A Novel Hybrid Deep Learning Algorithm for DDoS Attack Detection on Software-Defined Networking

1. Introduction

The rise in online services and the escalating amount of data transmitted across communication networks affirm the necessity to develop traditional network structures. There is a growing need to move towards a new paradigm that matches the evolving demands of development. Software-Defined Networking (SDN) emerges as a sophisticated network technology designed to revolutionize and optimize the traditional network [1]. Unlike the traditional network, SDN allows the separation of control and data plane functions. This disconnection facilitates the efficient monitoring, configuration, and optimization of network resources [2,3]. Figure 1 shows the structure of SDN, consisting of three main planes: the application plane, the control plane (CP), and the data plane (DP). The DP devices forward traffic based on rules that are received from the controller. CP has a global view of the network and can quickly manage rules and generate configurations. The controller plane is the central decision point and mind of the network. The application plane contains many SDN applications, which communicate with the SDN controller using a northbound interface [1].

The SDN controller presents security vulnerabilities and forms a single point of failure, vulnerable to misuse by attackers trying to disrupt network functionality [4]. Consequently, attackers may initiate a large-scale traffic onslaught, commonly referred to as a Distributed Denial of Service (DDoS) attack, directed from the SDN infrastructure layer toward the controller [5,6]. The core target of DDoS attacks is to obstruct legal users from arriving at a service for a prolonged time. In this type of attack, the assailant seeks to harm numerous hosts to deliberately inundate a legitimate user with an overwhelming volume of traffic. Consequently, this results in a prolonged unavailability of the service [7].

Identifying DDoS attacks on the SDN controller as early as possible is a critical research concern. Several researchers have put forth diverse methods for identification of DDoS attacks in SDN environments utilizing machine learning (ML) and deep learning (DL) techniques [7,8,9,10,11,12,13,14,15,16]. Although these methods have demonstrated promise, several vital challenges persist. First, current methods often lack effective feature selection mechanisms, leading to suboptimal performance [8,13,17]. Second, many of these approaches suffer from low detection accuracy and prolonged detection times, making them less practical for real-time applications [6,18,19]. Third, some work uses conventional datasets that do not correctly mirror the reality of the SDN environment [8,12,19,20].

In this research, our purpose is to address these challenges and contribute to improving DDoS attack detection in SDN infrastructures by developing an advanced detection model equipped with an unorthodox hybrid feature selection where the proposed model will be developed based on a dataset that accurately reflects the reality of the SDN infrastructures. The major contributions of this research paper are listed as follows:

• Introduce a novel hybrid feature selection approach that combines traditional filter-based methods (mutual information, chi-squared, and ANOVA) with a self-attention mechanism. This approach effectively identifies the most important features for DDoS attack identification in SDN environments.
• Propose a novel detection model that relies on a parallel 1D CNN-GRU architecture for the identification of DDoS attacks on SDN controllers. The model leverages the strengths of both a CNN and GRU. The CNN captures spatial and local patterns, while the GRU focuses on temporal dependencies within the data. By combining both spatial and temporal features, this architecture ensures comprehensive feature extraction and improves detection performance.
• Conduct a comprehensive assessment of the suggested approach by comparing its outcomes with other ML and DL approaches. This comparison highlights the superiority of the hybrid 1D CNN-GRU model in terms of accuracy, precision, false positive rate, and detection efficiency.

The remainder of the research is structured as follows: Section 2 reviews the previous works. Section 3 describes the proposed method, including a hybrid feature selection mechanism, and 1D CNN-GRU DDoS attack classification models. Section 4 discusses the results. Lastly, Section 5 summarizes the main findings of this work.

2. Literature Review

The employing of machine learning (ML) and deep learning (DL) algorithms to boost the security of SDN has captured the interest of numerous researchers. These methods provide sophisticated capabilities for examining intricate network traffic patterns, which makes them useful for recognizing and alleviating DDoS attacks. This section explores diverse studies centered around DDoS security mechanisms through harnessing the capabilities of both ML and DL techniques.

