Two-Stage EWMA–XGBoost Pipeline with Pre-Enforcement Victim Shielding for SDN DDoS Mitigation

Continuing Denial of Service (DoS/DDoS) flooding attacks consume network and host computing power, while software-defined network (SDN) controllers that centralize traffic monitoring remain subject to saturating packet-in floods, victim misclassification, and static-threshold attack detection logic. Proposed solution: this paper develops and validates an effective two-stage hybrid Intrusion Detection and Prevention System (IDPS) running within a Ryu OpenFlow 1.3 controller, comprising an adaptive-threshold rule based heuristics stage (Stage 1) and calibrated XGBoost classifier trained using an eleven-dimensional protocol-behavior feature set (Stage 2) along with an asymmetric victim-shielding, confidence-adaptive TTL, exponentially weighted moving average (EWMA) features smoothing, isotonic probability calibration, and a dual safety-gated confidence fusion decision rule. Key results: In sixty-three attack simulation scenarios using eleven different types of attacks at four intensity levels, the proposed IDPS achieves around an 89% scenario-level detection rate, sub-second latency at medium and high intensity levels, and no false positive enforcement of victim hosts; the remaining missed true positives are found to be caused by a structural issue, the Protocol Counter Bypass problem at burst mode hardware flow-table offloading. Applications: The architecture can be immediately applied to enterprise, campus, and data center SDN applications where fast, self-adaptive DoS/DDoS defense is required.