Image-Based Frequency-Domain Analysis for Robust DDoS Detection in SDN

Software-Defined Networking (SDN) enhances network management by offering greater adaptability, flexibility, and scalability. However, its centralized controller is susceptible to Distributed Denial of Service (DDoS) attacks, which can compromise network availability. This study proposes an innovative real-time DDoS detection mechanism integrated into the SDN controller. The approach employs frequency-domain analysis to examine Packet-In messages. A time series is created by sampling the number of Packet-In messages at specific time intervals. This time series is then transformed into one or more images using frequency-domain analysis, enabling the extraction of hidden patterns indicative of DDoS attack traffic. Converting time series data into images allows for multi-scale frequency analysis by adjusting the window size, which helps capture both short-term fluctuations and long-term trends. Additionally, different images obtained from varying window sizes are rescaled to a uniform size with minimal information loss, enhancing the effectiveness of pattern recognition. These frequency-based images, encapsulating both amplitude and phase information, are then utilized by a Convolutional Neural Network (CNN) to detect DDoS attack traffic with improved accuracy.