Enhanced Feature Selection for Superior Ensemble DDoS Detection in Software-Defined Networks

Distributed Denial-of-Service (DDoS) attacks disrupt networks by flooding systems with traffic from multiple sources, making real-time detection essential. Integrating Machine Learning (ML) with Software-Defined Networking (SDN) presents a viable solution; however, existing ML methods often face challenges such as high false positive rates and difficulty detecting sophisticated attacks like low-rate and zero-day DDoS attacks due to inadequate training features. As DDoS attack methods evolve, continuous retraining of ML models becomes necessary. This paper introduces a feature selection approach for ensemble classifiers to improve DDoS detection in SDNs. Through correlation analysis and principal component analysis (PCA), the most relevant features are identified, leading to substantial improvements in model performance. Our evaluation, using diverse DDoS datasets, demonstrates that the proposed method achieves near-perfect accuracy, a 100% true positive rate, and minimal error rates, offering a highly effective solution for DDoS detection in SDNs.