2.1. Machine Learning

The studies in [8,13,17,21] introduced diverse approaches for identifying DDoS attacks. But, a significant drawback of these approaches is their dependence on conventional datasets, which don't accurately mirror the reality of the SDN infrastructure. In [8], the researchers constructed a ML model utilizing decision trees (DTs) and support vector machine (SVM) to identify DDoS attacks in SDN networks. They assessed their suggested method employing the KDD CUP dataset which doesn't mirror the reality of the SDN environment, their findings yielded subpar outcomes. Specifically, DT achieved only a 78% accuracy. In [13], the researchers presented a ML-based approach for identifying and alleviating low-rate DDoS attacks in the SDN infrastructure. They used six ML algorithms, including J48, random tree (RT), random forest (RF), multilayer perceptron (MLP), SVM, and REP Trees. The outcomes indicated that the MLP algorithm yielded the best outcomes, achieving a 95% accuracy rate. However, the method underwent testing and assessment employing the (CIC) DoS dataset, which does not represent of the real SDN environment. Authors in [21] introduced an ML model for identifying application layer DDoS Attacks. Their proposed approach involved combining a radial basis function (RBF) neural network with the cuckoo search (CS) model. To determine the optimal features for data collection, they employed a genetic algorithm (GA). In their study, they compared the efficiency of their model to that of other methods, including Bootstrap Aggregation (Bagging), k-nearest neighbor (KNN), recurrent neural network (RNN), SVM, and MLP. Experimental findings demonstrated that their approach surpassed previous approaches in the detection of DDoS traffic. But, they assessed the model using the NSL-KDD dataset which doesn't mirror the reality of the SDN infrastructure. Authors in [17] introduced an anomaly-based intrusion detection system designed for SDN, employing a range of ML models, involving extreme learning machine (ELM), linear discriminant analysis (LDA), neural networks (NN), AdaBoost (AB), RUSBoost (RB), LogitBoost (LB), BaggingTrees (BT), Naive Bayes (NB), RF, SVM, KNN, and DT. Based on their experimental findings, the DT proved higher efficiency compared to the other ML algorithms, attaining a testing accuracy of 88.74% and a training accuracy of 99.7 %. It’s worth noting that the NSL-KDD dataset was employed in their work.

The authors in [7,10,22,23] proposed a hybrid ML system for the identifying of DDoS attacks in SDN infrastructures. In [7], the hybrid system merges self-organizing map (SOM) and SVM for DDoS attack detection in SDN infrastructures. The presented hybrid system showcased a detection rate of 90.45%. Nevertheless, the authors presented insufficient details regarding the dataset employed. Authors in [10] generated an SDN dataset employing a Mininet emulator, simulating real-time scenarios and extracting 23 features. The presented hybrid system combines SVM and RF (SVM-RF), experimented with their approach, and attained a high-performance level. Authors in [22] developed a DDoS security system leveraging SDN architecture and vehicle sensors for the detection of attack flows. Their hybrid solution incorporates an integration of SOM and KNN algorithms. Authors in [23] develop a hybrid solution for detecting various sorts of DDoS attacks in vehicular ad hoc networks (VANET), the hybrid model integrates neural networks (NN) and DT algorithms, and they concluded a result that the hybrid model surpasses the individual performance of the NN and DT models.

The SVM algorithm has been employed by many authors in their approach [11,24,25]. In [24], the authors presented an evolutionary model developed for the recognition of DDoS attack traffic within an SDN infrastructure. They enhanced SVM by incorporating kernel principal component analysis (KPCA) with GA. In this SVM model, KPCA serves to lower the dimensionality of feature vectors, while GA improves various SVM parameters. In [11], the authors suggested employing an ensemble approach for identifying DDoS attacks. They applied four various ML models (KNN, NB, SVM, and SOM) to identify suspect traffic within the SDN infrastructure. Among these, the SVM-SOM displayed superior efficiency in contrast to the other ML algorithm. In [25], the researchers presented a system intended to identify DDoS attacks in SDN, they employed an Advanced SVM in their method which exhibited a prediction accuracy of 97%. Although they generated an attack dataset within the SDN environment, it is noteworthy that they did not release it to the public.

In [15], the researchers suggested a security model to recognize DDoS attacks within the SDN infrastructure. The system relies on an adaptive learning approach that utilizes previous datasets to categorize the traffic. They employed a cross-validation strategy to enhance the efficiency of categorization outcomes, while the acquired findings are promising, it is suggested that the adaptive security system undergoes testing on diverse datasets acquired from real-world environments to enhance its realism and generalizability. In [26], the authors directed their attention to web-shell intrusion in the IoT environment, employing ensemble techniques. They utilized principal component analysis (PCA) to identify optimal features, incorporating three ensemble techniques: voting, extremely randomized trees (ET), and RF. Notably, RF and ET demonstrated effectiveness in light IoT environments, while the voting method yielded superior results in heavier IoT scenarios.

