The proposed dataset balanced groups.

Software Defined Network (SDN) has alleviated traditional network limitations but faces a significant challenge due to the risk of Distributed Denial of Service (DDoS) attacks against an SDN controller, with current detection methods lacking evaluation on unrealistic SDN datasets and standard DDoS attacks (i.e., high-rate DDoS attack). Therefore, a realistic dataset called HLD-DDoSDN is introduced, encompassing prevalent DDoS attacks specifically aimed at an SDN controller, such as User Internet Control Message Protocol (ICMP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP). This SDN dataset also incorporates diverse levels of traffic fluctuations, representing different traffic variation rates (i.e., high and low rates) in DDoS attacks. It is qualitatively compared to existing SDN datasets and quantitatively evaluated across all eight scenarios to ensure its superiority. Furthermore, it fulfils the requirements of a benchmark dataset in terms of size, variety of attacks and scenarios, with significant features that highly contribute to detecting realistic SDN attacks. The features of HLD-DDoSDN are evaluated using a Deep Multilayer Perception (D-MLP) based detection approach. Experimental findings indicate that the employed features exhibit high performance in the detection accuracy, recall, and precision of detecting high and low-rate DDoS flooding attacks.

软件定义网络（Software Defined Network, SDN）虽有效缓解了传统网络的固有局限，但却面临一项严峻挑战：针对SDN控制器的分布式拒绝服务（Distributed Denial of Service, DDoS）攻击风险突出，而当前主流检测方法均缺乏针对贴合实际场景的SDN数据集与标准DDoS攻击（即高速率DDoS攻击）的评估工作。为此，本研究提出一款贴合实际应用场景的数据集HLD-DDoSDN，其涵盖了专门针对SDN控制器的主流DDoS攻击类型，例如互联网控制报文协议（Internet Control Message Protocol, ICMP）、传输控制协议（Transmission Control Protocol, TCP）以及用户数据报协议（User Datagram Protocol, UDP）攻击。该SDN数据集还纳入了不同层级的流量波动场景，可表征DDoS攻击中两类不同的流量变化速率（即高速率与低速率攻击）。研究人员已将其与现有公开SDN数据集开展定性对比，并在全部8种实验场景下完成定量评估，证实了该数据集的优越性。此外，该数据集在规模、攻击类型与场景多样性层面均满足基准数据集的核心要求，且包含了对真实SDN攻击检测具有显著贡献度的关键特征。研究团队采用基于深度多层感知器（Deep Multilayer Perception, D-MLP）的检测方法对HLD-DDoSDN的特征性能进行了评估。实验结果表明，所采用的特征在检测高速率与低速率DDoS泛洪攻击的准确率、召回率与精确率方面均展现出优异性能。