{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T20:33:04Z","timestamp":1782937984701,"version":"3.54.5"},"reference-count":50,"publisher":"MDPI AG","issue":"13","license":[{"start":{"date-parts":[[2023,7,5]],"date-time":"2023-07-05T00:00:00Z","timestamp":1688515200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Natural Science Foundation of Hebei Province, China","award":["F2019201427"],"award-info":[{"award-number":["F2019201427"]}]},{"name":"National Natural Science Foundation of Hebei Province, China","award":["2017A20004"],"award-info":[{"award-number":["2017A20004"]}]},{"name":"Fund for Integration of Cloud Computing and Big Data, Innovation of Science and Education (FII) of Ministry of Education of China","award":["F2019201427"],"award-info":[{"award-number":["F2019201427"]}]},{"name":"Fund for Integration of Cloud Computing and Big Data, Innovation of Science and Education (FII) of Ministry of Education of China","award":["2017A20004"],"award-info":[{"award-number":["2017A20004"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Distributed denial-of-service (DDoS) attacks pose a significant cybersecurity threat to software-defined networks (SDNs). This paper proposes a feature-engineering- and machine-learning-based approach to detect DDoS attacks in SDNs. First, the CSE-CIC-IDS2018 dataset was cleaned and normalized, and the optimal feature subset was found using an improved binary grey wolf optimization algorithm. Next, the optimal feature subset was trained and tested in Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbor (k-NN), Decision Tree, and XGBoost machine learning algorithms, from which the best classifier was selected for DDoS attack detection and deployed in the SDN controller. The results show that RF performs best when compared across several performance metrics (e.g., accuracy, precision, recall, F1 and AUC values). We also explore the comparison between different models and algorithms. The results show that our proposed method performed the best and can effectively detect and identify DDoS attacks in SDNs, providing a new idea and solution for the security of SDNs.<\/jats:p>","DOI":"10.3390\/s23136176","type":"journal-article","created":{"date-parts":[[2023,7,6]],"date-time":"2023-07-06T00:54:41Z","timestamp":1688604881000},"page":"6176","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":69,"title":["A DDoS Detection Method Based on Feature Engineering and Machine Learning in Software-Defined Networks"],"prefix":"10.3390","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7466-4622","authenticated-orcid":false,"given":"Zhenpeng","family":"Liu","sequence":"first","affiliation":[{"name":"School of Electronic Information Engineering, Hebei University, Baoding 071002, China"},{"name":"Information Technology Center, Hebei University, Baoding 071002, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yihang","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Electronic Information Engineering, Hebei University, Baoding 071002, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fan","family":"Feng","sequence":"additional","affiliation":[{"name":"Information Technology Center, Hebei University, Baoding 071002, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yifan","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security and Computer, Hebei University, Baoding 071002, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zelin","family":"Li","sequence":"additional","affiliation":[{"name":"School of Electronic Information Engineering, Hebei University, Baoding 071002, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yawei","family":"Shan","sequence":"additional","affiliation":[{"name":"School of Electronic Information Engineering, Hebei University, Baoding 071002, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,7,5]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"69680","DOI":"10.1109\/ACCESS.2021.3078065","article-title":"An Efficient IDS Framework for DDoS Attacks in SDN Environment","volume":"9","author":"Varghese","year":"2021","journal-title":"IEEE Access"},{"key":"ref_2","unstructured":"Wu, Q., Shi, S., Wan, Z., Fan, Q., Fan, P., and Zhang, C. (2023). Towards V2I Age-aware Fairness Access: A DQN Based Intelligent Vehicular Node Training and Test Method. Chin. J. Electr., in press."