2.2. Deep Learning

The studies in [18,27,28] utilized deep neural networks (DNN) in their approach. In [18], the authors built a deep learning model employing DNN and CNN to identify link flooding attacks. They experimented with their technique utilizing a created dataset and got a detection accuracy rate of only 95.03%. In [27], the authors presented a DDoS attack recognition approach for SDN, incorporating two security phases. Initially, a snort was employed for the recognition of signature-based attacks. Subsequently, the SVM model and the DNN model were utilized for attack classification. The experimental findings showed that the DNN was better than the SVM, obtaining a classification accuracy rate of 92.30%. In [28], the authors proposed a method employing DNN to safeguard DP and CP against DDoS attacks. Nevertheless, their training, testing, and evaluation were based on the UNSW-NB15 dataset, which is not particularly tailored for the SDN infrastructure. Consequently, the approach exhibited subpar efficiency in terms of computation metrics.

The authors in [19,20,29,30] used the conventional dataset which reflects the traditional networks to evaluate their proposed DL model. In [19], to prevent false data injection attacks on the communication channel, the authors introduced an anomaly-based intrusion detection framework employing a DL algorithm, and recognize any attack attempts on the SDN southbound side. While the authors asserted a detection accuracy of 99.6% for their proposed system, it's crucial to highlight that the approach underwent testing and evaluation utilizing a non-SDN dataset, which doesn't represent the dynamics of an SDN infrastructure. Moreover, the system's protective scope is restricted solely to communication channels. In [20], the researchers presented a DDoS attack recognition approach employing a two-level detection system to detect attacks using information entropy (IE) and DL. In the initial phase, entropy detection is employed to identify suspicious traffic, and in the subsequent phase, the CNN algorithm is employed for detecting attack traffic. The method underwent testing with DNN, DT, and SVM algorithms, revealing that the accuracy of the CNN algorithm was 4.25–8.20% greater than that of the other algorithms. It's essential to highlight that the approach underwent testing and evaluation using the CICIDS2017 DoS dataset which does not represent the reality of the SDN infrastructure. In [29], the authors suggested an ensemble approach that combines GRU, CNN, and LSTM. They assessed their strategy employing the CICIDS2017 dataset and obtained a high accuracy (99.77%) by focusing on just four selected features, notable that the dataset used does not represent the realistic SDN environment. In [30], the authors introduced an SSAE-BiLSTM model using DL to recognize the DDOS attack in the SDN network, they employed the bidirectional long short-term memory (BiLSTM) in their method. The suggested model achieved high accuracy and minimal FPR. Nevertheless, their method tested with a dataset that wasn't specific to SDN.

The authors in [6] introduced a DLADSC model utilizing DL to recognize DDoS attacks on SDN controllers, they employed the RNN algorithm for the detection process and Chi-square, and IGR methods for the feature selection process. They experimented with their method using a realistic dataset but showed low accuracy, achieving a detection accuracy of only 94.186%.

Table 1 illustrates a summary of the related works examined in this study, it shows the year of publication, the method utilized, the type of dataset employed, and the key findings for each work.

In general, researchers have delved into diverse DL and ML-based models to fortify DDoS attacks on SDN controllers. These efforts have improved the accuracy, diminished false alarms, and enabled more adept identification and detection of DDoS attacks. Nevertheless, the persistent challenge lies in formulating an effective feature selection mechanism and an advanced detection model. In this research, we are going to develop a hybrid DL model, augmented with a novel hybrid feature selection mechanism. Furthermore, this work uses a real dataset, which accurately reflects the reality of the SDN environment, to be tested and trained on the proposed approach.

3. Methodology

The methodology utilized in this research is depicted in Figure 2 and it includes several stages: 1) Data pre-processing: This stage is centered on preparing the data for analysis, including cleaning, handling missing values, and normalization. 2) Hybrid feature selection: It combines filter feature selection methods (mutual information, chi-squared, and ANOVA) with the self-attention mechanism, and it demonstrates the procedure of choosing the most pertinent features from the data. 3) Attack detection model: This stage employs parallel 1D CNN-GRU to identify DDoS attacks.

3.1. Dataset

In this research, we used the "DDOS attack SDN Dataset" [31] a publicly available resource developed within the SDN environment. It is openly available to researchers for application in ML and DL studies. The dataset was produced by leveraging the Mininet emulator, 10 topologies have been proposed, where the switches are linked to a singular Ryu controller. The dataset was generated using network simulations.

