Electrical Engineering and Computer Science, National University of Science
and Technology (NUST), Islamabad 44000, Pakistan. fmughal.mscs19seecs@seecs.edu.pk
-
Department of Software and Communications Engineering, Hongik University, Sejong 30016,
South Korea. ghulammusaraza96@gmail.com
-
Department of Computer Science, University of Gujrat, Gujrat 50700, Pakistan. waseemrazagujrat@gmail.com
-
Department of Software and Communications Engineering, Hongik University, Sejong 30016,
South Korea. jsnbs@hongik.ac.kr
Copyright © 2026 The Institute of Electronics and Information Engineers
Keywords
SDN, DDoS, Machine learning, Security, Features, Dataset
1. Introduction
As the usage of internet in the new era is growing day by day so privacy and security
issues are also considered due to this reason sophisticated network policies like
Software Defined Network (SDN) were required. SDN is convenient and simpler one as
compared to traditional network architecture but here is some security vulnerabilities
occurred because of centralized control plane. As can be seen from the architecture
of SDN in Fig. 1.
Fig. 1. SDN architecture.
The whole network working is dependent on controllers such as Denial of Service (DoS)
or Distributed Denial of Service (DDoS) can easily target control platforms, so it
is major damage to network system. DDoS is the most common and major attack which
can damage any network by massive traffic as the traffic generated from different
sources hosts to one destination host. Intrusion Detection System (IDS) plays an important
role in detecting these attacks by analyzing and identifying normal and abnormal traffic
in a network. These days Machine learning based IDS are securing Software Defined
Networks by detecting attack and doing prevention. As compared to traditional approaches,
ML-based IDS is efficient and more accurate for the detection of anomalies. There
has been a lot of research on many attacks in SDN and detection of anomalies happening
by ML-based IDS [1]. Many authors worked on publicly available datasets [2] and a few of them generated simulated datasets [3] and showed the results in the form of accuracy and said simulated datasets are better
because publicly available datasets are not updated regularly also, they concluded
few algorithms are performing well. In this paper, our aim is to check the performance
of algorithms in detection of DDoS attacks in different datasets. Additionally, our
aim is to generate a simulated dataset on which we check the performance of algorithms.
Different datasets are publicly available in which real-time and simulated datasets
are included. In our research, five famous datasets are selected to check the algorithms’
performance. Necessary data preprocessing is done, and seven algorithms have been
tested, and ensemble methods are applied on top four models which gave high accuracy.
Here five datasets were selected, and results are produced, there are three famous
real-time datasets; CIC-DDoS2019, BoT-IoT, and ToN-IoT whereas two simulated datasets;
Mendeley DDoS [4] and Bogaziçi University DDoS Dataset (BOUN) [5]. Opinions are considered as someone’s review or reaction while facts correspond to
exact dealing. Opinion usually deals with positive and negative adjectives that reflect
for and against attitude towards topic at hand. Sentiment Analysis can be termed as
opinion mining to find positive or negative inclination of masses.
The remaining of the paper is organized as follows. Section 2 demonstrates related
work in which use of ML-based IDS and previous related work is included. Section 3
will be based on the generation of DDoS datasets and previous publicly available datasets.
Section 4 explains the research methodology and feature set. Section 5 provides results.
In Section 6, the article is concluded.
2. Related Work
In network systems, security has become an important and challenging factor. In today’s
networking, cyber security plays an important role by providing security, integrity
and confidentiality to users on the internet. Intrusion can be in various forms on
the internet, but the most common one is in the form of DoS and DDoS attack and for
this Network Intrusion Detection Systems are used. In Software Defined Networks ML-based
IDS are used to detect malicious and abnormal traffic flow. There are two methods
to detect malicious traffic, the first one is signature-based detection which detects
the threat we know about whereas the second one is known as anomaly-based detection
whose methodology of detection is change in behavior of traffic.