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Ashraf, J., Moustafa, N., Bukhshi, A.D., and Javed, A. (2021, January 25\u201329). Intrusion Detection System for SDN-enabled IoT Networks using Machine Learning Techniques. Proceedings of the 2021 IEEE 25th International Enterprise Distributed Object Computing Workshop (EDOCW), Gold Coast, Australia.","DOI":"10.1109\/EDOCW52865.2021.00031"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"13","DOI":"10.23919\/JCC.2019.07.002","article-title":"A Survey: Typical Security Issues of Software-Defined Networking","volume":"16","author":"Liu","year":"2019","journal-title":"China Commun."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Alzahrani, A.O., and Alenazi, M.J.F. (2021). Designing a Network Intrusion Detection System Based on Machine Learning for Software Defined Networks. Future Internet, 13.","DOI":"10.3390\/fi13050111"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"1095","DOI":"10.3390\/sym14061095","article-title":"Machine-Learning-Based DDoS Attack Detection Using Mutual Information and Random Forest Feature Importance Method","volume":"14","author":"Mona","year":"2022","journal-title":"Symmetry"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"3969","DOI":"10.3233\/JIFS-190159","article-title":"Distributed denial of service attack detection using autoencoder and deep neural networks","volume":"37","author":"Catak","year":"2019","journal-title":"J. Intell. Fuzzy Syst."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Ali, T.E., Chong, Y.-W., and Manickam, S. (2023). Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review. Appl. Sci., 13.","DOI":"10.3390\/app13053183"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"9768","DOI":"10.1007\/s10489-021-02968-1","article-title":"A tree-based stacking ensemble technique with feature selection for network intrusion detection","volume":"52","author":"Rashid","year":"2022","journal-title":"Appl. Intell."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"323","DOI":"10.1007\/s41315-022-00224-4","article-title":"Optimal feature selection with CNN-feature learning for DDoS attack detection using meta-heuristic-based LSTM","volume":"6","author":"Dora","year":"2022","journal-title":"Int. J. Intell. Robot. Appl."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Sharma, B., Sharma, L., and Lal, C. (2022, January 29\u201330). Feature Selection and Deep Learning Technique for Intrusion Detection System in IoT. Proceedings of the International Conference on Computational Intelligence, Pune, India.","DOI":"10.1007\/978-981-16-3802-2_21"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"2","DOI":"10.1145\/3138808.3138810","article-title":"Knowledge-Defined Networking","volume":"47","author":"Mestres","year":"2017","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"685","DOI":"10.1007\/s12525-021-00475-2","article-title":"Machine learning and deep learning","volume":"31","author":"Janiesch","year":"2021","journal-title":"Electron. Mark."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Polat, H., Polat, O., and Cetin, A. (2020). Detecting DDoS Attacks in Software-Defined Networks Through Feature Selection Methods and Machine Learning Models. Sustainability, 12.","DOI":"10.3390\/su12031035"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"63844","DOI":"10.1109\/ACCESS.2022.3182818","article-title":"Application Layer DDoS Attack Detection Using Cuckoo Search Algorithm-Trained Radial Basis Function","volume":"10","author":"Beitollahi","year":"2022","journal-title":"IEEE Access"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"229","DOI":"10.1007\/s11235-022-00981-4","article-title":"Defensive mechanism against DDoS attack based on feature selection and multi-classifier algorithms","volume":"82","author":"Mishra","year":"2023","journal-title":"Telecommun. Syst."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"761","DOI":"10.1007\/s10207-019-00434-1","article-title":"DDoS attack detection with feature engineering and machine learning: The framework and performance evaluation","volume":"18","author":"Aamir","year":"2019","journal-title":"Int. J. Inf. Secur."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"104412","DOI":"10.1016\/j.micpro.2021.104412","article-title":"An optimized weighted voting based ensemble model for DDoS attack detection and mitigation in SDN environment","volume":"89","author":"Maheshwari","year":"2022","journal-title":"Microprocess. Microsyst."