Search Results (686)

The recent trend of Software-Defined Networking (SDN) has posed significant cybersecurity challenges as a result of its centralized control architecture, dynamic traffic behavior, and high programmability. Although these attributes improve network flexibility and management, they also increase vulnerability to Distributed Denial-of-Service (DDoS) attacks that can overwhelm network resources and disrupt services. Traditional signature- and rule-based detection methods may struggle with evolving traffic patterns and generate excessive false alarms. Machine learning offers a more promising solution that can learn the complex traffic patterns and separate malicious traffic from normal traffic. Most machine learning models, however, are black-box models that provide only superficial insight into the model predictions. Explainable Artificial Intelligence (XAI) addresses this limitation by identifying influential traffic features and providing interpretable evidence for detection decisions. This research develops an explainable machine learning-based framework for accurate, transparent, and reliable DDoS attack detection in an SDN environment. Several machine learning models are assessed, and XAI techniques are applied to explain the results of the predictions at global and instance levels. Gradient Boosting, Logistic Regression, AdaBoost, and Gaussian Naive Bayes were evaluated on 104,345 network-flow records using a 70:30 training–testing split. Gradient Boosting achieved the strongest performance, with 99.88% training accuracy, 99.87% testing accuracy, a testing F1-score of 99.84%, and a 0.20% miss rate. SHAP identified the most influential traffic features, while LIME linked individual predictions to feature-specific contributions. The proposed framework therefore combines reliable DDoS detection with transparent, analyst-oriented decision support for SDN security monitoring. Full article

Software-Defined Networking (SDN) provides fine-grained control over network architectures, yet integrating intrusion detection systems (IDSs) into the control plane frequently introduces prohibitive computational overhead. This issue is compounded by the fact that existing machine learning models, typically trained on static benchmark datasets, often degrade under real-time polling conditions and unpredictable traffic bursts. To bridge this gap, this paper evaluates an ultra-compact five-feature polling scheme (F1–F5) designed to preserve statistical symmetry between control-plane monitoring and telemetry overhead within a dynamic Mininet–Ryu testbed. The experimental framework incorporates 15% background noise, and a 10% stealth attack overlaps across a 120 s dynamic trace. Four distinct classifiers—Random Forest (RF), Decision Tree (DT), Multi-Layer Perceptron (MLP), and Long Short-Term Memory (LSTM)—were evaluated across frame-by-frame snapshot and windowed prediction tasks. Empirical findings reveal that tree-based ensembles consistently outperform deep learning approaches, with RF attaining an overall accuracy of 97.57% and DT achieving 96.74%, compared to 90.77% for MLP and 90.73% for LSTM. Analysis of the time-series logs demonstrates that RF’s orthogonal decision boundaries successfully isolate transient, high-intensity threats such as WebAttack and PortScan vectors without needing memory-intensive recurrent architectures. Ultimately, pairing minimal feature extraction with lightweight tree ensembles offers an optimal balance between low control-plane latency and high detection efficacy. Full article

The rapid advancement of software-defined networking (SDN) has enhanced network programmability, centralized control, and traffic management flexibility, while also increasing exposure to sophisticated attacks targeting the control plane. Although federated learning (FL) enables collaborative intrusion detection without centralized raw data sharing, existing FL-based intrusion detection systems remain vulnerable to plaintext model update leakage, centralized cryptographic trust, limited interpretability, and insufficient validation in operational SDN environments. To address these limitations, this paper presents an explainable federated intrusion detection framework that integrates distributed key generation (DKG), CKKS-based threshold homomorphic encryption, collaborative decryption, and SHapley Additive exPlanations (SHAP). Unlike conventional HE-enabled FL systems that rely on a trusted authority or a globally shared secret key, the proposed framework removes the trusted key-generation dealer, avoids centralized custody of the complete secret key, and prevents any single client or aggregation server from independently decrypting ciphertexts using locally held key material. A gated recurrent unit (GRU)-based model is used for privacy-preserving intrusion detection, and SHAP provides global and local explanations of model decisions. The framework is further deployed in a real-time SDN testbed to evaluate the online inference pipeline following threshold-secured federated training. Computationally intensive cryptographic operations, including DKG, encrypted aggregation, and threshold decryption, are performed during offline training, while the converged global model enables low-latency inference at runtime. Experiments on the InSDN, CICDDoS2017, and CICDDoS2019 datasets with 4, 8, and 12 client federated configurations achieved detection accuracies above 99% across all datasets. The evaluation also examines encryption latency, collaborative decryption overhead, secure aggregation cost, communication complexity, and scalability. The results demonstrate that the proposed framework provides a practical balance among decentralized key management, privacy-preserving aggregation, explainability, detection performance, and real-time SDN deployment feasibility. Full article

