Real-Time Two-Stage Detection and Mitigation System for DDoS Attacks in SDN

In this study, we propose a two-stage anomaly detection system aimed at real-time detection and mitigation of distributed denial of service (DDoS) attacks within Software Defined Networking (SDN). In the first stage, lightweight, threshold-based detection is performed on edge switches to quickly identify abnormal traffic. This detected anomalous traffic is reported to an SDN controller. Then, in the second stage, detailed analysis using a convolutional neural network-long short-term memory (CNN-LSTM) model optimized for time-series data, is conducted. This approach effectively distributes the load of the SDN controller, which handles both route control and anomaly detection. In addition, it enables high-precision anomaly detection. For traffic deemed anomalous, a mitigation strategy involving bandwidth throttling is applied to achieve rapid traffic control. Compared with existing methods, the proposed system improves both detection accuracy and mitigation efficiency, contributing to enhanced security in real SDN environments.