Improving Security in Software‐Defined Networks Through an Optimized Support Vector Machine Model for Detecting Distributed Denial‐of‐Service Attacks

ABSTRACT In recent years, software‐defined networking (SDN) has emerged as one of the modern networks, offering a centralized control for managing and controlling the network. This centralization in SDN makes it vulnerable to distributed denial of service (DDoS) attacks, leading to network damage and unavailability. This research presents a novel approach to detect the DDoS attacks in real‐time SDN environment using the support vector machine (SVM) model, enhanced by kernel principal component analysis (KPCA) and genetic algorithm (GA). KPCA is employed to reduce the dimensions of the network traffic features and to effectively capture the nonlinear patterns, while minimizing the computational complexity. To optimize the SVM hyperparameters and to improve the accuracy of the proposed model, a GA is used. The proposed model is deployed on a customized Ryu controller incorporating FlowTracker for real‐time OpenFlow feature extraction, KPCA and StandardScaler for transformation, and an optimized SVM classifier with high‐priority flow rules for instantaneous attack mitigation. The system is rigorously evaluated on the CIC‐DDoS2019 dataset as well as live SDN traffic generated in a Mininet + Ryu environment. Results indicate that the proposed approach is successful and efficient with high detection accuracy, and a very low false positive rates, as compared to the other traditional machine learning models.