Performance Analysis of Gradient Boosting and Decision Tree on Distributed Denial of Service Attacks in Software Defined Networks

Distributed Denial of Service (DDoS) attacks remain a prominent threat to modern network infrastructures, particularly in Software Defined Networks (SDNs), which operate under a centralized control architecture. This study aims to assess the effectiveness of Gradient Boosting and Decision Tree algorithms for identifying DDoS attacks in SDN environments. To improve model performance, we applied preprocessing and feature selection to a publicly available SDN-based DDoS dataset. The feature selection process successfully reduced the number of attributes from 23 to the 10 most influential features for classification. The models were trained and evaluated using multiple data splitting ratios: 60:40, 70:30, 80:20, and 90:10. Their performance was measured through accuracy, precision, recall, F1-score, and confusion matrix analysis. Experimental results showed that Gradient Boosting achieved the highest accuracy of 95.53% on a 90:10 split, with relatively low computation time. In comparison, the Decision Tree achieved a maximum accuracy of 94.26% but required more processing time. The confusion matrix for the best-performing model showed high true-positive and true-negative rates, with a low false-negative rate, indicating reliable detection capabilities. This study contributes to the ongoing research in DDoS detection by highlighting the effectiveness of machine learning algorithms in SDN environments.