3.2. Data Pre-Processing

In any ML process, effective data preprocessing is a crucial step [32]. It plays a vital function in ensuring the quality and dependability of the data since low-quality data can adversely affect the learning process and model efficiency. Its primary goal is to mitigate unforeseen behaviors throughout the learning process, ultimately bolstering the efficiency of the ML algorithm [33]. The techniques that have been employed in data preprocessing are depicted below:

• Handling missing and null values: In this study, we implemented a statistical imputation approach, wherein missing values which number of 506 were filled with the mean value corresponding to the respective feature [34].
• Handling duplicated rows: In this study, 5091 duplicate entries were handled by their removal to avoid inaccurate or biased results.
• Data transformation: In this work, a one-hot encoding technique is employed to convert categorical data kinds into numerical data kinds. This method guarantees an accurate representation of categorical data, enabling the detection model to process the data without bias or errors.
• Data normalization: Machine learning standardizing numerical attributes to a uniform scale is known as data normalization [35]. This practice is crucial in the ML process to mitigate bias towards dominant features. In the conducted research, min-max normalization was utilized to transform each numerical feature value into a range between [0, 1] as illustrated in (1).

$$x^n={\displaystyle \frac{x-min}{max-min}}$$

(1)

Where $x^n$represents the normalized value of $x$ within the interval [min, max].

3.3. Hybrid Feature Selection

This section discusses the filter feature selection mechanism that have been employed, as well as describes the self-attention mechanism. Moreover, it presents an innovative proposed hybrid feature selection. It shows the mechanism of computing the traditional feature set utilizing the filter feature selection techniques and the mechanism of selecting the final feature set using the self-attention mechanism.

3.3.1. Filter Feature Selection

Filter feature selection utilizes statistical metrics to assess the interdependence or correlation among features, allowing for the filtration of the most informative ones. In this research, three distinct filter feature selection methods are employed, namely: 1) mutual information, 2) chi-squared, and 3) analysis of variance feature selection. It is worth mentioning that these methods have proven their efficiency within the field of intrusion detection systems in many studies [6,36,37,38].

3.3.1.1. Mutual Information

Data mutual information (MI) refers to the degree of knowledge that a random variable possesses about another random variable [39]. Mutual information operates by diminishing the uncertainty linked to determining the class attribute when the feature's value is unknown [40], and it relies on information theory principles, employed to rank and pick key features, thereby reducing the feature number prior to the commencement of the learning process. Increased mutual information between two features signifies a higher level of importance.

3.3.1.2. Chi-Squared

It is a statistical method employed for testing the independence of two variables, quantifying a score that gauges the degree of independence from one another. Within feature selection, chi-squared assesses the independence of features concerning the class. chi-square starts with the presumption that the feature and the class are independent prior to the score computation. A high-value score signifies a significant dependency relationship [37].

3.3.1.3. Analysis of Variance (ANOVA)

ANOVA stands as a renowned statistical way for comparing multiple independent means. This approach assesses features by computing the ratio of variances across and within groups [41]. In this work, ANOVA was utilized to evaluate and rank the features based on their statistical significance in detecting DDoS attacks. ANOVA helps to enhance the model's efficiency by concentrating on the most important data and decreasing the noise.

3.3.2. Self-Attention Mechanism

The attention mechanism is modeled after the way the human brain processes attention. When viewing images, people don't scrutinize every detail; rather, they concentrate on specific key areas of the image while disregarding less important parts [42]. In DL, the attention mechanism functions to quantitatively assess the level of focus across various system components. This concept was first introduced in the realm of image research during the mid-1990s. The increased emphasis on attention mechanisms is largely due to the Google DeepMind team, who integrated these mechanisms into recurrent neural networks (RNNs) for image recognition studies [43]. Bahdanau et al. [44] were the first to introduce the attention mechanism in the domain of natural language processing (NLP). Their work aimed to address the bottleneck issue that can arise from handling long sequences in automated language translation.

The notion of self-attention was first proposed by Cheng et al. in 2016 [45]. In the introduced model, a self-attention mechanism is employed to calculate attention scores, emphasizing the significance of each input feature. This mechanism derives the attention score using queries (Q), keys (K), and values (V). The computations for Q, K, and V are carried out using formula (2), formula (3), and formula (4), respectively:

$$Q=W_q\cdot X$$

(2)

$$K=W_k\cdot X$$

(3)

$$V=W_v\cdot X$$

(4)

Where X stands for the input, and W denotes the learning weight. The attention score (AS) is computed utilizing formula (5), where d_qrepresents the length of Q. Following this, the attention value (AV) is determined using formula (6).

$$A_s={\displaystyle \frac{Q\cdot K^T}{\sqrt{d_q}}}$$

(5)

$$A_v=\mathit{softmax}{A}_s\cdot V$$

(6)

3.3.3. Proposed Hybrid Feature Selection

The introduced hybrid feature selection combines filter feature selection techniques with the self-attention mechanism. This approach effectively identifies the most important features for DDoS attack identification in SDN environments. Algorithm 1 presented in Figure 3 describes this approach, where the inputs are feature set, as shown in formula (7), the class, as shown in formula (8), filter method (MI, Chi-squared, and ANOVA), the output is the f_attention_features.

$${\mathrm{f}}_{\mathrm{i}}=\{{\mathrm{f}}_1,{\mathrm{f}}_2,\dots ,{\mathrm{f}}_{22}\}$$

(7)

$${\mathrm{C}}_{\mathrm{i}}=\{{\mathrm{c}}_1,{\mathrm{c}}_2\}$$

(8)

Where the f_i represents the feature set, and C_i denotes the class (normal or attack).