As in the past there were some issues in detecting new attacks in a network system
when intrusion is detected by Signature-based IDS, research has been done to overcome
the limitations of Signature-based IDS using Anomaly-based IDS [6]. In many network systems the most uncertain traffic flow is evaluated by selecting
limited features which help in decision making and give shows performance which helps
the controller to detect normal and malicious traffic [7].
In [8], Machine learning techniques were applied to find optimal algorithms to classify
the traffic, predict the Quality of Service or Quality of Experience, for routing
optimization and for providing security and resource management. Different algorithms
were applied to predict all the above and for Traffic Classification the optimal algorithms
were Decision Tree, Random Forest, Deep NN, SVM KNN, for QoS/QoE; Decision Tree, KNN,
Random Forest, Neural Network and for Resource Management the optimal algorithms were
Naïve Bayes, Linear SVM, Radial SVM, Decision Tree and K-NN.
In Table 1, different attacks are identified also the type of dataset is mentioned either it
is simulated or real-time based dataset. In article [9], DDoS attack was implemented on the Ryu SDN controller using the Mininet emulator,
with detection achieved through a Support Vector Machine (SVM). By adding flows to
the switches, the impact of the attack was reduced by 36%. The study utilized the
Ryu controller, Mininet emulator, and an entropy-based model for training and differentiating
normal and abnormal traffic. This approach improved the detection accuracy of the
DDoS attack. The authors suggested that future enhancements could involve improving
feature correlation, traffic generation, and real-time performance.
Table 1. Literature review.
|
Authors
|
Dataset type
|
Attacks
|
Classifiers
|
Accuracy
|
|
[3]
|
Simulated Dataset
|
UDP Flood
|
1. SVM
2. Naïve Bayes
3. Logistic Regression
4. Decision Tree
|
97.5%
|
|
[6]
|
Real-time Dataset
|
1. U2R
2. R2L
3. Probe
|
1. ANN
|
97%
|
|
[9]
|
Real-time Dataset
|
LR-DDoS
|
1. J48
2. Random Forest
3. REP Tree
4. MPL
5. SVM
|
97%
|
|
[10]
|
Simulated Dataset
|
DDoS
|
1. SVM
|
High accuracy.
|
|
[11]
|
Real Traffic
|
1. TCP
2. SYN
|
1. Decision Fusion
|
97%
|
|
[12]
|
Real-time Dataset
|
1. Warmhole
|
1. K-mean
2. Decision Tree
|
KM-IDS achieved 70% to 90% accuracy rate.
|
|
[13]
|
Simulated Dataset
|
1. DDoS
|
1. SVM
2. Naïve Bayes
3. KN
4. Self Organizing Map
|
97.14% accuracy achieved by ensemble technique applying on SVM-SOM
|
In [10], proposed the Multi-Level Intrusion Detection System (ML-IDS), which enhanced intrusion
detection by analyzing network traffic at three levels: flow, packet header, and payload.
The system used a fusion decision algorithm to combine findings from each level, improving
detection accuracy and reducing false alarms. It employed data mining techniques like
neural networks and decision trees to identify various intrusions. ML-IDS integrated
autonomic computing principles to automate control and adapt to new threats. This
approach offered a robust, adaptive solution for network security.
A machine learning-based Intrusion Detection System (ML-IDS) was introduced in [11], for detecting wormhole attacks in IoT networks. The system employed K-means clustering,
decision trees, and a hybrid approach, with K-means achieving detection rates between
70% and 93%. The decision tree method showed detection rates of 71% to 80%, while
the hybrid model achieved 71% to 75% and reduced false positives. ML-IDS proved to
be a scalable and effective solution for wormhole attack detection in IoT.
According to [12], DDoS attack identification and defense were achieved using Software-Defined Networking
(SDN) combined with machine learning techniques. A Support Vector Machine (SVM) classification
model was employed to process six-tuple characteristic values extracted from switch
flow tables, achieving an average detection accuracy of 95.24% with minimal flow data
collection. This approach effectively leveraged SDN’s capabilities for DDoS attack
detection and mitigation. The proposed method demonstrated high efficiency in both
attack identification and defense within SDN environments.
