A PSO-Optimized gradient boosting framework for flow-based DDoS detection in software-defined networks

Abstract Software-Defined Networking (SDN) provides a programmable and centrally managed network architecture, but its centralized control plane introduces significant vulnerability to Distributed Denial of Service (DDoS) attacks. These attacks can overwhelm controller resources and disrupt network availability, making efficient and reliable detection mechanisms essential. This study proposes an optimization-driven ensemble learning framework for DDoS detection in SDN environments by integrating a Gradient Boosting Classifier (GBC) with Particle Swarm Optimization (PSO). PSO is employed to automatically tune key hyperparameters of the ensemble model, improving classification stability and enhancing detection performance while maintaining lightweight inference suitable for real-time deployment in SDN monitoring systems. The proposed framework is evaluated using an SDN-specific dataset generated in a realistic Mininet-based environment with OpenFlow-enabled switches and a Ryu controller. Experimental results under stratified 5-fold cross-validation show near-perfect detection performance, achieving accuracy and F1-score values 0.9999, with consistently high precision and recall. To further assess generalization capability, the model is validated on the CICDDoS2019 benchmark dataset, where it achieves more than 99% accuracy across all evaluation metrics. The results demonstrate strong robustness across heterogeneous traffic distributions while maintaining stable performance. Overall, the findings indicate that PSO-enhanced ensemble learning provides an effective and computationally efficient approach for improving DDoS detection in SDN environments, offering a practical balance between accuracy, robustness, and deployment feasibility.