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"102748","DOI":"10.1016\/j.cose.2022.102748","article-title":"A new DDoS attacks intrusion detection model based on deep learning for cybersecurity","volume":"118","author":"Akgun","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"32150","DOI":"10.1109\/ACCESS.2020.2973219","article-title":"Increasing the Performance of Machine Learning-Based IDSs on an Imbalanced and Up-to-Date Dataset","volume":"8","author":"Karatas","year":"2020","journal-title":"IEEE Access"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"116748","DOI":"10.1016\/j.eswa.2022.116748","article-title":"A novel approach for accurate detection of the DDoS attacks in SDN-based SCADA systems based on deep recurrent neural networks","volume":"197","author":"Polat","year":"2022","journal-title":"Expert Syst. Appl."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"2553","DOI":"10.32604\/csse.2023.032078","article-title":"A Novel Framework for DDoS Attacks Detection Using Hybrid LSTM Techniques","volume":"45","author":"Thangasamy","year":"2023","journal-title":"Comput. Syst. Sci. Eng."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"163","DOI":"10.1007\/s11280-022-01040-3","article-title":"A novel feature-based framework enabling multi-type DDoS attacks detection","volume":"26","author":"Zhou","year":"2023","journal-title":"World Wide Web"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"4268","DOI":"10.1007\/s10489-022-03565-6","article-title":"A framework to detect DDoS attack in Ryu controller based software defined networks using feature extraction and classification","volume":"53","author":"Chouhan","year":"2023","journal-title":"Appl. Intell."},{"key":"ref_25","first-page":"5039","article-title":"DDoS Attack Detection Method Based on Improved KNN With the Degree of DDoS Attack in Software-Defined Networks","volume":"8","author":"Shi","year":"2019","journal-title":"IEEE Access"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"103108","DOI":"10.1016\/j.jnca.2021.103108","article-title":"Automated DDOS attack detection in software defined networking","volume":"187","author":"Ahuja","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"46","DOI":"10.1016\/j.advengsoft.2013.12.007","article-title":"Grey Wolf Optimizer","volume":"69","author":"Mirjalili","year":"2014","journal-title":"Adv. Eng. Softw."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"39496","DOI":"10.1109\/ACCESS.2019.2906757","article-title":"Binary Optimization Using Hybrid Grey Wolf Optimization for Feature Selection","volume":"7","author":"Kadir","year":"2019","journal-title":"IEEE Access"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"371","DOI":"10.1016\/j.neucom.2015.06.083","article-title":"Binary grey wolf optimization approaches for feature selection","volume":"172","author":"Emary","year":"2016","journal-title":"Neurocomputing"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"16062","DOI":"10.1109\/ACCESS.2021.3051074","article-title":"Deep Belief Network Integrating Improved Kernel-Based Extreme Learning Machine for Network Intrusion Detection","volume":"9","author":"Wang","year":"2021","journal-title":"IEEE Access"},{"key":"ref_31","first-page":"659","article-title":"A survey of intrusion detection from the perspective of intrusion datasets and machine learning techniques","volume":"44","author":"Singh","year":"2022","journal-title":"Int. J. Comput. Appl."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"353","DOI":"10.1007\/s12293-017-0247-0","article-title":"CBSO: A memetic brain storm optimization with chaotic local search","volume":"10","author":"Yu","year":"2018","journal-title":"Memetic Comput."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"110031","DOI":"10.1016\/j.asoc.2023.110031","article-title":"A high-dimensional feature selection method based on modified Gray Wolf Optimization","volume":"135","author":"Pan","year":"2023","journal-title":"Appl. Soft Comput."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"107706","DOI":"10.1016\/j.compeleceng.2022.107706","article-title":"A survey on DoS\/DDoS mitigation techniques in SDNs: Classification, comparison, solutions, testing tools and datasets","volume":"99","author":"Alhijawi","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Idris, S., Ishaq, O.O., and Juliana, N.N. (2019, January 14\u201317). Intrusion Detection System Based on Support Vector Machine Optimised with Cat Swarm Optimization Algorithm. Proceedings of the 2019 2nd International Conference of the IEEE Nigeria Computer Chapter (NigeriaComputConf), Zaria, Nigeria.","DOI":"10.1109\/NigeriaComputConf45974.2019.8949676"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1016\/j.cose.2019.05.022","article-title":"A