By extensive literature review, it came to my mind that in this article, we must work
on real time datasets and on simulated datasets which are publicly available to detect
DDoS attacks and compare the accurate results of algorithms.
By doing so, optimal algorithms for each dataset can be found either they are tree-based
algorithms like Decision Tree, Random Forest or Regression Tree based like Logistic
Regression. For doing this evaluation five datasets are used in this article to detect
DDoS attack.
3. Datasets
3.1. Generation of DDoS Dataset
UDP traffic is generated in Packet Sender which is an open-source utility that allows
sending and receiving TCP and UDP packets. In our dataset there are nine features:
Time, Source IP, Destination IP, Source Port, Destination Port, Method which is basically
protocol type, ASCII value which represents Packet size and Hex value represents the
byte count. Attack is represented by ‘1’ whereas normal traffic is represented by
‘0’. UDP traffic is generated based on the scenario shown by Fig. 2.
3.2. Available Datasets
The following publicly available data sets are used in our research:
1) CIC-DDoS2019: It is real time-based famous dataset generated and published by Canadian Institute
for Cybersecurity in 2019. This dataset is based on 88 network flow features; every
feature has its contribution in this dataset to detect DDoS attacks [13].
2) BoT-IoT: It was created at Cyber Range Lab of UNSW Canberra in realistic environment. It
has six different attacks such as DoS, OS and service Scan, DDoS, Keylogging, theft,
and Data Exfiltration attacks with normal traffic [14].
3) ToN-IoT: It is collected from several heterogeneous sources from IIoT and IoT sensors and
designed at UNSW Canberra at Australian Defiance Force Academy. It was gathered in
parallel manner to collect many cyber-attacks and normal traffic from a network system.
This dataset has 127 features and by these features it is the updated one which comes
after BoT-IoT and covers more attacks [15].
4) Mendeley DDoS: (A dataset generated by Ahuja and available at Mendeley repository). It has 24 features,
and its results are high for Random forests its accuracy rate is 98.8 with minor false
rate alarm depending on these features. It is simulated that’s why authors said that
results are high [16].
5) Boğaziçi University DDoS Dataset (BOUN): It is generated in Bogazici University; in this dataset 12 features are present
which helped in generating DDoS [17]. It is generated by easier simulation techniques by mixing DDoS traffic with legitimate
internet traffic.
4. Methodology
ML-based methods are used to detect DDoS attacks in a dataset. As we have selected
the above-mentioned datasets which are different from each other based on attack,
non-attack, labels, categories, some features have the value as a string whereas some
are in the form of 0 (non-attack) and 1 (attack). BoT-IoT, ToN-IoT, Generated dataset
and Mendeley DDoS Datasets are in the form of attack non attack, and different categories
of attacks are involved in it while BOUN and CIC-DDoS2019 datasets are based on labeling.
Exploratory data analysis is done by Jupiter notebook in which loaded all required
libraries, dataset and selected required columns. Flow of ML based detection system
is given in Fig. 3.
Fig. 3. Flow of ML-based detection system.
4.1. Pre-processing
To enhance the performance of algorithms we only require certain features for our
research, so data pre-processing is done on each dataset. Following data pre-processing
steps were performed on datasets:
• Useless columns were dropped in each dataset.
• Blank cells were filled by 0 or -1 in some datasets.
• As data is in mixed format (integer, objects) it was converted into int 64 categories.
• Standard scalars were also applied.
• For data normalization label encoder is used.
The process begins by applying a standard scaling technique to the dataset, which
normalizes the features to have a mean of zero and a standard deviation of one. After
the scaling, the transformed data is then converted into a structured format for easier
manipulation. Next, categorical features within the dataset are encoded into numeric
values using a label encoder. This encoding process is applied to each column that
contains categorical data, converting them into numerical representations that can
be utilized by machine learning models. Finally, the dataset is split into two distinct
parts: the features and the target variable. The features, now normalized and encoded,
are prepared for further analysis, while the target variable is isolated for use in
prediction tasks.
