Evaluating Sequence-Based NLP Models for Accurate DDoS Detection in Software-Defined Networks

Distributed Denial-of-Service (DDoS) attacks pose a critical threat to Software-Defined Networks (SDN) due to their centralized control architecture and highly dynamic traffic behavior. Traditional intrusion detection techniques often fail to capture the temporal and contextual dependencies present in network traffic, resulting in reduced detection accuracy and higher false alarm rates. To address these limitations, this paper proposes a sequence-based deep learning framework that models network traffic flows as ordered sequences, inspired by natural language processing techniques. A hybrid Transformer–BiLSTM architecture is introduced to jointly capture global contextual relationships through self-attention and bidirectional temporal dependencies in traffic patterns. Experimental evaluation on the CIC-IDS2017 dataset demonstrates superior performance, achieving a detection accuracy of 99.7% and a ROC–AUC value close to 0.999, significantly outperforming traditional machine learning and standalone deep learning models. Additionally, an unsupervised LSTM autoencoder is incorporated to identify unknown anomalies, enhancing robustness against zero-day attacks. Overall, the results confirm the effectiveness, scalability, and reliability of the proposed approach for real-time DDoS detection in SDN environments.