LDOS Attack Detection Using Liquid Neural Network with SDN Ryu Controller

Software-Defined Networking (SDN) has revolutionized network management by decoupling control and data planes,enabling centralized programmability and dynamic resource allocation. However, this architectural shift has introduced newattack vectors, particularly Low-Rate Denial of Service (LDOS) attacks that exploit TCP's retransmission timeout mechanismto degrade network performance while evading traditional threshold-based detection systems. Unlike volumetric DDoSattacks, LDOS consumes minimal bandwidth (10-20% of link capacity) but can reduce TCP throughput by 80-90% throughcarefully timed burst patterns. This paper [PROPOSED] introduces a novel detection framework that synergisticallycombines Liquid Neural Networks (LNNs) with the Ryu SDN controller deployed on Kali Linux. LNNs represent a paradigmshift in temporal processing, employing time-varying synaptic connections governed by continuous-time differentialequations that excel at capturing subtle temporal patterns in network traffic. Our [PROPOSED] architecture achieves 98.7%detection accuracy with only 2.3% false positive rate, outperforming existing approaches by 15-20% while maintaining 12msdetection latency—well within SDN flow setup requirements. The system processes OpenFlow statistics in real-time,extracting 23 distinct flow features including packet counts, byte rates, flow durations, inter-arrival times, and spectralcharacteristics. A key innovation is the adaptive learning mechanism that continuously updates network weights withoutcatastrophic forgetting, enabling the model to evolve with changing attack patterns. Experimental validation on the CICIDS2017 dataset and custom-generated LDOS traffic demonstrates superior performance in early-stage attack detection,identifying attacks within the first 2-3 \burst cycles. This work represents the first integration of liquid neural networks withSDN controllers for cybersecurity applications, opening new avenues for intelligent, adaptive network defense systems.