4.2. ML Classifiers
Seven different ML classifiers were used for learning different patterns. The following
classifiers were used in our research:
1) Logistic Regression: LR is a statistical analysis technique which is used to predict a value based on
prior known knowledge of dataset [18].
2) Decision Tree: In DT the decision is taken by learning simple decision rules [19]. As can be seen from its name, it is for classification it uses tree structure. It
gives the best classification rates by making small subsets of dataset.
3) Support Vector Machine: SVM is used for finding hyperplanes which distinguish data points [20].
4) Random Forest: While growing the trees it adds extra randomness to the classifier. It searches
and selects best features when splitting any node. It produces good prediction and
performs very well in both classification and regression tasks.
5) K- Nearest Neighbor: It is also used for regression and classification tasks. Its learning methodology
is simple; it determines the value of a point by analyzing its nearest data points.
6) Multi-Layer Perception: MPL can distinguish the data which is not linearly separable. It can find any abnormality
by its gesture/behavior, also it can do tasks on a particular given dataset.
7) XG-Boost: It’s an implementation of Gradient Boosted Decision Trees. It is used for tabular
or structured data, designed for efficient performance and learning speed.
8) Ensemble Methods: It is a technique where various models are combined for better results. Given the
highly dynamic and programmable nature of SDN, traffic flows are constantly changing,
making it challenging for a single classifier to reliably distinguish between legitimate
and malicious behavior. Ensemble techniques–such as Random Forests, Gradient Boosting,
or hybrid deep learning ensembles–address this by aggregating the outputs of multiple
diverse models, each capturing different patterns and decision boundaries. This fusion
significantly improves detection accuracy, reduces overfitting, and ensures resilience
against sophisticated and low-rate DDoS attacks.
4.3. Best Features
All columns were taken and run Extra Tree Classifier then results were checked and
exclude certain features and order important features which are not impacting much
or giving high false rate. The following features were selected in each dataset which
fits best in them for our research purpose.
1) Features of CIC-DDoS2019: There are a total of 87 features in this dataset and every feature has an impact
on accuracy but the most important features which are performing well which are shown
in Fig. 4.
Fig. 4. Feature importance of CIC-DDoS.
2) Features of BoT-IoT: In BoT-IoT total features are 46, after pre-processing we select nine features which
are performing well, and feature importance is shown in Fig. 5
Fig. 5. Feature importance of BoT-IoT.
3) Features of ToN-IoT: In ToN-IoT, there are 126 features in total, after pre-processing the selected features
are 32 which were useful in our research and from thirty-two features, 8 features
were contributing more as shown in Fig. 6.
Fig. 6. Feature importance of ToN-IoT.
4) Features of Mendeley DDoS: Mendeley DDoS is simulated dataset. It has 23 features in it and here we selected
15features which are highly contributing to it. Feature selection is done by evaluating
extra tree classifier, feature importance of Mendeley DDoS is shown in Fig. 7.
Fig. 7. Feature importance of Mendeley.
5) Features of Boğaziçi University DDoS Dataset (BOUN): It is also simulated dataset generated in Boğaziçi University. The given dataset
has 12 features in total, and from twelve 8 features were chosen according to their
contribution.
Fig. 8. Feature importance of BOUN.
6) Features of Generated DDoS Dataset: We generate it in a simulated environment in packet sender; Fig. 9 has all the important features which are highly contributing in it.
Fig. 9. Feature Importance of generated DDoS dataset.
4.4. Common Features
Following features are common features which are present in every dataset. These features
are playing important role in datasets but in some datasets it has great impact on
the other hand it is not performing well on some datasets. Common features are:
• Source IP
• Source Port
• Destination IP
• Destination Port
• Time to live
• Packet count
• Protocol
• Packet size in bytes
5. Results
5.1. Results Based on Best Features
It can be seen from Table 2, that accuracy rate of different algorithms in every dataset has different. All datasets
have high accuracy rate of decision tree and random forest and XG-Boost whereas Logistic
Regression have least accuracy rate among all datasets. Ensemble method is applied
on four models which are giving high accuracy such as MLP, DT, RF and XGB. Here the
results are on the basis of individual best features of datasets.
