Enhancing SDN Controller Resilience to DDoS Attacks with IAT-Based Detection on CICIoT2023

This study addresses the vulnerability of Software-Defined Networking (SDN) controllers to Distributed Denial of Service (DDoS) attacks, a critical issue for secure smart city and e-government applications. Using the CICIoT2023 dataset. Methods: We employed Random Forest with Recursive Feature Elimination and Cross-Validation (RFECV) to identify critical features for DDoS detection, validated through simulations in a Mininet/ONOS environment. Results reveal Inter-Arrival Time (IAT) as the most significant feature (importance score: 0.3200), with Controller Resources being the most vulnerable component (vulnerability score: 0.9048). DDoS-ICMP_Flood was the most effective attack (vulnerability score: 1.00), while Controller Distribution achieved a mitigation effectiveness of 0.9048. This research introduces a novel temporal feature-based detection approach, outperforming volume-based methods, and proposes adaptive mitigation strategies for SDN resilience. These findings enhance secure SDN deployment in dynamic IoT-driven environments.