novel approach to intrusion detection using SVM ensemble with feature augmentation","volume":"86","author":"Gu","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Manghnani, T., and Thirumaran, T. (2019, January 22\u201324). Computational CBGSA\u2014SVM Model for Network Based Intrusion Detection System. Proceedings of the International Conference on Applications and Techniques in Information Security, Tamil Nadu, India.","DOI":"10.1007\/978-981-15-0871-4_14"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"103026","DOI":"10.1016\/j.adhoc.2022.103026","article-title":"RBF-SVM kernel-based model for detecting DDoS attacks in SDN integrated vehicular network","volume":"140","author":"Anyanwu","year":"2023","journal-title":"Ad Hoc Netw."},{"key":"ref_39","first-page":"2317","article-title":"DDoS attack detection using MLP and Random Forest Algorithms","volume":"14","author":"Najar","year":"2022","journal-title":"J. Inf. Technol."},{"key":"ref_40","first-page":"233","article-title":"Performance Evaluation of SDN DDoS Attack Detection and Mitigation Based Random Forest and K-Nearest Neighbors Machine Learning Algorithms","volume":"36","author":"Mohsin","year":"2022","journal-title":"Revue Intell. Artif."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"1353","DOI":"10.1007\/s13369-021-05947-3","article-title":"Analysis of Machine Learning Classifiers for Early Detection of DDoS Attacks on IoT Devices","volume":"47","author":"Gaur","year":"2022","journal-title":"Arab. J. Sci. Eng."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Sridaran, R. (2022). An SDN-based Decision Tree Detection (DTD) Model for Detecting DDoS Attacks in Cloud Environment. Int. J. Adv. Comput. Sci. Appl., 13.","DOI":"10.14569\/IJACSA.2022.0130708"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"e5402","DOI":"10.1002\/cpe.5402","article-title":"Machine learning algorithms to detect DDoS attacks in SDN","volume":"32","author":"Santos","year":"2020","journal-title":"Concurr. Comput."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"194269","DOI":"10.1109\/ACCESS.2020.3033942","article-title":"Bandwidth Control Mechanism and Extreme Gradient Boosting Algorithm for Protecting Software-Defined Networks Against DDoS Attacks","volume":"8","author":"Alamri","year":"2020","journal-title":"IEEE Access"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"21443","DOI":"10.1109\/ACCESS.2022.3152577","article-title":"A Machine Learning-Based Classification and Prediction Technique for DDoS Attacks","volume":"10","author":"Mohmand","year":"2022","journal-title":"IEEE Access"},{"key":"ref_46","first-page":"224","article-title":"A DDoS attack detection method based on SVM and K-nearest neighbour in SDN environment","volume":"23","author":"Ma","year":"2020","journal-title":"Int. J. Comput. Sci. Eng."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"504","DOI":"10.1016\/j.dcan.2020.04.002","article-title":"The detection method of low-rate DoS attack based on multi-feature fusion","volume":"6","author":"Liu","year":"2020","journal-title":"Digit. Commun. Netw."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Chouhan, R.K., Atulkar, M., and Nagwani, N.K. (2019, January 19\u201320). Performance Comparison of Ryu and Floodlight Controllers in Different SDN Topologies. Proceedings of the 2019 1st International Conference on Advanced Technologies in Intelligent Control, Environment, Computing & Communication Engineering (ICATIECE), Bangalore, India.","DOI":"10.1109\/ICATIECE45860.2019.9063806"},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"5178","DOI":"10.1109\/TNNLS.2020.2964585","article-title":"Entropy and Confidence-Based Undersampling Boosting Random Forests for Imbalanced Problems","volume":"31","author":"Wang","year":"2020","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Almomani, O. (2020). A Feature Selection Model for Network Intrusion Detection System Based on PSO, GWO, FFA and GA Algorithms. Symmetry, 12.","DOI":"10.3390\/sym12061046"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/13\/6176\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T20:06:53Z","timestamp":1760126813000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/13\/6176"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,7,5]]},"references-count":50,"journal-issue":{"issue":"13","published-online":{"date-parts":[[2023,7]]}},"alternative-id":["s23136176"],"URL":"https:\/\/doi.org\/10.3390\/s23136176","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,7,5]]}}}