Tytuł:

Federated Learning for Low-rate DDoS Detection in Multi-controller Software Defined Networks: A Meta Analysis, Journal of Telecommunications and Information Technology, 2026, nr 2

Tytuł publikacji grupowej:

2026, nr 2, JTIT-artykuły

Autor:

Kartadie, Rikie ; Marpanaji, Eko ; Abadi, Agus Maman

Temat i słowa kluczowe:

federated learning ; intrusion detection systems ; low-rate distributed denial-of-service ; SDN security ; software-defined networking

Opis:

kwartalnik

Abstrakt:

Multi-controller SDN environments suffer from a blind spot when it comes to detecting low-rate DDoS attacks. Each controller sees only its own traffic slice, meaning that an LDDoS campaign looking, at every controller, like background noise is still capable of draining the network. Federated learning (FL) is a reasonable answer to this challenge, due to such controllers sharing model updates rather than raw logs. However, the published literature on FL-based detection is fragmented enough that the results have not been systematically compared up to date.We analyze 39 papers published between 2020 and 2026. 35 of those reported quantitative results, with the pooled mean detection precision equaling 98.25% (SD ±0.91) and the mean F1 score amounting to 97.98% (SD ±1.10). Federated models averaged an accuracy score of 98.33%, compared to 98.06% for centralized approaches - a 0.27 pp gap that is practically negligible. LSTM and hybrid CNN + RNN architectures ranked the highest in terms of the most metrics. Four aggregation strategies were mentioned repeatedly: weighted aggregation, asynchronous FL, personalized FL, and standard FedAvg.The widest gap we identified was in the datasets. No available benchmark simultaneously models multi-controller SDN topology, low-rate attack patterns, and heterogeneous traffic distributions across various controllers. Until that changes, high-accuracy scores on CICIDS2017 or CICDDoS2019 should be interpreted with some caution.

Tom:

104

Numer:

2

Wydawca:

National Institute of Telecommunications

Data wydania:

2026, nr 2

Typ zasobu:

artykuł

DOI:

10.26636/jtit.2026.2.2552

eISSN:

1899-8852

Źródło:

Journal of Telecommunications and Information Technology

Język:

ang

Prawa:

Biblioteka Naukowa Instytutu Łączności

Licencja:

CC BY 4.0

Właściciel praw:

Biblioteka Naukowa Instytutu Łączności