Abstract: Detecting Distributed Denial of Service (DDoS) attacks in Software Defined Networks (SDNs) is crucial for safeguarding network infrastructure from malicious disruptions. This study utilizes the CICIDS dataset to evaluate and compare various machine learning (ML) and deep learning (DL) methods for anomaly detection. The models assessed include Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM), Gated Recurrent Units (GRU), Bidirectional LSTM (BiLSTM), Convolutional Neural Networks (CNN), a CNN–BiLSTM hybrid, Support Vector Machines (SVM), Random Forest, AdaBoost, XGBoost, Decision Trees, Logistic Regression, K-Nearest Neighbors (KNN), and an ensemble Voting Classifier. Among these, the Voting Classifier produced the best outcome, reaching 93% accuracy with strong precision, recall, and F1-score. These findings highlight the enhanced accuracy offered by ensemble learning in DDoS detection in SDNs and position the Voting Classifier as a strong candidate for future developments in anomaly detection.

Keywords: Software Defined Networks (SDN), Distributed Denial of Service (DDoS), Anomaly detection, Machine learning, Ensemble learning (voting Classifier).

Downloads: | DOI: 10.17148/IARJSET.2025.12824