Content area
Organizations increasingly adopt Software Defined Networks (SDN) to mitigate traditional network scalability and management inefficiency. Organizations use SDN’s programmability and instant network instantiation and configuration to meet today's dynamic demand and massive volume of diverse network traffic data flows. However, network security remains a critical issue. SDN's reliance on resource-restrictive devices and centralized architecture significantly increases its distributed denial-of-service (DDoS) attack risk. Also, key issues affecting the network's primary defense, passive and signature-based intrusion detection systems (IDS), are scalability issues resulting from inefficient manual configuration management, high false positive detection rates, and detection inaccuracies. With the growing need to handle massive data volumes and dynamic workloads, industry and research focus continues to shift to using machine learning (ML) and deep learning (DL) technology to mitigate the growing DDoS attack threat. Existing ML-based DDoS detection solutions have proven instrumental in identifying volumetric, hidden attack features and patterns in labeled network flow as malicious or benign, resulting in almost perfect abnormal behavior detection accuracy. However, the current ML-based DDoS attack solutions method experiences numerous challenges stemming from the diverse network traffic flow data, the vast amount of data generated (big data), using a suboptimal critical feature subset, and attack detection inaccuracies. This study focused on advancing the ML/DL knowledge base by examining RFECV's with DL Decision Tree (DT) with Gaussian Naïve Bayes (GNB) performance in detecting infrequent and spurious DDoS attack features in large-volume SDN network traffic flow.