Interpretable Machine Learning Approaches for Resilient DDoS Detection in Software-Defined Networks

SDNs are dynamic, scalable and may be susceptible to Distributed Denial of Service (DDoS) because of its centralized control. In this paper, hybrid machine learning methodology has been introduced to detect DDoS in SDN. The suggested approach helps to use unsupervised algorithms (K-Means clustering, Principal Component Analysis (PCA), and K-Best feature selection) with supervised classifiers (Decision Trees, Random Forests, and ensemble classifiers including Stacking and Voting). The unsupervised methods are used to decrease dimensionality and create features that are significant, therefore, maximizing the accuracy of classification. The findings show that all models had an accuracy of 96 per cent, which shows that the hybrid model is effective in separating between normal and malicious traffic. In addition, ensemble techniques especially, Stacking and Voting classifiers were also found to be robust and gave the most reliable result. This framework will be used to improve the security of SDN by offering an effective DDoS detection mechanism. The next generation of SDN can see the addition of deep learning models and explainable AI in order to enhance the functionality and interpretability of SDN.