{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,29]],"date-time":"2026-03-29T17:28:52Z","timestamp":1774805332808,"version":"3.50.1"},"reference-count":47,"publisher":"Oxford University Press (OUP)","issue":"10","license":[{"start":{"date-parts":[[2025,4,30]],"date-time":"2025-04-30T00:00:00Z","timestamp":1745971200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/academic.oup.com\/pages\/standard-publication-reuse-rights"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,22]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Software-defined networking (SDN) improves network flexibility by separating the control plane and data plane, but centralized control architecture also increases the risk of distributed denial of service (DDoS) attacks. Traditional detection methods often face performance bottlenecks when dealing with large-scale data. Deep learning, with its powerful automatic feature extraction capabilities, can significantly improve detection accuracy. However, single models typically focus on a specific dimension of network traffic features, neglecting the comprehensive processing of spatial and temporal features. In addition, most existing deep learning methods rely on centralized training, leading to issues such as data transmission delays and privacy breaches. To address these issues, this paper proposes a hybrid model named 1DCNN-TransBiLSTM. The model consists of a spatial feature extraction module based on a 1DCNN and a temporal feature extraction module based on Transformer and BiLSTM. By processing spatial and temporal features in parallel, the model effectively enhances the ability to identify complex attack patterns. Additionally, federated learning is employed to enable multiple SDN controllers to collaborate in training without sharing raw data, and multi-key homomorphic encryption is used to protect the privacy of model gradients. The experimental results show that the model achieves an accuracy of 99.925% and an F1 score of 99.962% on the CICDDoS2019 dataset, outperforming existing machine learning and deep learning methods, demonstrating outstanding performance in DDoS detection in SDN environments.<\/jats:p>","DOI":"10.1093\/comjnl\/bxaf049","type":"journal-article","created":{"date-parts":[[2025,4,11]],"date-time":"2025-04-11T07:41:14Z","timestamp":1744357274000},"page":"1463-1475","source":"Crossref","is-referenced-by-count":4,"title":["A DDoS attack detection method combining federated learning and hybrid deep learning in software-defined networking"],"prefix":"10.1093","volume":"68","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-7717-3469","authenticated-orcid":false,"given":"Qi","family":"Zhou","sequence":"first","affiliation":[{"name":"Department of Computer Science , Taizhou University, No. 1139 Shifu Avenue, Jiaojiang District, Taizhou City, Zhejiang Province 318000, P. R.","place":["China"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7292-020X","authenticated-orcid":false,"given":"Xuechun","family":"Mao","sequence":"additional","affiliation":[{"name":"Department of Computer Science , Taizhou University, No. 1139 Shifu Avenue, Jiaojiang District, Taizhou City, Zhejiang Province 318000, P. R.","place":["China"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9520-3008","authenticated-orcid":false,"given":"Ying","family":"Chen","sequence":"additional","affiliation":[{"name":"Department of Computer Science , Taizhou University, No. 1139 Shifu Avenue, Jiaojiang District, Taizhou City, Zhejiang Province 318000, P. R.","place":["China"]}]}],"member":"286","published-online":{"date-parts":[[2025,4,30]]},"reference":[{"key":"2025102215362783900_ref1","doi-asserted-by":"publisher","first-page":"602","DOI":"10.1109\/COMST.2015.2487361","article-title":"Software-defined networking (SDN) and distributed denial of service (DDoS) attacks in cloud computing environments: a survey, some research issues, and