Comparative Performance Analysis of Sequence-Aware NLP Models for DDoS Attack Detection in SDN

Software Defined Networks (SDN) provides the ability to a centralized control, which increases the flexibility of the network, but the architectural design of SDN also provides an increased vulnerability to Distributed Denial-of-Service (DDoS) attacks to the control plane. Accurate and timely detection of such attacks is thus essential for ensuring the reliability of networks. This paper provides a comparative performance analysis of sequence awareness Natural Language Processing (NLP) models for DDoS attack detection at SDN environments. Network traffic information from the CICDDoS2019 dataset is modeled as temporal sequences and analyzed with LSTM, BiLSTM, GRU and Transformer architectures. The models are tested with the help of standard performance metrics such as accuracy, precision, recall, F1-score, ROC-AUC and detection latency. Experimental results reveal that the high detection accuracy (96.1% to 98.8%) is obtained for sequence-aware models. The Transformer model is the best performer overall in terms of accuracy (98.8%), F1-score (98.3%) and ROC-AUC (0.991), and GRU has the lowest detection latency, which is suitable for SDN deployment in a real-time scenario. The results speak volume about the effectiveness of temporal sequence modeling and attention-based learning to robust and scalable DDoS detection in Software Defined Networks.