Recent progress in intelligent, adaptive, and security-aware Software-Defined Wireless Sensor Networks (SDWSNs) is driven by the integration of Machine Learning (ML) with Software-Defined Networking (SDN) and Wireless Sensor Networks (WSNs). This systematic survey analyzes 46 peer-reviewed articles published between 2024 and 2025, providing a problem-oriented synthesis of ML-SDWSN research. Emphasizing security, routing, and performance optimization, with a particular focus on deployment architectures, the survey identifies three major trends: increased adoption of ensemble and Reinforcement Learning (RL) methods for security and adaptive control; broader implementation of edge-based ML to minimize inference latency; and greater emphasis on privacy-preserving techniques, especially Federated Learning (FL). The survey presents a structured taxonomy encompassing seven thematic areas: Distributed Denial-of-Service (DDoS) mitigation, Intrusion Detection Systems (IDSs), routing optimization, Quality of Service (QoS) management, privacy preservation, data integrity, and network-efficiency optimization. Findings are synthesized from over 120 experimental configurations reported in the literature. Due to substantial differences among the reviewed studies in terms of datasets, network topologies, hardware platforms, measurement definitions, and validation methodologies, the reported values are presented as descriptive cross-study aggregates rather than direct comparative benchmarks or formal effect-size estimates. Within these constraints, the survey identifies recurring trade-offs among accuracy, latency, scalability, and privacy. It provides evidence-based design considerations for researchers and practitioners. The survey also highlights eight critical research gaps, including limited multi-dataset validation, a lack of real-world deployments, insufficient scalability analysis, and the need for rigorous evaluation of RL-based SDWSN control. Full article

Fast Reroute (FRR) after link failures is essential for carrier-grade Software-Defined Networking (SDN), yet hybrid deployments remain dominated by slow legacy routing convergence. This paper presents two port-state-driven FRR mechanisms for homogeneous and hybrid SDN networks. First, Port-State-Aware Fast Reroute (PSA-FRR) uses OpenFlow port-status events to trigger proactive, rule-based protection in the data plane. Second, Port-State-Aware Neural Fast Reroute (PSAR-FRR) formulates hybrid FRR as a controller-local multi-class classification problem and predicts the backup egress port from a port-centric state representation, enabling microsecond-scale decision latency. We evaluate the methods on the Abilene wide-area network (WAN) topology using Mininet with Open vSwitch (OVS) and a Ryu controller (homogeneous case) and Graphical Network Simulator-3 (GNS3) with Cisco IOS routers (hybrid baseline). In homogeneous SDN emulation, PSA-FRR restores connectivity within 30–100 ms under the evaluated configurations. In the hybrid baseline, conventional routing protocols converge in 13.8–256.1 s (Enhanced Interior Gateway Routing Protocol (EIGRP), Intermediate System to Intermediate System (IS-IS), Open Shortest Path First (OSPF), Border Gateway Protocol (BGP), and Routing Information Protocol (RIP)), confirming that control-plane recovery cannot meet a 50 ms target. Using the collected dataset, PSAR-FRR reduces controller decision time from 6.753 $\mathsf{\mu }$s (PSA-FRR rule evaluation) to 0.214 $\mathsf{\mu }$s (deep neural network (DNN) inference), a 31.5× speedup. These results show that port-state awareness combined with learned, controller-local policies can substantially reduce the decision-to-action latency of FRR, providing a practical path toward low-latency failure recovery in SDN migration scenarios. Full article