challenges","volume":"18","author":"Yan","year":"2015","journal-title":"IEEE Commun Surv Tutor"},{"key":"2025102215362783900_ref2","doi-asserted-by":"publisher","first-page":"102856","DOI":"10.1016\/j.jnca.2020.102856","article-title":"A comprehensive survey of load balancing techniques in software-defined network","volume":"174","author":"Hamdan","year":"2021","journal-title":"J Netw Comput Appl"},{"key":"2025102215362783900_ref3","volume-title":"2021 26th International Conference on Automation and Computing (ICAC)"},{"key":"2025102215362783900_ref4","article-title":"A denial of service attack against the open floodlight SDN controller","volume":"410","author":"Dover","year":"2013","journal-title":"Research report"},{"key":"2025102215362783900_ref5","doi-asserted-by":"publisher","first-page":"4117","DOI":"10.3390\/s23084117","article-title":"A critical cybersecurity analysis and future research directions for the internet of things: a comprehensive review","volume":"23","author":"Tariq","year":"2023","journal-title":"Sensors"},{"key":"2025102215362783900_ref6","volume-title":"2023 International Conference on Computer, Information and Telecommunication Systems (CITS)"},{"key":"2025102215362783900_ref7","volume-title":"Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security."},{"key":"2025102215362783900_ref8","doi-asserted-by":"publisher","first-page":"107801","DOI":"10.1016\/j.engappai.2023.107801","article-title":"A novel machine learning approach for detecting first-time-appeared malware","volume":"131","author":"Shaukat","year":"2024","journal-title":"Eng Appl Artif Intel"},{"key":"2025102215362783900_ref9","doi-asserted-by":"publisher","first-page":"2509","DOI":"10.3390\/en13102509","article-title":"Performance comparison and current challenges of using machine learning techniques in cybersecurity","volume":"13","author":"Shaukat","year":"2020","journal-title":"Energies"},{"key":"2025102215362783900_ref10","doi-asserted-by":"publisher","first-page":"222310","DOI":"10.1109\/ACCESS.2020.3041951","article-title":"A survey on machine learning techniques for cyber security in the last decade","volume":"8","author":"Shaukat","year":"2020","journal-title":"IEEE Access"},{"key":"2025102215362783900_ref11","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1155\/2022\/4016073","article-title":"Deep learning for intrusion detection and security of internet of things (IoT): current analysis, challenges, and possible solutions","volume":"2022","author":"Khan","year":"2022","journal-title":"Secur Commun Netw"},{"key":"2025102215362783900_ref12","volume-title":"2020 International Conference on Cyber Warfare and Security (ICCWS)"},{"key":"2025102215362783900_ref13","doi-asserted-by":"publisher","first-page":"106030","DOI":"10.1016\/j.engappai.2023.106030","article-title":"A novel deep learning-based approach for malware detection","volume":"122","author":"Shaukat","year":"2023","journal-title":"Eng Appl Artif Intel"},{"key":"2025102215362783900_ref14","doi-asserted-by":"publisher","first-page":"105461","DOI":"10.1016\/j.engappai.2022.105461","article-title":"A novel method for improving the robustness of deep learning-based malware detectors against adversarial attacks","volume":"116","author":"Shaukat","year":"2022","journal-title":"Eng Appl Artif Intel"},{"key":"2025102215362783900_ref15","doi-asserted-by":"publisher","first-page":"14","DOI":"10.3390\/technologies9010014","article-title":"An investigation into the application of deep learning in the detection and mitigation of DDoS attack on SDN controllers","volume":"9","author":"Gadze","year":"2021","journal-title":"Dent Tech"},{"key":"2025102215362783900_ref16","doi-asserted-by":"publisher","first-page":"8162","DOI":"10.3390\/app12168162","article-title":"A survey of CNN-based network intrusion detection","volume":"12","author":"Mohammadpour","year":"2022","journal-title":"Appl Sci"},{"key":"2025102215362783900_ref17","volume-title":"Advances in Information