Federated Learning for Low-rate DDoS Detection in Multi-controller Software Defined Networks: A Meta Analysis
DOI:
https://doi.org/10.26636/jtit.2026.2.2552Keywords:
federated learning, intrusion detection systems, low-rate distributed denial-of-service, SDN security, software-defined networkingAbstract
Multi-controller SDN environments suffer from a blind spot when it comes to detecting low-rate DDoS attacks. Each controller sees only its own traffic slice, meaning that an LDDoS campaign looking, at every controller, like background noise is still capable of draining the network. Federated learning (FL) is a reasonable answer to this challenge, due to such controllers sharing model updates rather than raw logs. However, the published literature on FL-based detection is fragmented enough that the results have not been systematically compared up to date.
We analyze 39 papers published between 2020 and 2026. 35 of those reported quantitative results, with the pooled mean detection precision equaling 98.25% (SD ±0.91) and the mean F1 score amounting to 97.98% (SD ±1.10). Federated models averaged an accuracy score of 98.33%, compared to 98.06% for centralized approaches - a 0.27 pp gap that is practically negligible. LSTM and hybrid CNN + RNN architectures ranked the highest in terms of the most metrics. Four aggregation strategies were mentioned repeatedly: weighted aggregation, asynchronous FL, personalized FL, and standard FedAvg.
The widest gap we identified was in the datasets. No available benchmark simultaneously models multi-controller SDN topology, low-rate attack patterns, and heterogeneous traffic distributions across various controllers. Until that changes, high-accuracy scores on CICIDS2017 or CICDDoS2019 should be interpreted with some caution.
Downloads
References
[1] X. Zhou, X. Mao, and Y. Chen, "A DDoS Attack Detection Method Combining Federated Learning and Hybrid Deep Learning in Software Defined Networking", The Computer Journal, vol. 68, pp. 1463-1475, 2025. DOI: https://doi.org/10.1093/comjnl/bxaf049
View in Google Scholar
[2] A. Alhasawi and S. Alghamdi, "Federated Learning for Decentralized DDoS Attack Detection in IoT Networks", IEEE Access, vol. 12, pp. 42357-42368, 2024. DOI: https://doi.org/10.1109/ACCESS.2024.3378727
View in Google Scholar
[3] M. Shamim et al., "A Comparison Study on federated Learning and Centralized Learning-based Intrusion Detection System for Software Defined Networking", 2025 International Technical Conference on Circuits/Systems, Computers, and Communications (ITC-CSCC), Seoul, South Korea, 2025. DOI: https://doi.org/10.1109/ITC-CSCC66376.2025.11137775
View in Google Scholar
[4] Z. Alashhab et al., "Low-rate DDoS Attack Detection Using Deep Learning for SDN Enabled IoT Networks", International Journal of Advanced Computer Science and Applications, vol. 13, 2022. DOI: https://doi.org/10.14569/IJACSA.2022.0131141
View in Google Scholar
[5] Z. Lv et al., "DDoS Attack Detection Based on CNN and Federated Learning", International Conference on Advanced Cloud and Big Data, Xi'an, China, 2022. DOI: https://doi.org/10.1109/CBD54617.2021.00048
View in Google Scholar
[6] V. R et al., "A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security", TechRxiv, 2020.
View in Google Scholar
[7] S. Muthunambu et al., "A Novel Eccentric Intrusion Detection Model Based on Recurrent Neural Networks with Leveraging LSTM", Computers Materials and Continua, vol. 78, pp. 3089-3127, 2024. DOI: https://doi.org/10.32604/cmc.2023.043172
View in Google Scholar
[8] A. Khraisat et al., "Survey on Federated Learning for Intrusion Detection System: Concept, Architectures, Aggregation Strategies, Challenges, and Future Directions", ACM Computing Surveys, vol. 57, pp. 1-38, 2024. DOI: https://doi.org/10.1145/3687124
View in Google Scholar
[9] M. Fan et al., "DDoS Attack Detection in SDN-assisted Federated Learning Environment Based on Contrastive Learning", IEEE Access, vol. 13, pp. 108798-108814, 2025. DOI: https://doi.org/10.1109/ACCESS.2025.3582445
View in Google Scholar
[10] Y. Liu et al., "An Asynchronous Federated Learning Arbitration Model for Low-rate DDoS Attack Detection", IEEE Access, vol. 11, pp. 18448-18460, 2023. DOI: https://doi.org/10.1109/ACCESS.2023.3247512
View in Google Scholar
[11] R. Doriguzzi-Corin and D. Siracusa, "FLAD: Adaptive Federated Learning for DDoS Attack Detection", Computers & Security, vol. 137, art. no. 103597, 2023. DOI: https://doi.org/10.1016/j.cose.2023.103597
View in Google Scholar
[12] Y.S.N. Fotse, V.K. Tchendji, and M. Velempini, "Federated Learning Based DDoS Attacks Detection in Large Scale Software-defined Network", IEEE Transactions on Computers, vol. 74, pp. 101-115, 2024.