The hybrid feature selection method comprises two main modules: the application of filtering techniques and the implementation of a self-attention mechanism. Three filter-based feature selection techniques (mutual information, chi-squared, and ANOVA) were employed to compute feature importance scores depending on the relationship between each attribute and the goal variable. Each filtering technique selected the top 10 features, resulting in three distinct sets: ${\mathrm{f}}_{\mathrm{mi}}^{\prime }$, ${\mathrm{f}}_{\mathrm{chi}}^{\prime }$, and ${\mathrm{f}}_{\mathrm{anova}}^{\prime }$. The combined feature set, denoted as f _traditional, was computed using a union of the selected features from each technique. This combined feature set was then employed as input for the subsequent attention mechanism.

A custom self-attention layer was implemented, as illustrated in Figure 4, to further refine the combined feature set by assigning attention scores to each feature based on its relevance to the target variable. The structure of the attention model, illustrated in Figure 5, contained of several dense layers with ReLU activation functions. The outcome of the attention layer was then routed via additional dense layers to generate the final feature vector.

The attention model was trained using the combined feature set (f _traditional), with the adam optimizer and the binary cross-entropy loss function. The training process ran for 100 epochs with a batch size of 128, and a validation split of 0.2 was applied to measure the model's efficiency during training. Following training, the features were ranked by the attention model according to their attention scores. The final feature set (f_attention_features) was created by choosing features with high attention scores. This condensed feature set reflects the most significant attributes for DDoS attack detection.

3.4. DDoS Attack Detection Model Based on Parallel 1D CNN-GRU

In this work, we introduce a hybrid DL technique (1D CNN-GRU) designed to identify DDoS attacks in SDN. This approach integrates the 1D CNN and GRU algorithms to leverage their complementary strengths. We employ the 1D CNN model since it is an efficient technique for identifying patterns in sequential data, such as network traffic, making it particularly suitable for capturing spatial features that may indicate abnormal behaviors associated with DDoS attacks. On the other hand, the GRU is especially efficient at modeling temporal dependencies, which is crucial for analyzing sequences of network events over time. By combining these two models, our hybrid architecture is well-equipped to identify DDoS attacks in SDN environments, providing both excellent accuracy and robustness in the classification process.

Convolutional Neural Networks (CNNs) have shown exceptional results across multiple areas, like computer vision, speech recognition, intrusion detection systems, and NLP [46,47]. In this study, we utilize the 1D CNN algorithm since it is an effective technique for identifying patterns in sequential data, such as network traffic. The CNN model typically comprises five components: the input layer, convolutional layer, pooling layer, fully connected layer, and output layer. Figure 6 illustrates the CCN model components in the schematic representation of a DDoS attack detection system.

The Gated Recurrent Unit (GRU) is a kind of recurrent neural network that is more straightforward than the LSTM structure because it lacks a memory cell [48]. GRU provides a lower computational cost while maintaining performance similar to LSTM. The GRU architecture includes two key components: the update gate and the reset gate [49]. The update gate regulates which previous data should be retained or discarded to align with the current prediction needs. Meanwhile, the reset gate determines the quantity of data that is required to be remembered. The GRU gates and activation function are defined as illustrated in (9), (10), (11), and (12).

$$r_t=sigm(W_{xr}{x}_t+W_{hr}{h}_{t-1}+b_r)$$

(9)

$$z_t=sigm(W_{xz}{x}_t+W_{hz}{h}_{t-1}+b_z)$$

(10)

$$\overline{h_t}=tanh(W_{xh}{x}_t+W_{hh}(r_t\odot h_{t-1}\left)\right)+b_h)$$

(11)

$$h_t=z_t\odot h_{t-1}+(1-z_t\odot \overline{h_t})$$

(12)

In these formulas, $x_t$ represents the input vector, while $r_t$ and $z_t$ denote the output vectors of the update gate and the reset gate. The term b refers to the biases, and W represents the weights. The activation functions are defined by sigm for the sigmoid function and tanh for the tangent function. Figure 7 illustrates the structure of GRU.

