Enhancing Transparency in DDoS Detection on SDN Using Explainable ML Models
Zobair Raihan, Md Saiful Islam · 2024
Software-Defined Networking (SDN) is a networking approach that allows network administrators to define and manage network behavior through software rather than relying on physical hardware configurations. SDN can be both beneficial and challenging. The benefits include centralized management, automated detection, and efficient mitigation. SDN's programma-bility enables rapid deployment of DDoS defenses and real-time analytics. However, SDN's complexity and dependency on software can make it vulnerable to DDoS attacks. Additionally, SDN's centralized architecture can create a single point of failure, making it crucial to design robust networks and implement proactive security measures. In this research, we aim to address the DDoS attack detection using machine learning-based meth-ods. Our research is conducted on the CIC-DDoS2019 dataset and the result demonstrates that our optimized XGBoost model with chosen hyperparameters surpasses existing models with significant improvements in attack detection, achieving a recall score of 100%. Explainable AI (XAI) techniques were applied to provide insights into the model's decision-making process.