Enhancing DDoS attack detection and mitigation in SDNS using tharn-aided feature-driven detection and Q-Mitigate reinforcement learning

Software-Defined Networking (SDN) offers flexibility and programmability but also exposes the control plane to Distributed Denial-of-Service (DDoS) attacks that can degrade network performance. Existing intrusion detection frameworks often suffer from class imbalance, feature redundancy, and limited temporal modeling, which reduce their effectiveness in detecting diverse attack patterns. To address these challenges, we propose a novel pipeline that integrates Synthetic Minority Oversampling Technique (SMOTE) for balancing, Hybrid Crayfish–Gazelle Optimization (HCGO) for optimal feature selection, and a Temporal Hybrid Attention Recurrent Network (THARN) that combines LSTM, GRU, Temporal Convolutional Networks (TCN), and attention mechanism for robust classification. In addition, a reinforcement learning–based policy module, Q-Mitigate is specified to bridge detection and adaptive SDN mitigation. Experimental evaluation on the CIC-DDoS2017 dataset demonstrates that THARN achieves 99.38% accuracy, 99.58% precision, and 99.45% F1-score, outperforming existing approaches. These results confirm the effectiveness and novelty of the proposed system, while also providing foundation for future integration of detection and mitigation in SDN environments.