Figure 8 shows the proposed architecture of the parallel 1D CNN-GRU technique, where the input layer comprises the f_attention_features subset. The model employs a parallel combination of a 1D CNN and a GRU. The 1D CNN is responsible for capturing spatial and local patterns within the data, effectively identifying intricate details, while the GRU is developed to capture temporal dependencies, thereby understanding sequential patterns over time. By operating these two components in parallel, rather than sequentially, the architecture ensures comprehensive extraction and integration of both spatial and temporal features. This parallel approach mitigates the risk of feature loss, which is a common issue when CNNs are used for feature extraction, as observed in previous studies [50]. Furthermore, this design contributes to maintaining the introduced model's high accuracy and low false alarm rate, ensuring robust performance in identifying DDoS attacks within SDN networks.

3.5. Performance Metrics

For evaluating the efficiency of our presented technique, we employed widely used evaluation criteria generally used in ML and DL model assessment [6,16,18,19], including accuracy, precision, false positive rate (FPR), and F1-measure as presented in (13), (14), (15), and (16).

$$\mathrm{A}\mathrm{c}\mathrm{c}\mathrm{u}\mathrm{r}\mathrm{a}\mathrm{c}\mathrm{y}={\displaystyle \frac{\mathrm{T}\mathrm{P}+\mathrm{T}\mathrm{N}}{\mathrm{T}\mathrm{P}+\mathrm{T}\mathrm{N}+\mathrm{F}\mathrm{P}+\mathrm{F}\mathrm{N}}}$$

(13)

$$\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}={\displaystyle \frac{\mathrm{T}\mathrm{P}}{\mathrm{T}\mathrm{P}+\mathrm{F}\mathrm{P}}}$$

(14)

$$\mathrm{F}\mathrm{P}\mathrm{R}={\displaystyle \frac{\mathrm{F}\mathrm{P}}{\mathrm{T}\mathrm{N}+\mathrm{F}\mathrm{P}}}$$

(15)

$$\mathrm{F}1\mathrm{M}\mathrm{e}\mathrm{a}\mathrm{s}\mathrm{u}\mathrm{r}\mathrm{e}=2\times \left({\displaystyle \frac{\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}\times \mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}}{\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}+\mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}}}\right)$$

(16)

Where TP is True Positive, TN for True Negative, FP for False Positive, FN for False Negative.

4. Results and Discussion

4.1. Results of the Hybrid Feature Selection Approach

This section illustrates the final feature set that was chosen by the suggested hybrid feature selection technique, determining the most crucial features for DDoS attack recognition in SDN infrastructures. The dataset contains 22 features, denoted as ${\mathrm{f}}_{\mathrm{i}}$ which are stated below:

[Dt, Switch, Src, Dst, Pktcount, Bytecount, Dur, Dur_Nsec, Tot_Dur, Flows, Packetins, Pktperflow, Byteperflow, Pktrate, Pairflow, Protocol, Port_No, Tx_Bytes, Rx_Bytes, Tx_Kbps, Rx_Kbps, Tot_Kbps]

The hybrid feature selection technique blends the filter feature selection techniques with the self-attention mechanism. Three filter-based feature selection techniques (mutual information, chi-squared, and ANOVA) were employed to compute feature importance scores depending on the relationship between each attribute and the goal variable. Each filtering technique selected the top 10 features, denoted as ${\mathrm{f}}_{\mathrm{m}\mathrm{i}}^{\prime }$, ${\mathrm{f}}_{\mathrm{c}\mathrm{h}\mathrm{i}}^{\prime }$, and ${\mathrm{f}}_{\mathrm{a}\mathrm{n}\mathrm{o}\mathrm{v}\mathrm{a}}^{\prime }$, respectively. The combined feature set, denoted as f _traditional, was computed using a union of the selected features from each technique. This combined feature set was then employed as input for the subsequent attention mechanism.

The top 10 features chosen by mutual information are represented as ${\mathrm{f}}_{\mathrm{m}\mathrm{i}}^{\prime }$, and the output is as follows:

${\mathrm{f}}_{\mathrm{m}\mathrm{i}}^{\prime }$ = [Bytecount, Pairflow, Dt, Dur, Dur_Nsec, Pktcount, Pktperflow, Pktrate, Tot_Dur, Tx_Bytes]

The top 10 features chosen by chi-squared are represented as ${\mathrm{f}}_{\mathrm{c}\mathrm{h}\mathrm{i}}^{\prime }$, and the output is as follows:

${\mathrm{f}}_{\mathrm{c}\mathrm{h}\mathrm{i}}^{\prime }$ = [Dt, Bytecount, Dur, Flows, Pktcount, Protocol, Rx_Bytes, Src, Switch, Tot_Dur]

The top 10 features chosen by ANOVA are represented as ${\mathrm{f}}_{\mathrm{a}\mathrm{n}\mathrm{o}\mathrm{v}\mathrm{a}}^{\prime }$ , and the output is as follows:

