Deployment of a Machine Learning-SDN Pipeline for IoT Threat Detection in Smart City Environments
Antônio Wendell De Oliveira Rodrigues, Francisco Erialdo D. Freitas, Rodrigo Aguiar Rodrigues, Rogério Guerra Diógenes Filho, André Luiz C. De Araújo · 2025
Smart cities rely on IoT systems that require adaptive security against evolving cyber threats. This paper presents a modular architecture combining machine learning (ML) with Software-Defined Networking (SDN) for real-time threat detection and mitigation in MQTT-based LoRaWAN networks. The system uses flow-level features to preserve privacy and enables dynamic policy enforcement via a REST API in the SDN control loop. We evaluate 13 ML models on the UNSW-NB15 dataset, with XGBoost achieving 0.8995 accuracy and 0.9927 AUC. Though based on synthetic data, the solution supports extensibility, SDN portability, and future integration of online and federated learning. Deployment feasibility, performance impact, and scalability are also addressed.