View in Google Scholar
[13] A.A. Al-Ameer and W.S. Bhaya, "Intelligent Intrusion Detection Based on Multi Model Federated Learning for Software Defined Network", International Journal of Safety and Security Engineering, vol. 13, pp. 1135-1141, 2023. DOI: https://doi.org/10.18280/ijsse.130617
View in Google Scholar
[14] R. Amin, G. El-Taweel, A. Ali, and M. Tahoun, "A Hybrid Extreme Gradient Boosting and Long Short-term Memory Algorithm for Cyber Threats Detection", Mendel, vol. 29, pp. 307-322, 2023. DOI: https://doi.org/10.13164/mendel.2023.2.307
View in Google Scholar
[15] K. Ramya et al., "An Efficient Infiltration and Denial of Service Detection Using Dynamic Weighted Aggregation Federated Learning", in Recent Trends in Network Security, 2024. DOI: https://doi.org/10.1201/9781003565024-13
View in Google Scholar
[16] N.T. Cam and N.G. Trung, "An Intelligent Approach to Improving the Performance of Threat Detection in IoT", IEEE Access, vol. 11, pp. 44319-44334, 2023. DOI: https://doi.org/10.1109/ACCESS.2023.3273160
View in Google Scholar
[17] J. Malik et al., "Hybrid Deep Learning: An Efficient Reconnaissance and Surveillance Detection Mechanism in SDN", IEEE Access, vol. 8, pp. 134695-134706, 2020. DOI: https://doi.org/10.1109/ACCESS.2020.3009849
View in Google Scholar
[18] M. Moradi et al., "A Multi Agent Adaptive Deep Learning Framework for Online Intrusion Detection", Cybersecurity, vol. 7, art. no. 9, 2024. DOI: https://doi.org/10.1186/s42400-023-00199-0
View in Google Scholar
[19] R. Yang et al., "Dependable Federated Learning for IoT Intrusion Detection Against Poisoning Attacks", Computers & Security, vol. 132, art. no. 103381, 2023. DOI: https://doi.org/10.1016/j.cose.2023.103381
View in Google Scholar
[20] A. Elubeyd and D. Yiltas-Kaplan, "Hybrid Deep Learning Approach for Automatic dos DDoS Attacks Detection in Software Defined Networks", Applied Sciences, vol. 13, art. no. 3828, 2023. DOI: https://doi.org/10.3390/app13063828
View in Google Scholar
[21] M. Aswad et al., "Deep Learning in Distributed Denial of Service Attacks Detection Method for Internet of Things Networks", Journal of Intelligent Systems, vol. 32, 2023. DOI: https://doi.org/10.1515/jisys-2022-0155
View in Google Scholar
[22] H. Zhang et al., "Survey of Federated Learning in Intrusion Detection", Journal of Parallel and Distributed Computing, vol. 195, art. no. 104976, 2024. DOI: https://doi.org/10.1016/j.jpdc.2024.104976
View in Google Scholar
[23] U. Qazi, A. Almorjan, and T. Zia, "A One-dimensional Convolutional Neural Network (1D-CNN) Based Deep Learning System for Network Intrusion Detection", Applied Sciences, vol. 12, art. no. 7986, 2022. DOI: https://doi.org/10.3390/app12167986
View in Google Scholar
[24] A.A Maiga, E. Ataro, and S. Githinji, "Secured Federated Learning for DDoS Detection in Heterogeneous Telecom Cloud Networks Using Recurrent Neural Networks", International Journal of Electrical and Electronics Engineering, vol. 10, pp. 54-64, 2023. DOI: https://doi.org/10.14445/23488379/IJEEE-V10I12P106
View in Google Scholar
[25] A. Adedeji, A.M. Abu-Mahfouz, and A.M. Kurien, "DDoS Attack and Detection Methods in Internet Enabled Networks: Concept, Research Perspectives, and Challenges", Journal of Sensor and Actuator Networks, vol. 12, art. no. 51, 2023. DOI: https://doi.org/10.3390/jsan12040051
View in Google Scholar
[26] M. Elsayed et al., "DDoSnet: A Deep Learning Model for Detecting Network Attacks", 2020 IEEE 21st International Symposium on "A World of Wireless, Mobile and Multimedia Networks", Cork, Ireland, 2020. DOI: https://doi.org/10.1109/WoWMoM49955.2020.00072
View in Google Scholar
