Federated Incremental Learning Based DDoS Attack Detection Model in SDN Environment

Software-Defined Networking （SDN） is a widely adopted network paradigm characterized by the separation of the control plane from the data plane. In light of network security threats， particularly Distributed Denial of Service （DDoS） attacks， the integration of effective DDoS attack detection methods within SDN is of paramount importance. The centralized control characteristic of SDN presents significant security risks when employing centralized DDoS attack detection methods， thereby posing considerable challenges to the security of the control plane in SDN environments. Furthermore， the growing volume of traffic data in SDN environments results in challenges related to more intricate traffic characterization and a pronounced Non-Independent and Identically Distributed （Non-IID） distribution among various entities. These issues present significant barriers to enhancing the accuracy and robustness of current federated learning-based detection models. The separation of management and control in SDN facilitates the creation of new flow rules by users， which enhances the efficiency of message routing control. However， current methodologies for flow detection face difficulties in preserving the knowledge of original features while simultaneously adapting to the distribution of newly generated features within the SDN environment. This challenge contributes to a phenomenon known as data forgetting. Furthermore，the imposition of flow rules restricts the forwarding targets of messages， resulting in variability in the data messages that can be collected by different host entities. The Non-IID distribution problem significantly undermines the performance and robustness of DDoS attack detection models that utilize artificial intelligence. To address these challenges， we propose a federated incremental learning-based model for DDoS attack detection within an SDN environment. This model integrates incremental learning and federated learning to accommodate new data inputs through incremental model updates， thereby eliminating the need for global re-training of the entire model. To mitigate the security risks associated with centralized DDoS attack detection methods and to address the Non-IID distribution issues arising from data increments， we introduce a weighted aggregation algorithm grounded in federated incremental learning. This algorithm personalizes adaptation to different subdataset increments by dynamically adjusting aggregation weights， thereby enhancing the efficiency of incremental aggregation. Additionally， in response to the complex traffic features inherent in SDN networks， we propose a DDoS attack detection methodology that employs Long Short-Term Memory （LSTM） networks. This approach enables real-time detection of traffic features by extracting and learning the temporal correlations present in the data， utilizing statistical analysis of the temporal characteristics of traffic data within SDN networks. Finally， by integrating the unique characteristics of SDN networks， we facilitate real-time decision-making for DDoS defense. This integration combines the results of DDoS attack detection with information pertaining to network entities， enabling the real-time deployment of flow rules. Concurrently， this approach effectively mitigates malicious DDoS attack traffic， safeguards critical entities， and ensures the stability of network topology. In this study， we evaluate the performance of the proposed method against existing techniques， including FedAvg， FA-FedAvg， and FIL-IIoT， in the context of an incremental DDoS attack detection task. The experimental results indicate that the proposed method enhances the accuracy of DDoS attack detection by an improvement range of 5. 06% to 12. 62% and increases the F1-Score by 0. 0565 to 0. 1410 when compared to alternative methods. © 2024 Science Press. All rights reserved.