Software-defined Networking (SDN) is a promising networking architecture that separates the control and data planes to allow flexible network management. However, the SDN architecture makes networks vulnerable to various security threats, such as Distributed Denial-of-Service (DDoS) attacks. A DDoS attack is one of the most common SDN threats, aiming to exhaust a network’s computational and bandwidth resources. Self-similarity is a statistical property of time series in which data patterns repeat at different time scales. Several studies have shown that network traffic exhibits increased self-similarity during DDoS attacks, making it a promising tool for DDoS detection. Despite the effectiveness of statistical methods for detecting DDoS, some methods, such as self-similarity, are discarded due to their high computational cost, leading to detection delays. This paper proposes a lightweight Rescaled Range ($R/S$)-based scheme for effective real-time DDoS attack detection in SDN. The scheme employs the Welford online algorithm to compute statistical parameters of the $R/S$ scheme. Experimental results demonstrate that the proposed scheme efficiently captures changes in self-similarity and detects TCP/UDP DDoS attacks in real time. Moreover, it achieves high detection performance compared to other $R/S$ methods, with a False Positive Rate (FPR) below 0.5% and an average computation time of 0.047 ms. Full article

Software-Defined Networking (SDN) separates the control and data planes, introducing a logically centralized controller that is itself a high-value attack target. Despite growing interest in SDN intrusion detection, publicly available datasets either restrict evaluation to binary normal-vs-DDoS classification or lack control-plane telemetry, leaving multi-class detection of SDN-architectural attacks without a dedicated benchmark. This work presents LAN-SDN-NIDS, a publicly available, multi-class flow-level dataset of 1,125,059 records generated in a fully containerized Containernet/OpenDaylight testbed across five standard network topologies. Each flow record combines 29 traffic-level features with 11 control-plane-aware metrics—including Packet-In and Flow-Mod counts and first-seen delay. The dataset covers five attack classes in two categories: three that exploit SDN control-plane mechanisms (link fabrication, host injection, and port hijack) alongside DDoS and port scan, plus normal traffic. An XGBoost classifier trained on the full feature set achieved a macro F1 of 0.94; an ablation study showed that removing OpenFlow features causes link fabrication F1 to collapse from 0.97 to 0.19, indicating that control-plane telemetry is decisive for detecting SDN-architectural attacks under the conditions evaluated. A UMAP embedding is consistent with class separability, except for a structural overlap between host injection and normal traffic attributable to their shared ARP protocol. Full article

Data Centers that implement Software-Defined Networks (SDN) are not required to employ the Address Resolution Protocol (ARP), but network hosts do. Therefore, there is a need to support this protocol without modifying the intrinsic functionality of the SDN controller. In this work, four strategies for handling ARP are evaluated using an SDN and OpenFlow rules. The strategies include disabling ARP at the host level, using static MAC addresses, introducing a fake gateway, and generating ARP replies using OpenFlow flows. To our knowledge, nobody has tested and compared the main characteristics and advantages offered by these four strategies. Experimental evaluation was conducted on a real SDN network and complemented with similar experiments using Mininet. Performance was assessed using metrics such as ping response time, address resolution response time, jitter, and packet loss ratio. The results show that OpenFlow-based ARP replies provide a good balance in terms of scalability, performance, and configuration effort. This strategy achieved the lowest average ping response time (0.641 ms) and ARP response time (0.6188 ms), while avoiding the manual configuration requirements of static approaches. Full article

The convergence of optical burst switching (OBS) and elastic optical networks (EON) offers a promising pathway for 6G IoT backhaul. However, existing solutions treat OBS and EON separately and rely on heuristic resource allocation that fails to meet stringent QoS demands. This paper proposes a fully AI-driven converged OBS/EON architecture integrating a hybrid switching fabric, a multi-agent deep reinforcement learning (DRL) orchestrator, and a federated learning (FL) plane for autonomous, QoS-aware resource provisioning. The control plane implements multi-agent Proximal Policy Optimization (PPO) for joint burst scheduling, routing, modulation selection, and spectrum allocation. The orchestration plane employs q-fair FL for privacy-preserving cross-domain traffic prediction. Mathematical formulations of the optimization problem with spectrum, GSNR, and delay constraints are provided, along with pseudo-algorithms. Simulations over a 14-node NSFNET topology demonstrate a 78% reduction in blocking probability, a 42% improvement in spectral efficiency, sub-millisecond URLLC delays, and a Jain’s fairness index of 0.92, while preserving data privacy. The framework builds upon SDN principles for seamless integration with optical transport infrastructures. Full article

