Detection of DDoS Attacks in SDN Switches with Deep Learning and Swarm Intelligence Approach

This paper introduces an efficient intrusion detection system for the Internet of Things, addressing the challenge of malware-infected IoT nodes acting as botnet attackers, along with issues in existing intrusion detection systems such as feature selection, data imbalance, and centralization. The proposed system leverages the distributed architecture of SDN. The method begins by balancing the dataset using the SMOTE technique. Essential features are then selected using the African Vulture Optimization Algorithm. Subsequently, an LSTM deep learning model is trained within the SDN controller. SDN switches utilize this trained model for attack detection. To enhance attack mitigation, attacking node addresses are shared among SDN switches, ensuring consistent recognition and enabling effective Distributed Denial-of-Service (DDoS) attack prevention across the network. Experimental results obtained in MATLAB, using the NSL-KDD dataset, demonstrate the proposed method’s effectiveness, achieving an accuracy of 99.34%, a sensitivity of 99.16%, and a precision of 98.93% in attack detection. The proposed method outperforms feature selection methods based on WOA, HHO, and AO algorithms, and deep learning methods like LSTM, RNN, and CNN, particularly in detecting DDoS attacks.