DDoS Attack Detection in SDN Networks with Federated Learning: A Comparison with Supervised Machine Learning Techniques

• Grant number: 25/10108-0
• Support Opportunities: Scholarships in Brazil - Scientific Initiation
• Start date: August 01, 2025
• End date: July 31, 2026
• Field of knowledge: Physical Sciences and Mathematics - Computer Science - Computer Systems
• Principal Investigator: Kelton Augusto Pontara da Costa
• Grantee: Nicole Forsin Ribeiro Lopes
• Host Institution: Faculdade de Ciências (FC). Universidade Estadual Paulista (UNESP). Campus de Bauru. Bauru , SP, Brazil

Abstract

The adoption of Software Defined Networks (SDN) has been continuously increasing over the years. According to trend reports by Mordor Intelligence, in 2023, the global SDN market was valued at 11.91 billion dollars and is expected to register a compound annual growth rate of 22.8% between 2024 and 2029, reaching 33.25 billion dollars. Although network virtualization brings several benefits in terms of implementation and management, the decoupling of the control plane and data plane also introduces new security risks. In this context, Distributed Denial of Service (DDoS) attacks are common in such infrastructures, as they are capable of disrupting regular network traffic by flooding servers with illegitimate requests. This fact, when combined with the growing SDN landscape, highlights the need to effectively detect and mitigate such attacks. Therefore, this project, based on studies published in recent years, presents a comparative analysis of different types of machine learning approaches for DDoS attack detection in SDN with a decentralized method, in order to determine which techniques yield the best results. More specifically, the research aims to explore the behavior of the technique known as Federated Learning (FL), a distributed learning approach, in comparison to centralized supervised algorithms such as Random Forest, K-Nearest Neighbors, and Support Vector Machine. (AU)