${\mathrm{f}}_{\mathrm{a}\mathrm{n}\mathrm{o}\mathrm{v}\mathrm{a}}^{\prime }$ = [Bytecount, Dt, Dur, Flows, Pktcount, Pktperflow, Pktrate, Protocol, Src, Tot_Dur]

The combined feature set f _traditional is computed using a union of the selected features from each technique (${\mathrm{f}}_{\mathrm{m}\mathrm{i}}^{\prime }$, ${\mathrm{f}}_{\mathrm{c}\mathrm{h}\mathrm{i}}^{\prime }$, and ${\mathrm{f}}_{\mathrm{a}\mathrm{n}\mathrm{o}\mathrm{v}\mathrm{a}}^{\prime }$), and the result is as follows:

f _traditional = [Bytecount, Dt, Dur, Pktcount, Tot_Dur, Pairflow, Flows, Pktperflow, Pktrate, Protocol, Src, Rx_Bytes, Switch, Tx_Bytes, Dur_Nsec]

This combined feature set was then employed to train a self-attention-based model. The attention mechanism assigned importance scores to each feature, ranking them accordingly. Figure 9 show the features and their corresponding attention scores in descending order.

It is noted from the Figure the Bytecount feature has the highest attention score (0.884388), whereas the Dur_Nsec feature has the lowest attention score (0.0071484). In our model, we selected features with attention scores greater than 0.1. The final selected features, denoted as f_attention_features, are as follows:

f_attention_features = [Bytecount, Pktcount, Dur, Tot_Dur, Protocol]

As a result, the number of features was declined from 22 to 5. This decrease proves the efficiency of the hybrid feature selection technique in identifying the most crucial features for DDoS attack recognition.

4.2. Performance Evaluation of the Proposed Hybrid Feature Selection Method

To validate the effectiveness of the suggested hybrid feature selection method, we ran an experiment to compare its performance with individual traditional feature selection approaches: mutual information, chi-squared, and ANOVA. The results, as shown in Table 2 highlight the substantial improvements brought by the hybrid approach. The hybrid feature selection method attained an accuracy of 97.882%, notably surpassing the accuracy of mutual information (94.59%), chi-squared (94.21%), and ANOVA (93.6%). The precision metric also shows significant improvements. The hybrid method achieved a precision of 98.078%, which is notably higher than that of mutual information (89.2%), chi-squared (89.15%), and ANOVA (95.47%). The F1-Measure is also highest for the hybrid method at 97.276%. This surpasses the F1-Measure achieved by mutual information (93.4%), chi-squared (92.89%), and ANOVA (91.46%). The hybrid method achieved an FPR of 1.208%, significantly lower than the FPRs of mutual information (7.59%), chi-squared (7.49%), and ANOVA (2.66%). Overall, the proposed hybrid feature selection mechanism greatly enhances the model's efficiency across all key metrics compared to using individual feature selection techniques, demonstrates the hybrid method's ability to pick the most important features more effectively than any single method alone. Figure 10 depicts the comparison between the performance of individual traditional feature selection techniques and the proposed hybrid approach.

4.3. Performance Comparison with other ML and DL Models

Table 3 depicts the outcomes of the suggested detection technique 1D CNN-GRU on the basis of accuracy, precision, F1 measure, and FPR based on five separate runtimes. The model demonstrates stable performance across multiple runs, with an average accuracy of 97.882%, an average precision of 98.078%, an F1-measure of 97.276%, and an FPR of 1.208%. The average detection time is 1.206 seconds, indicating the efficiency of the technique in identifying DDoS attacks. Figure 11 shows the performance metric of the suggested technique.

Table 4 describes the efficiency comparison between the suggested 1D CNN-GRU technique (with hybrid feature selection) and other ML and DL algorithms, including Logistic Regression (LR), SVM, LSTM, 1D CNN, GRU, and the non-hybrid version of the 1D CNN-GRU model. The hybrid feature selection combined with the 1D CNN-GRU technique shows superior efficiency compared to the other models. LR has the lowest efficiency, with an accuracy of 70.95% and a high FPR of 35.92%. SVM achieves a better performance than LR but still falls short with a 24.48% FPR and an extremely high detection time of 174.029 seconds, making it impractical for real-time detection. The LSTM model performs well, with an accuracy of 91.43% and an F1-measure of 85.64%, but its FPR of 5.03% is still significantly higher than the proposed model. 1D CNN achieves a better balance between accuracy (93.4%) and FPR (4.66%), but the proposed model outperforms it in all metrics. The hybrid 1D CNN-GRU model significantly improves the results, reaching 97.882% accuracy, 98.078% precision, 97.276% F1-measure, and the lowest FPR of 1.208%. Additionally, the detection time of 1.206 seconds is much more efficient than many traditional models.