and Communication: Proceedings of the 2021 Future of Information and Communication Conference (FICC)"},{"key":"2025102215362783900_ref18","doi-asserted-by":"publisher","first-page":"9731","DOI":"10.1007\/s00500-021-05893-0","article-title":"Machine learning and deep learning methods for intrusion detection systems: recent developments and challenges","volume":"25","author":"Kocher","year":"2021","journal-title":"Soft Comput"},{"key":"2025102215362783900_ref19","doi-asserted-by":"publisher","first-page":"5111","DOI":"10.1038\/s41598-024-55814-y","article-title":"A novel multi-scale CNN and Bi-LSTM arbitration dense network model for low-rate DDoS attack detection","volume":"14","author":"Yin","year":"2024","journal-title":"Sci Rep"},{"key":"2025102215362783900_ref20","doi-asserted-by":"publisher","first-page":"53972","DOI":"10.1109\/ACCESS.2020.2976908","article-title":"A deep CNN ensemble framework for efficient DDoS attack detection in software defined networks","volume":"8","author":"Haider","year":"2020","journal-title":"IEEE Access"},{"key":"2025102215362783900_ref21","volume-title":"2020 IEEE 21st International Symposium on \u201cA World of Wireless, Mobile and Multimedia Networks\u201d (WoWMoM)"},{"key":"2025102215362783900_ref22","doi-asserted-by":"publisher","first-page":"5790","DOI":"10.1109\/TII.2020.3047675","article-title":"Siamese neural network based few-shot learning for anomaly detection in industrial cyber-physical systems","volume":"17","author":"Zhou","year":"2020","journal-title":"IEEE Trans Industr Inform"},{"key":"2025102215362783900_ref23","volume-title":"2020 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)"},{"key":"2025102215362783900_ref24","doi-asserted-by":"publisher","first-page":"102942","DOI":"10.1016\/j.jnca.2020.102942","article-title":"A GRU deep learning system against attacks in software defined networks","volume":"177","author":"Assis","year":"2021","journal-title":"J Netw Comput Appl"},{"key":"2025102215362783900_ref25","volume-title":"2021 International Conference on Intelligent Technologies (CONIT)"},{"key":"2025102215362783900_ref26","doi-asserted-by":"publisher","first-page":"5615","DOI":"10.1109\/TII.2020.3023430","article-title":"DeepFed: federated deep learning for intrusion detection in industrial cyber\u2013physical systems","volume":"17","author":"Li","year":"2020","journal-title":"IEEE Trans Industr Inform"},{"key":"2025102215362783900_ref27","doi-asserted-by":"publisher","first-page":"4059","DOI":"10.1109\/TII.2021.3088938","article-title":"FLEAM: a federated learning empowered architecture to mitigate DDoS in industrial IoT","volume":"18","author":"Li","year":"2021","journal-title":"IEEE Trans Industr Inform"},{"key":"2025102215362783900_ref28","doi-asserted-by":"publisher","first-page":"923","DOI":"10.32604\/iasc.2022.024668","article-title":"Ensemble deep learning models for mitigating DDoS attack in software-defined network","volume":"33","author":"Alanazi","year":"2022","journal-title":"Intell Autom Soft Comput"},{"key":"2025102215362783900_ref29","doi-asserted-by":"publisher","DOI":"10.14569\/IJACSA.2022.0131141"},{"key":"2025102215362783900_ref30","doi-asserted-by":"publisher","first-page":"2145","DOI":"10.3390\/math11092145","article-title":"Detection of unknown DDoS attack using convolutional neural networks featuring geometrical metric","volume":"11","author":"Shieh","year":"2023","journal-title":"Mathematics"},{"key":"2025102215362783900_ref31","doi-asserted-by":"publisher","first-page":"1431","DOI":"10.3390\/app13031431","article-title":"Low rate DDoS detection using weighted federated learning in SDN control plane in IoT network","volume":"13","author":"Ali","year":"2023","journal-title":"Appl Sci"},{"key":"2025102215362783900_ref32","volume-title":"CNN-BiLSTM: A Hybrid Deep Learning Approach for Network Intrusion Detection System in Software Defined Networking with Hybrid Feature Selection."