Table 2. Results based on best features.
|
Algorithms
|
Accuracy rate of CIC
|
Accuracy rate of BoT-IoT
|
Accuracy rate of ToN -IoT
|
Accuracy rate of Mendeley
|
Accuracy rate of BOUN
|
|
Logistic regression
|
51.86%
|
57.09%
|
84.71%
|
70.63%
|
92.14%
|
|
K-nearest neighbor
|
80.15%
|
96.52%
|
93.69%
|
92.55%
|
97.64%
|
|
Multi-layer perception
|
86.03%
|
78.10%
|
82.78%
|
83.03%
|
71.98%
|
|
Decision tree
|
88.15%
|
97.44%
|
98.47%
|
99.89%
|
99.97%
|
|
Random forest
|
88.65%
|
97.35%
|
98.79%
|
99.89%
|
99.98%
|
|
XG-Boost
|
89.94%
|
95.54%
|
99.14%
|
99.96%
|
99.99%
|
|
Support vector machine
|
66.19%
|
54.45%
|
85.14%
|
82.37%
|
86.85%
|
|
Ensemble
|
89.51%
|
96.56%
|
85.14%
|
82.37%
|
99.99%
|
1) Results of CIC-DDoS2019 Dataset: In this dataset, the accuracy of Decision Tree is 88.15%, Random Forest accuracy
is 88.65% and XG-Boost performed very well, and its accuracy is 89.94%. These algorithms
performed well because of tree based nature. Ensemble method is applied on four models
which are giving high accuracy such as MPL, DT, RF and XGB which is shown in Fig. 10.
Fig. 10. Accuracy rate of CIC-DDoS.
2) Results of BoT-IoT Dataset: In BoT-IoT, the accuracy of K-nearest Neighbor is 96.5% and it is high as compared
to CIC-DDoS2019 dataset. The accuracy of Decision Tree is 97.44% whereas the accuracy
of Random Forest is 97.35%. After applying ensemble method on MPL, DT, RF and XGB
the accuracy we achieved is 96.56% which can be seen in Fig. 11.
Fig. 11. Accuracy rate of BoT-IoT.
3) Results of ToN-IoT Dataset: In this dataset, the performance of XG-Boost is high it achieved 99.14% accuracy
and the accuracy rate of Decision Tree is 98.47% whereas Random Forest achieved 98.79%
which can be seen from Fig. 12. When ensemble method is applied on the four algorithms as we do in previous datasets,
the accuracy rate is 85.14% which is lower, compared to other datasets except Mendeley.
Fig. 12. Accuracy rate of ToN-IoT.
4) Results of Mendeley DDoS Dataset: As this dataset is simulated and tree based so we achieved 99.89% accuracy rate
of Decision Tree and Random Forest whereas the accuracy of XG-Boost is 99.96%. In
this dataset other algorithms such as Logistic Regression and MPL didn’t perform well
which can be seen from Fig. 13.
Fig. 13. Accuracy rate of Mendeley DDoS.
5) Results of BOUN Dataset: This dataset performed very well among all datasets, it gave us a high accuracy
rate of 99.99% in ensemble method also the accuracy of Decision Tree is 99.97%, Random
Forest 99.98% and XG-Boost has 99.99% accuracy rate which is shown in Fig. 14.
Fig. 14. Accuracy rate of BOUN.
5.2. Results of Datasets Based on Common Features
Common Features of all datasets are mentioned in Section 3.5, on the basis of these
common features results are shown below in Table 3 that results are different from previous results which are based on best features.
Here it can be seen that the accuracy rate of logistic regression of CIC-DDoS is 32.27%
whereas on best features it was 51.86%, also the accuracy rate of KNN, SVM are low.