[27] M.W. Nadeem, H.G. Goh, Y. Aun, and V. Ponnusamy, "Detecting and Mitigating Botnet Attacks in Software-defined Networks Using Deep Learning Techniques", IEEE Access, vol. 11, pp. 49153-49171, 2023. DOI: https://doi.org/10.1109/ACCESS.2023.3277397
View in Google Scholar
[28] J. Mateus, G.A.L. Zodi, and A. Bagula, "Federated Learning-based Solution for DDoS Detection in SDN", 2024 International Conference on Computing, Networking and Communications (ICNC), Big Island, USA, 2024. DOI: https://doi.org/10.1109/ICNC59896.2024.10556115
View in Google Scholar
[29] S.S. Kiruthika, S. Kumar, R. Fernandes, and S. Adari, "Network Flow Based Abnormal Behavior Feature Extraction for DDoS Attack Classification Using Adaptive Federated Learning Model", Journal on Emerging trends in Modelling and Manufacturing, vol. 9, 2023. DOI: https://doi.org/10.46632/jemm/9/2/5
View in Google Scholar
[30] F. Perez Diaz et al., "A Flexible SDN-based Architecture for Identifying and Mitigating Low-rate DDoS Attacks Using Machine Learning", IEEE Access, vol. 8, pp. 155859-155872, 2020. DOI: https://doi.org/10.1109/ACCESS.2020.3019330
View in Google Scholar
[31] A. Belenguer, J.A. Pascual, and J. Navaridas, "GowFed: A Novel Federated Network Intrusion Detection System", Journal of Network and Computer Applications, vol. 217, art. no. 103653, 2023. DOI: https://doi.org/10.1016/j.jnca.2023.103653
View in Google Scholar
[32] Y.S.N. Fotse, V.K. Tchendji, and M. Velempini, "Federated Learning Based DDoS Attacks Detection in Large Scale Software Defined Network", IEEE Transactions on Computers, vol. 74, pp. 101-115, 2024. DOI: https://doi.org/10.1109/TC.2024.3474180
View in Google Scholar
[33] A. Kadam et al., "SDN-driven Security Framework for DDoS Attack Detection and Mitigation", International Journal for Science Technology and Engineering, vol. 12, pp. 620-625, 2024. DOI: https://doi.org/10.22214/ijraset.2024.65142
View in Google Scholar
[34] J. Wang, L. Wang, and R. Wang, "MFFLR-DDoS: An Encrypted LR-DDoS Attack Detection Method Based on Multi Granularity Feature Fusions in SDN", Mathematical Biosciences and Engineering, vol. 21, pp. 4187-4209, 2024. DOI: https://doi.org/10.3934/mbe.2024185
View in Google Scholar
[35] M. Nakip, B.C. Gul, and E. Gelenbe, "Decentralized Online Federated G-network Learning for Lightweight Intrusion Detection", 2023 31st International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS), Stony Brook, USA, 2023. DOI: https://doi.org/10.1109/MASCOTS59514.2023.10387644
View in Google Scholar
[36] K. Oki, Y. Ogawa, K. Ota, and M. Dong, "Evaluation of Applying Federated Learning to Distributed Intrusion Detection Systems through Explainable AI", IEEE Networking Letters, vol. 6, pp. 198-202, 2024. DOI: https://doi.org/10.1109/LNET.2024.3465516
View in Google Scholar
[37] D.C. Attota, V. Mothukuri, R.M. Parizi, and S. Pouriyeh, "An Ensemble Multi-view Federated Learning Intrusion Detection for IoT", IEEE Access, vol. 9, pp. 117734-117745, 2021. DOI: https://doi.org/10.1109/ACCESS.2021.3107337
View in Google Scholar
[38] A.A. Wabi, I. Idris, O.M. Olaniyi, and J.A. Ojeniyi, "DDoS Attack Detection in SDN: Method of Attacks, Detection Techniques, Challenges and Research Gaps", Computers & Security, vol. 139, art. no. 103652, 2023. DOI: https://doi.org/10.1016/j.cose.2023.103652
View in Google Scholar
[39] J. Ma and W. Su, "Collaborative DDoS defense for SDN-based AIoT with Autoencoder-enhanced Federated Learning", Information Fusion, vol. 117, art. no. 102820, 2024. DOI: https://doi.org/10.1016/j.inffus.2024.102820
View in Google Scholar
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Rikie Kartadie, Eko Marpanaji, Agus Maman Abadi
This work is licensed under a Creative Commons Attribution 4.0 International License.
