A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking

• Published in: Sensors (Basel, Switzerland) Vol. 23; no. 9; p. 4441
• Main Authors: Bahashwan, Abdullah Ahmed, Anbar, Mohammed, Manickam, Selvakumar, Al-Amiedy, Taief Alaa, Aladaileh, Mohammad Adnan, Hasbullah, Iznan H
• Format: Journal Article
• Language: English
• Published: Switzerland MDPI AG 01-05-2023; MDPI
• Subjects: Cloud computing; Datasets; Deep learning; deep learning (DL); Denial of service attacks; distributed denial of service (DDoS); Innovations; intrusion detection system (IDS); Literature reviews; Machine learning; machine learning (ML); Software-defined networking; software-defined networking (SDN); Synthetic data; systematic literature review (SLR); Systematic Review; Traffic control; Virtual private networks; distributed denial of service (DDoS); machine learning (ML); intrusion detection system (IDS); systematic literature review (SLR); software-defined networking (SDN); deep learning (DL)
• ISSN: 1424-8220; 1424-8220
• DOI: 10.3390/s23094441

Software-defined networking (SDN) is a revolutionary innovation in network technology with many desirable features, including flexibility and manageability. Despite those advantages, SDN is vulnerable to distributed denial of service (DDoS), which constitutes a significant threat due to its impact on the SDN network. Despite many security approaches to detect DDoS attacks, it remains an open research challenge. Therefore, this study presents a systematic literature review (SLR) to systematically investigate and critically analyze the existing DDoS attack approaches based on machine learning (ML), deep learning (DL), or hybrid approaches published between 2014 and 2022. We followed a predefined SLR protocol in two stages on eight online databases to comprehensively cover relevant studies. The two stages involve automatic and manual searching, resulting in 70 studies being identified as definitive primary studies. The trend indicates that the number of studies on SDN DDoS attacks has increased dramatically in the last few years. The analysis showed that the existing detection approaches primarily utilize ensemble, hybrid, and single ML-DL. Private synthetic datasets, followed by unrealistic datasets, are the most frequently used to evaluate those approaches. In addition, the review argues that the limited literature studies demand additional focus on resolving the remaining challenges and open issues stated in this SLR.