Some common features are performing well in one dataset but in other datasets it’s
not performing well due to under-fitting because of less features selection. Therefore
comparison of real-time based datasets with simulated datasets is not possible if
both have many different features which are highly contributing in generation and
detection DDoS attacks.
Table 3. Results based on common features.
|
Algorithm
|
CIC-DDoS
|
BOT-IoT
|
ToN-IoT
|
Mendeley
|
BOUN
|
|
Logistic Regression
|
35.27%
|
57.57%
|
80.85%
|
63.21%
|
74.76%
|
|
K-Nearest Neighbor
|
38.83%
|
53.77%
|
99.27%
|
99.82%
|
91.82%
|
|
Multi-Layer Perception
|
47.22%
|
54.43%
|
87.05%
|
76.89%
|
71.97%
|
|
Decision Tree
|
85.84%
|
80.99%
|
99.17%
|
99.98%
|
99.97%
|
|
Random Forest
|
86.40%
|
82.53%
|
99.98%
|
99.37%
|
99.97%
|
|
XG-Boost
|
88.56%
|
82.14%
|
99.43%
|
99.93%
|
99.99%
|
|
Support Vector Machine
|
34.74%
|
55.28%
|
91.73%
|
85.14%
|
86.65%
|
|
Ensemble
|
88.56%
|
82.57%
|
99.43%
|
99.93%
|
99.99%
|
5.3. Results of Generated DDoS Dataset
The detailed analysis of generated DDoS dataset is in Table 4 where accuracy, precision, F1-score, sensitivity and specificity is shown across
each algorithm. Accuracy rate of algorithms is also shown in Fig. 15.
Table 4. Detailed analysis of generated dataset.
|
Algorithm
|
Accuracy
|
Precision
|
F1-Score
|
Sensitivity
|
Specificity
|
|
Logistic Regression
|
98.54%
|
96.50%
|
97.76%
|
99.05%
|
98.31%
|
|
K-nearest neighbor
|
99.07%
|
97.52%
|
98.58%
|
99.66%
|
98.80%
|
|
Multi-layer perception
|
97.74%
|
93.16%
|
96.44%
|
99.96%
|
96.77%
|
|
Decision tree
|
99.98%
|
99.97%
|
99.98%
|
100%
|
99.98%
|
|
Random forest
|
99.98%
|
99.97%
|
99.98%
|
100%
|
99.98%
|
|
XG-Boost
|
99.98%
|
99.97%
|
99.98%
|
100%
|
99.98%
|
|
Support vector machine
|
97.31%
|
91.80%
|
95.73%
|
100%
|
96.15%
|
|
Ensemble
|
99.98%
|
99.97%
|
99.98%
|
100%
|
99.98%
|
Fig. 15. Accuracy rate of generated dataset.
6. Conclusion
In every dataset, either it is real time dataset or simulated, Decision Tree, Random
Forest and XG-Boost performed well and gave high accuracy rate in detecting DDoS attack
whereas the performance of Logistic Regression was not good in every dataset as compare
to other algorithms. The motive of this paper was to identify the performance of ML
algorithms on both types of datasets and we found out that three algorithms have high
accuracy rate with very low error rate. Comparisons of datasets on the basis of common
features it is confirmed that the comparison of real time based datasets with synthetic
datasets could only possible if both datasets have exactly same features which are
contributing highly, if real-time based datasets have more features which shows more
importance than common features than results which were obtained are biased means
that one feature may have high contribution in one dataset whereas in other dataset
its contribution is low. Important future work includes massive traffic generation
of TCP SYN flood, ICMP attack also detection and prevention through machine learning.
Acknowledgement
This work was supported by the National Research Foundation (NRF), Korea, under project
BK21 FOUR (F21YY8102068).
