Customizable DDoS attack data generation in SDN environments for enhanced machine learning detection models.

Gayantha, Nadeera; Rajapakse, Chathura; Senanayake, Janaka

Abstract

Distributed Denial of Service (DDoS) attacks are a critical threat to the security and reliability of Software-Defined Networking (SDN) environments. Existing datasets for training machine learning (ML) models, such as KDDCup '99 and CICIDS 2017, are either outdated or fail to capture SDN-specific characteristics, limiting their effectiveness in detecting modern DDoS attacks. This paper proposes a framework for generating a comprehensive, SDN-specific dataset using a virtual environment that integrates Mininet, the Ryu controller, and Python-based automation. The dataset incorporates advanced flow-level metrics, including SYN counts, queue lengths, and real-time traffic dynamics, reflecting contemporary attack scenarios such as ICMP floods, TCP SYN floods, and UDP floods. By addressing the limitations of traditional datasets, this custom dataset enhances ML model training for DDoS detection in SDN environments, providing improved accuracy and adaptability. Contributions include a scalable SDN-based dataset generation framework, enriched feature sets for ML training, and a comprehensive approach to capturing both legitimate and malicious traffic dynamics. This study highlights the potential of SDN programmability in advancing security research and offers a robust tool for the development of reliable DDoS detection mechanisms.

Citation

GAYANTHA, N., RAJAPAKSE, C. and SENANAYAKE, J. 2025. Customizable DDoS attack data generation in SDN environments for enhanced machine learning detection models. In Proceedings of the 25th International conference on advanced research in computing 2025 (ICARC 2025): converging horizons: uniting disciplines in computing research through AI innovation, 19-20 February 2025, Belihuloya, Sri Lanka. Piscataway: IEEE [online], pages 386-391. Available from: https://doi.org/10.1109/icarc64760.2025.10963190

• Presentation Conference Type: Conference Paper (published)
• Conference Name: 25th International conference on advanced research in computing 2025 (ICARC 2025): converging horizons: uniting disciplines in computing research through AI innovation
• Start Date: Feb 19, 2025
• End Date: Feb 20, 2025
• Acceptance Date: Jan 1, 2025
• Online Publication Date: Feb 19, 2025
• Publication Date: Dec 31, 2025
• Deposit Date: Apr 24, 2025
• Publicly Available Date: Apr 24, 2025
• Publisher: Institute of Electrical and Electronics Engineers (IEEE)
• Peer Reviewed: Peer Reviewed
• Pages: 386-391
• ISBN: 9798331530983
• DOI: https://doi.org/10.1109/icarc64760.2025.10963190
• Keywords: Distributed denial of service (DDoS) detection; Software-defined networking (SDN); Dataset generation; Machine learning; Network security
• Public URL: https://rgu-repository.worktribe.com/output/2801576