These results demonstrate the significant advantages of combining 1D CNN and GRU for identifying DDoS attacks. The 1D CNN technique is particularly effective at identifying patterns in sequential data, like network traffic, making it well-suited for capturing spatial features that may indicate abnormal behaviors associated with DDoS attacks. GRU, on the other hand, excels at modeling temporal dependencies, which is critical for analyzing sequences of network events over time. By merging these two models, the hybrid 1D CNN-GRU architecture is well-equipped to identify DDoS attacks in SDN networks, offering both high accuracy and robustness in classification. The proposed hybrid feature selection further boosts the model's efficiency by combining traditional feature selection mechanisms with a self-attention technique. This approach enables the model to concentrate on the most relevant features, boosting both accuracy and generalization. By picking the most significant features and integrating them with the pattern recognition powers of 1D CNN and the temporal modeling strengths of GRU, the proposed detection model delivers both superior performance and computational efficiency. These outcomes demonstrate that integrating hybrid feature selection with the 1D CNN-GRU architecture substantially improves both detection performance and efficiency compared to other ML and DL models.

This study performs a comparative analysis of the introduced method utilized herein with established cutting-edge techniques. Table 5 furnishes a thorough comparison, encompassing key metrics such as the proposed approach, the dataset type, detection accuracy, precision, FPR, F-measure, and detection time. According to the comparing presented in Table 5, our proposed approach demonstrated outstanding efficiency, achieving a detection accuracy of 97.882%, precision of 98.078%, FPR of 1.208%, F-measure of 97.276%, and a detection time of 1.206 seconds. In contrast, the strategy introduced in [6] exhibited lower outcomes, recording an accuracy of 94.186%, a precision of 92.146%, a FPR of 8.114%, an F-measure of 94.276%, and a detection time of 1.627 seconds. Furthermore, the approach in [18] obtained inferior results, featuring a detection accuracy of 91.976%, precision of 91.772%, FPR of 8.138%, F-measure of 91.932%, and a detection time of 1.618 seconds. Moreover, the suggested technique in [19] proven relatively lower efficiency, recording a detection accuracy of 93.203%, precision of 88.472%, FPR of 12.746%, F-measure of 93.546%, and a detection time of 1.681 seconds. The exceptional efficiency of our introduced methodology can be attributed to the both efficacy of the innovative hybrid feature selection mechanism and to the advanced 1D CNN-GRU detection technique. The hybrid feature selection mechanism enhances the model efficiency by picking the most vital features and integrating them with the pattern recognition powers of 1D CNN and the temporal modeling strengths of GRU. Our approach surpassed other methods detailed in the aforementioned table, excelling across various metrics like detection accuracy, precision, FPR, F-measure, and detection time. This emphasizes the efficiency and efficacy of our method in successfully identifying DDoS attacks.

5. Conclusions

This paper presents an advanced approach to identify DDoS attacks on SDN controllers employing a hybrid deep learning technique, 1D CNN-GRU, augmented with a novel hybrid feature selection approach. The hybrid feature selection approach merges three filter-based feature selection techniques (mutual information, chi-squared, and ANOVA) with a self-attention mechanism to refine the most pertinent features. By utilizing the complementary power of GRU for temporal dependency modeling and 1D CNN for spatial pattern recognition, the suggested detection model shows superior performance compared to existing methods. it showcased high levels of accuracy (97.882%), precision of (98.078%), and F1-measure of (97.276%). In addition, it registered low FPR of 1.208% and detection time of 1.206 seconds. These results indicate the efficacy of the developed methodology to detect real-time DDoS attacks in SDN networks. Beyond its technical efficacy, the findings of the work hold important implications for enhancing the security of SDN architecture. The incorporation of hybrid feature selection not only increases identification efficacy but also improves computational efficiency, thus making the technique scalable to large data sets and more sophisticated network settings.

Although the work has positive outcomes, it has some limitations. The work was carried out on a single dataset, and this might restrict the generalizability of the outcomes. In our future research studies, we shall assess the suggested method on different datasets typical of the SDN environment for model generalization purposes. Moreover, extending this approach in an attempt to identify other types of network attacks. Finally, researching the integration of ensemble models or other feature selection methods might also bring additional performance improvements. This work contributes to scientific research and practical cybersecurity solutions by offering a strong and efficient framework for DDoS attack identifying in SDN. The results open the door to further advancement of secure SDN solutions by embracing the realization of the need to integrate innovative feature selection methods with hybrid deep learning architectures.