Object

Group publication title:

2026, nr 2, JTIT-artykuły

Description:

kwartalnik

Abstrakt:

Multi-controller SDN environments suffer from a blind spot when it comes to detecting low-rate DDoS attacks. Each controller sees only its own traffic slice, meaning that an LDDoS campaign looking, at every controller, like background noise is still capable of draining the network. Federated learning (FL) is a reasonable answer to this challenge, due to such controllers sharing model updates rather than raw logs. However, the published literature on FL-based detection is fragmented enough that the results have not been systematically compared up to date.We analyze 39 papers published between 2020 and 2026. 35 of those reported quantitative results, with the pooled mean detection precision equaling 98.25% (SD ±0.91) and the mean F1 score amounting to 97.98% (SD ±1.10). Federated models averaged an accuracy score of 98.33%, compared to 98.06% for centralized approaches - a 0.27 pp gap that is practically negligible. LSTM and hybrid CNN + RNN architectures ranked the highest in terms of the most metrics. Four aggregation strategies were mentioned repeatedly: weighted aggregation, asynchronous FL, personalized FL, and standard FedAvg.The widest gap we identified was in the datasets. No available benchmark simultaneously models multi-controller SDN topology, low-rate attack patterns, and heterogeneous traffic distributions across various controllers. Until that changes, high-accuracy scores on CICIDS2017 or CICDDoS2019 should be interpreted with some caution.

Volume:

104

Number:

2

Publisher:

National Institute of Telecommunications

Resource Identifier:

oai:bc.itl.waw.pl:2450

DOI:

10.26636/jtit.2026.2.2552

eISSN:

1899-8852

Source:

Journal of Telecommunications and Information Technology

Language:

ang

Rights Management:

Biblioteka Naukowa Instytutu Łączności

License:

CC BY 4.0

rights owner:

Biblioteka Naukowa Instytutu Łączności