References
J. Xie , F. R. Yu , T. Huang , R. Xie , J. Liu , C. Wang , Y. Liu ,
A survey of machine learning techniques applied to software-defined networking (SDN):
Research issues and challenges, IEEE Communications Surveys & Tutorials, Vol. 21,
No. 1, pp. 393-430, 2019
C. Song , Y. Park , K. Golani , Y. Kim , K. Bhatt , K. Goswami , Machine-learning-based
threat-aware system in software-defined networks, Proc. of the 26th International
Conference on Computer Communication and Networks (ICCCN), pp. 1-9, 2017
A. Ahmad , E. Harjula , M. Ylianttila , I. Ahmad , Evaluation of machine
learning techniques for security in SDN, Proc. of the IEEE Global Communications Conference
Workshops (GC Wkshps), pp. 1-6, 2020
D. Erhan , E. Anarım , Boğaziçi University distributed denial-of-service dataset,
Data in Brief, Vol. 32, Art. no. 106187, 2020
A. Abubakar , B. Pranggono , Machine learning-based intrusion detection system
for software-defined networks, Proc. of the Seventh International Conference on Emerging
Security Technologies (EST), pp. 138-143, 2017
C. Song , Y. Park , K. Golani , Y. Kim , K. Bhatt , K. Goswami , Machine-learning-based
threat-aware system in software-defined networks, Proc. of the 26th International
Conference on Computer Communication and Networks (ICCCN), pp. 1-9, 2017
J. Xie , F. R. Yu , T. Huang , R. Xie , J. Liu , C. Wang , Y. Liu ,
A survey of machine learning techniques applied to software-defined networking (SDN):
Research issues and challenges, IEEE Communications Surveys & Tutorials, Vol. 21,
No. 1, pp. 393-430, 2019
J. A. Perez-Diaz , I. A. Valdovinos , K.-K. R. Choo , D. Zhu , A flexible
SDN-based architecture for identifying and mitigating low-rate DDoS attacks using
machine learning, IEEE Access, Vol. 8, pp. 155859-155872, 2020
S. Y. Mehr , B. Ramamurthy , An SVM-based DDoS attack detection method for Ryu
SDN controller, Proc. of the 15th International Conference on Emerging Networking
Experiments and Technologies, pp. 72-73, 2019
Y. Al-Nashif , A. A. Kumar , S. Hariri , Y. Luo , F. Szidarovszky , G.
Qu , Multi-level intrusion detection system (ML-IDS), Proc. of the International
Conference on Autonomic Computing, pp. 131-140, 2008
P. Shukla , ML-IDS: A machine learning approach to detect wormhole attacks in Internet
of Things, Proc. of the Intelligent Systems Conference (IntelliSys), pp. 234-240,
2017
L. Yang , H. Zhao , DDoS attack identification and defense using SDN based on
machine learning method, Proc. of the 15th International Symposium on Pervasive Systems,
Algorithms and Networks (I-SPAN), pp. 174-178, 2018
T. M. Booij , I. Chiscop , E. Meeuwissen , N. Moustafa , F. T. H. den Hartog
, ToN_IoT: The role of heterogeneity and the need for standardization of features
and attack types in IoT network intrusion data sets, IEEE Internet of Things Journal,
Vol. 9, No. 1, pp. 485-496, 2022
N. Ahuja , G. Singal , D. Mukhopadhyay , N. Kumar , Automated DDoS attack
detection in software-defined networking, Journal of Network and Computer Applications,
Vol. 187, Art. no. 103108, 2021
D. Erhan , E. Anarım , Boğaziçi University distributed denial-of-service dataset,
Data in Brief, Vol. 32, Art. no. 106187, 2020
S. Menard , , Applied Logistic Regression Analysis, Vol. 106, 2002
S. R. Safavian , D. Landgrebe , A survey of decision tree classifier methodology,
IEEE Transactions on Systems, Man, and Cybernetics, Vol. 21, No. 3, pp. 660-674, 1991
T. Evgeniou , M. Pontil , Support vector machines: Theory and applications, Machine
Learning and Its Applications: Advanced Lectures, pp. 249-257, 2001
Fazeela Mughal completed her BSCS from UIIT, PMAS Arid Agriculture University in 2018,
specializing in Artificial Intelligence and Python. She earned her M.Sc. degree in
computer science from NUST in 2022, focusing on machine learning and deep learning
algorithms applied to network datasets. She has expertise in machine learning, deep
learning, and software defined networks. In 2021, she authored a chapter on Autonomous
Transportation Systems in Intelligent Cyber Physical Systems for Autonomous Transportation
Systems. Ms. Mughal served as a Computer Science Lecturer at Harvard College of Commerce
& Science from 2023-2024 and she joined LifeTech Applications (Black & Black Creative)
in October 2024 as Software Quality Assurance intern and is currently appointed as
Junior Quality Assurance Analyst.