},{"key":"2025102215362783900_ref33","doi-asserted-by":"publisher","first-page":"101","DOI":"10.1109\/TC.2024.3474180","article-title":"Federated learning based DDoS attacks detection in large scale software-defined network","volume":"74","author":"Fotse","year":"2024","journal-title":"IEEE Trans Comput"},{"key":"2025102215362783900_ref34","doi-asserted-by":"publisher","first-page":"42357","DOI":"10.1109\/ACCESS.2024.3378727","article-title":"Federated learning for decentralized DDoS attack detection in IoT networks","volume":"12","author":"Alhasawi","year":"2024","journal-title":"IEEE Access"},{"key":"2025102215362783900_ref35","volume-title":"Long Short-Term Memory"},{"key":"2025102215362783900_ref36","volume-title":"Attention Is All You Need. Advances in Neural Information Processing Systems"},{"key":"2025102215362783900_ref37","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3460427","article-title":"A comprehensive survey of privacy-preserving federated learning: a taxonomy, review, and future directions","volume":"54","author":"Yin","year":"2021","journal-title":"ACM Comput Surv"},{"key":"2025102215362783900_ref38","doi-asserted-by":"publisher","first-page":"5880","DOI":"10.1002\/int.22818","article-title":"Privacy-preserving federated learning based on multi-key homomorphic encryption","volume":"37","author":"Ma","year":"2022","journal-title":"Int J Intell Syst"},{"key":"2025102215362783900_ref39","volume-title":"2019 International Carnahan Conference on Security Technology (ICCST)."},{"key":"2025102215362783900_ref40","doi-asserted-by":"publisher","first-page":"21","DOI":"10.1016\/j.imavis.2018.04.004","article-title":"Beyond one-hot encoding: lower dimensional target embedding","volume":"75","author":"Rodr\u00edguez","year":"2018","journal-title":"Image Vision Comput"},{"key":"2025102215362783900_ref41","doi-asserted-by":"publisher","first-page":"321","DOI":"10.1613\/jair.953","article-title":"SMOTE: synthetic minority over-sampling technique","volume":"16","author":"Chawla","year":"2002","journal-title":"J Artif Intell Res"},{"key":"2025102215362783900_ref42","volume-title":"Machine Learning"},{"key":"2025102215362783900_ref43","volume-title":"2022 19th Annual International Conference on Privacy, Security & Trust (PST)"},{"key":"2025102215362783900_ref44","doi-asserted-by":"publisher","first-page":"103597","DOI":"10.1016\/j.cose.2023.103597","article-title":"FLAD: adaptive federated learning for DDoS attack detection","volume":"137","author":"Doriguzzi-Corin","year":"2024","journal-title":"Comput Secur"},{"key":"2025102215362783900_ref45","volume-title":"2022 13th International Conference on Information and Communication Technology Convergence (ICTC)."},{"key":"2025102215362783900_ref46","doi-asserted-by":"publisher","first-page":"2420","DOI":"10.1016\/j.procs.2023.01.217","article-title":"DDoS detection using deep learning","volume":"218","author":"Kumar","year":"2023","journal-title":"Procedia Comput Sci"},{"key":"2025102215362783900_ref47","doi-asserted-by":"publisher","DOI":"10.1002\/0470011815.b2a15177"}],"container-title":["The Computer Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/68\/10\/1463\/63030982\/bxaf049.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/68\/10\/1463\/63030982\/bxaf049.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,22]],"date-time":"2025-10-22T19:36:37Z","timestamp":1761161797000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/comjnl\/article\/68\/10\/1463\/8122430"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4,30]]},"references-count":47,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2025,4,30]]},"published-print":{"date-parts":[[2025,10,22]]}},"URL":"https:\/\/doi.org\/10.1093\/comjnl\/bxaf049","relation":{},"ISSN":["0010-4620","1460-2067"],"issn-type":[{"value":"0010-4620","type":"print"},{"value":"1460-2067","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2025,10]]},"published":{"date-parts":[[2025,4,30]]}}}