MininetGym: A modular SDN-based simulation environment for reinforcement learning in cybersecurity

Cybersecurity demands increasingly adaptive techniques to detect and mitigate sophisticated threats. This paper presents MininetGym , a Software Defined Network (SDN)-based simulation framework with a modular architecture based on Mininet, offering high configurability for experiments aimed at evaluating Reinforcement Learning (RL) strategies in network traffic classification and attack detection tasks. Three use cases are implemented: (i) traffic classification, (ii) detection of Denial of Service attacks in real-time, and (iii) the extension of the simulator with custom environments. The framework supports tabular and deep RL agents and includes modular components for network emulation, traffic generation, and agent interaction. The framework generates evaluation metrics and visualizations, enabling users to analyze agent performance and understand their behavior in dynamic network conditions. • A modular simulator for Reinforcement Learning (RL) in Software Defined Network-based network scenarios. • Supports both tabular (Q-learning, SARSA) and deep RL (DQN, PPO, A2C) agents. • Real-time traffic generation and flow monitoring via Mininet and OpenDaylight. • Custom Gym environments for traffic classification and Denial of Service attack detection. • Configurable setup for benchmarking RL models in cybersecurity experiments.