Vehicular Ad Hoc Networks (VANETs) are essential components of Intelligent Transportation Systems (ITS), allowing communication exchanges between vehicles and road infrastructure elements. These networks face challenges from vehicular mobility, including frequent topology changes, link instability, and variable wireless channel quality. This paper presents an extensive evaluation of Software-Defined Networking (SDN) integrated with two traffic engineering technologies, Multi-Protocol Label Switching (MPLS) and Segment Routing (SR), applied to the AODV and OLSR routing protocols. Nine incremental configurations are evaluated for each protocol, ranging from the default protocol through MPLS-enhanced forwarding, SDN-based centralized optimization, combined SDN-MPLS and SDN-SR integration, to advanced configurations using distance-based IS-IS weighted topology metrics with both Fixed and Adaptive metric computation approaches. Two distinct SDN topology construction methods are compared: a Protocol-based approach that uses routing table entries with equal hop-count metrics, and a distance-based approach using IS-IS weighted metrics. The simulation uses a realistic urban topology with 50 vehicles and 5 RSUs, evaluated across several traffic patterns, representing different application types. Results demonstrate that SR with distance-based IS-IS metrics achieves the highest Packet Delivery Ratio (PDR) and lowest delay by leveraging RSU infrastructure as reliable forwarding relays. Moreover, the proposed SDN-SR framework reduces routing overhead and control-plane signaling, improving network resource utilization and thereby indicating its potential to enhance the energy efficiency of vehicular communication infrastructures. Full article

Future sixth-generation (6G)-oriented networks require programmable control that can adapt routing to latency and congestion without unsafe online exploration. This study evaluates offline multi-agent deep deterministic policy gradient (MADDPG) with behavior-adjusted training rewards for latency-aware path control in software-defined networking (SDN). Each traffic pair is modeled as an agent selecting one of three retained candidate paths, while centralized critics learn coordinated decisions from topology-specific Ryu–Mininet transition datasets. Nine policies are compared using ten paired seeds on fat-tree, mesh-grid, and WAN-corridors topologies under a deployed utilization–latency weighting of $0.60/0.40$, together with flow-completion, latency, congestion, architectural-comparison, sensitivity, robustness, statistical, and controller-overhead analyses. The utilization-aware path heuristic achieves the strongest overall reward ranking. MADDPG is the strongest learned policy on fat-tree, is not significantly outperformed by any evaluated policy on mesh-grid, and remains statistically tied with completion-matched policies on WAN-corridors. Behavior adjustment is topology-dependent rather than uniformly beneficial. The exported policy requires approximately $52\mathsf{\mu }\mathrm{s}$ per joint decision, whereas complete control-loop timing is dominated by network-statistics polling. These results support offline multi-agent SDN control as a competitive, low-overhead option when interpreted jointly with topology structure, flow completion, and strong heuristic baselines. Full article

Software-Defined Networking (SDN) centralizes control logic, improving programmability but exposing the controller to volumetric and low-rate Distributed Denial of Service (DDoS) attacks. Entropy-based detectors often raise late alarms or require significant traffic distribution changes, while machine-learning approaches impose high training and inference overhead. To address these issues, this work proposes a Statistical Mean Renyi Entropy (SMRE)-based early-warning system that amplifies micro-level disturbances in flow randomness using a tunable sensitivity weight (μ). The formulation enhances responsiveness to entropy deviations without adding computational complexity, enabling O(n) single-pass execution per monitoring window. The method was implemented on a Mininet testbed (nine switches, 64 hosts, POX controller with the L3_learning module) with mixed benign traffic and hping3/Scapy-generated UDP and TCP flood attack traffic at intensities ranging from 10 to 75%. Experimental results demonstrate that SMRE detects early-stage attacks with 94.7–98.1% accuracy, 0.8–2.3% false positive rate, and 6.5–14 ms detection latency, outperforming Shannon and classical Renyi entropy detectors. ROC analysis (AUC ≈ 0.99) and paired t-tests (p < 0.01) confirm statistical significance. Resource profiling shows negligible CPU and memory overhead, supporting real-time deployment. By eliminating model training and ensuring robust early detection, SMRE offers a lightweight and practical detection mechanism for SDN environments, whose applicability to cloud, edge, and IoT deployments will be further substantiated through validation on real traffic traces and multi-controller architectures. Full article

