Adaptive Ensemble Learning Framework for Zero Day DDoS Attack Detection in Software Defined Networks Using Multi Dimensional Feature Correlation

Software-Defined Networks (SDN) have emerged as a transformative architecture for modern network management, yet their centralized control plane presents a critical vulnerability to Distributed Denial-of-Service (DDoS) attacks. This research proposes an adaptive ensemble learning framework that integrates Random Forest, Gradient Boosting, and eXtreme Gradient Boosting (XGBoost) classifiers to detect both known and zero-day DDoS attacks in SDN environments. The proposed framework employs multi-dimensional feature correlation analysis to extract temporal, statistical, and behavioral characteristics from network flows, enabling real-time threat identification with minimal computational overhead. A novel dynamic weight adjustment mechanism is introduced to optimize ensemble decision-making based on attack pattern evolution and classifier confidence scores. Experimental evaluation conducted on the CICDDoS2019 and InSDN datasets demonstrates that the proposed framework achieves 98.7% detection accuracy with a false positive rate of 0.3% and detection latency of 1.2 seconds. The framework successfully identified 94.2% of previously unseen attack vectors through anomaly-based behavioral profiling. Comparative analysis against standalone classifiers and existing ensemble methods reveals superior performance in terms of precision, recall, and F1-score across volumetric, protocol-based, and application-layer attack categories. The integration of flow-based statistical analysis with controller-level monitoring provides comprehensive visibility into attack propagation patterns within the SDN infrastructure.