Ghulam Musa Raza received his B.S. degree in computer sciences from Comsats University
Islamabad in 2019. His major in B.S. was intelligent robotics. He received his M.S.
degree in computer sciences from SEECS, NUST Islamabad in 2021. His research interest
in his master was natural language processing (artificial intelligence). From 2017
to 2019, he was working as a Software Engineer at Snaky Solutions Pvt Limited. He
served as a Machine Learning based Research Assistant in the TUKL lab, NUST Islamabad
at the start of 2021. He served as Lecturer at Alhamd Islamic University, Islamabad
from 2021 to 2022. His major Interests are in the field of Natural Language Processing,
the Internet of Things (IOT), Information-Centric Networking, and Named Data Networking.
He is currently pursuing a Ph.D. degree with the Department of Communication and Software
Engineering at Graduate School, Hongik University, SKR.
Waseem Raza is an aspiring computer science student pursuing his B.S. degree in computer
science at the University of Gujrat, Pakistan. With a keen interest in artificial
intelligence and machine learning, he aims to contribute meaningfully to the field.
He is driven by a passion for innovation and problem-solving. His research interests
are machine learning algorithms, natural language processing, and computer vision.
His dedication and enthusiasm for AI and ML make him a promising talent in the world
of computer science. He served as a Teaching Assistant in the Department of CS, University
of Gujrat from Sep. 2024 to Jan. 2025.
Byung-Seo Kim received his B.S. degree in electrical engineering from In-Ha University,
InChon, Korea in 1998 and his M.S. and Ph.D. degrees in electrical and computer engineering
from the University of Florida in 2001 and 2004, respectively. His Ph.D. study was
supervised by Dr. Yuguang Fang. Between 1997 and 1999, he worked for Motorola Korea
Ltd., PaJu, Korea as a Computer Integrated Manufacturing (CIM) Engineer in Advanced
Technology Research and Development (ATR & D). From January 2005 to August 2007, he
worked for Motorola Inc., Schaumburg Illinois, as a Senior Software Engineer in Networks
and Enterprises. His research focuses on Motorola Inc, design- ing the protocol and
network architecture of wireless broadband mission- critical communications. From
2012 to 2014, he was the Chairman of the Department of Software and Communications
Engineering, at Hongik University, South Korea, where he is currently a Professor.
He served as the General Chair for General Chair of 3rd IWWCN 2017, and the TPC member
for the IEEE VTC 2014-Spring and the EAI FUTURE2016, and ICGHIC 2016 2019 conferences.
He served as Guest Editor of special issues of the International Journal of Distributed
Sensor Networks (SAGE), IEEE Access, and the Journal of the Institute of Electrics
and Information Engineers. He also served as a Member of the Sejong-city Construction
Review Committee and the Ansan-city Design Advisory Board. His work has appeared in
around 167 publications and 22 patents. He is an IEEE Senior Member and Associative
Editor of IEEE Access. His research interests include the design and development of
efficient wireless/wired networks including link- adaptable/ cross-layer-based protocols,
multi-protocol structures, wireless CCNs/NDNs, Mobile Edge Computing, physical layer
design for broadband PLC, and resource allocation algorithms for wireless networks.