To address the limitations of traditional network gateways in performance and reliability, this paper proposes a multi-gateway load balancing and active-standby switchover strategy based on software-defined networking (SDN). A link quality scoring model is first developed, which normalizes throughput, delay, and packet loss rate into three separate 0–100 scores. To address the drawbacks of fixed weighting strategies, we adopt Q-learning to obtain optimal weight coefficients for the three metrics across nine discrete link states categorized by delay and packet loss. Based on the learned adaptive scoring model, four operation modes were implemented, i.e., normal, load balancing (LB), active standby (AS), and hybrid. Among them, the LB and hybrid modes adopted the Q-learning-based adaptive weighting mechanism, while the normal and AS modes either used fixed weights or no link quality scoring. Experiments are conducted on the Mininet platform under three fixed degradation levels (low, medium, high). Ablation experiments with fixed weight combinations [0.3, 0.4, 0.3] were further carried out to verify the necessity of the adaptive weighting module, and a quasi-dynamic gradual link degradation scenario was supplemented to test the dynamic adaptation capability. TCP single-flow and multi-flow throughput, UDP multi-flow packet loss rate, and self-healing time were measured. Results show that, compared with the normal mode, the LB and hybrid modes increased TCP throughput by 15–42% and reduced UDP packet loss by 7–13%. The hybrid mode achieved a self-healing time of 1.66 s, outperforming the active-standby mode (2.38 s), demonstrating its superior trade-off between performance and availability. Full article

The growing demand for real-time data synchronisation has increased the importance of supervisory control systems in industrial automation, smart grids, healthcare monitoring, and environmental applications. Low-power wireless sensor networks (LPWSNs) have emerged as key enablers of scalable and energy-efficient monitoring. However, achieving reliable synchronisation remains challenging due to latency, energy constraints, scalability limitations, security vulnerabilities, and data integrity concerns. This review examines the role of time synchronisation in supervisory control systems and evaluates how LPWSNs support real-time monitoring and decision-making. Established synchronisation protocols, including Reference Broadcast Synchronisation (RBS), the Flooding Time Synchronisation Protocol (FTSP), and the Timing-Sync Protocol for Sensor Network (TPSN), are analysed in terms of accuracy, energy efficiency, and scalability. Key optimisation strategies, such as clock drift compensation, data aggregation and compression, and edge computing, are also discussed. Recent advances, including artificial intelligence and machine learning (AI/ML)-based predictive synchronisation, blockchain, software-defined networking (SDN), and 5G-enabled LPWSNs, are reviewed across industrial, energy, healthcare, and agricultural applications. The review critically evaluates their benefits and trade-offs and identifies remaining challenges related to cybersecurity, energy efficiency, and large-scale deployment. Finally, future research directions are outlined to support robust, scalable, and efficient real-time synchronisation in LPWSNs. Full article

The development of Software-Defined Networks (SDNs) introduces new challenges in network security, particularly in detecting Distributed Denial of Service (DDoS) attacks and network anomalies. Due to the centralized architecture of SDN, traditional detection methods are often insufficient in dynamic environments. Therefore, machine learning techniques are increasingly applied to improve detection effectiveness. This paper analyzes the impact of network topology on the performance of machine learning-based detection methods in SDN environments. A controlled experimental setup based on the RYU controller and OpenFlow 1.3 was implemented using Mininet. Two network topologies (linear and hierarchical) were evaluated under multiple attack scenarios, including TCP SYN flood and TCP/UDP port scanning. Two supervised learning models, Random Forest (RF) and K-Nearest Neighbors (KNN), were implemented and compared using standard evaluation metrics: accuracy, precision, recall, F1-score, and detection time. The results show that Random Forest significantly outperforms KNN, achieving up to 100% accuracy and detection times as low as 4.24 s, while KNN exhibits lower stability and reduced recall in anomaly detection scenarios. The study demonstrates that network topology has a measurable impact on both detection performance and latency. The observed effects varied across attack scenarios and machine learning models. Hierarchical topology generally improved detection sensitivity in DDoS scenarios, while linear topology often enabled lower detection latency during selected anomaly detection experiments. The results indicate that both machine learning model selection and network topology should be jointly considered when designing intrusion detection systems for SDN environments. These findings contribute to improving the effectiveness and responsiveness of security mechanisms in modern programmable networks. Full article