A Novel DDoS Detection Model for SDN Using Single-Class Cluster Oversampling and Weighted Ensemble Method

The centralized control plane characteristic of Software Defined Networking (SDN) makes it a prime target for Distributed Denial of Service (DDoS) attacks. A significant issue in network traffic data is the severe imbalance between background traffic and various types of DDoS attack traffic. To address this challenge, we propose a novel DDoS detection model based on single-class cluster oversampling and weighted ensemble method. Initially, we design a multi-strategy feature selection using variance inflation factor and recursive feature elimination. Next, we construct a single-class cluster model based on the spatial distribution of samples, and create minority class samples independently within each cluster. Finally, detection results are determined using the weight vector of each base classifier in ensemble learning. The proposed DDoS detection model's performance is validated through simulations of various DDoS attack scenarios in an SDN environment. Experimental results indicate that the proposed strategy exhibits superior performance, showing improvements in precision, recall, and F1 score compared to state-of-the-art techniques.