<scp>RyuGuard</scp>—Combining Ryu and machine learning for proactive <scp>DDoS</scp> defense in software‐defined networks

Summary Software defined network (SDN) is an experimental network design utilized by software companies, academia, and healthcare systems to provide adequate resource utilization, data management, superior network control, and administration. However, these networks face substantial risks, especially from distributed denial of service (DDoS) attacks, requiring robust cybersecurity measures. This article proposes RyuGuard, an intrusion detection and prevention system (IDPS) enhanced with machine learning (ML) capabilities, specifically designed to protect SDNs from DDoS attacks. A DDoS‐specific dataset was collected in the SDN environment through feature extraction from normal and malicious traffic. The evaluation of the dataset with the ML classifiers demonstrates that the decision tree (DT) was the most effective model, with a low false alarm rate (FAR), achieving an accuracy of 99.9%, and rapid execution time, which ensures timely detection and response, suitable for real‐time implementation. RyuGuard, with DT deployment and utilizing the programmability feature of SDN, is designed to predict and prevent the DDoS attack from the ongoing traffic of SDN. Compared with the other existing models, the presented IDPS, RyuGuard, enables early attack prediction, preventing the full impact of DDoS within the network while maintaining sustained throughput and performance with low CPU utilization.