Payload-Independent Continual Detection of DDoS and Low-Rate Attacks in Software-Defined Networks Using SCX

Software-defined networking (SDN) improves network programmability by separating network control from packet forwarding. However, distributed denial-of-service (DDoS) and low-rate attacks can exhaust network and service resources through different traffic patterns. A detection model needs to identify these patterns and use incoming traffic when new labels are limited. This paper studies self-organizing map (SOM)-guided Continuous XGBoost (SCX) for payload-independent detection of DDoS and low-rate attacks. First, a self-organizing map is trained with the initial labeled data and assigns pseudo-labels to incoming flow records. Next, a filtering rule combines neuron label agreement, sample support, and quantization error to select records for training. The accepted records are added to the previous training data, and XGBoost is retrained to update the detector. The input features are obtained from packet headers, packet lengths, timestamps, and flow counters, without inspecting application contents. We describe the implementation, derive the sample-acceptance conditions, and analyze the time and memory requirements. The main evaluation averages twenty cases per dataset, randomly selected from 201 candidate partitions on InSDN, CIC 2017 DDoS, and CIC 2017 LR-DDoS. After ten updates, mean accuracy is 99.785%, 99.923%, and 99.543%, with total initial-to-final gains of 0.121, 0.032, and 0.523 percentage points. Corresponding mean F1 scores are 99.770%, 99.937%, and 99.394%. The low-rate improvement is mainly associated with higher recall, alongside a small precision decrease. Supplementary controlled ablations examine the reliability–coverage trade-off. These results characterize the update trajectories within fixed classification tasks; adaptation to new attacks, natural concept drift, and end-to-end SDN mitigation remain unevaluated.