DDOSDN2025

The DDOSDN2025 dataset was generated using a controlled Software-Defined Networking (SDN) testbed designed to emulate a segmented enterprise network environment. The data plane comprises three logical segments: an external attacker host, a client subnet generating legitimate traffic, and a demilitarized zone hosting the victim web server. All hosts are interconnected through a single OpenFlow v1.3 switch and managed by a centralized Ryu L3 controller, enabling full control-plane visibility and flow-level monitoring.

The dataset includes both benign and malicious traffic scenarios. Normal traffic was produced by multiple client hosts transmitting TCP and UDP flows to the web server, generating sustained and diverse legitimate network activity. To represent attack conditions, high-rate volumetric Distributed Denial of Service (DDoS) traffic was subsequently launched from the attacker host toward the victim server. The attack scenarios consist of TCP-SYN flooding, UDP flooding, and ICMP flooding, which reflect commonly studied DDoS vectors in SDN security research.

All traffic traversing the SDN switch was captured at the packet level and subsequently converted into flow-level records using CICFlowMeter. This processing ensures compatibility with standardized flow-based feature extraction workflows widely adopted in SDN-based DDoS detection studies. From the original flow feature space, a compact and standardized subset of eight features was selected, resulting in the DDOSDN2025-8 dataset.

The selected features are Flow Packets per Second, Backward Inter-Arrival Time Total, Backward Packets per Second, Protocol, Packet Length Standard Deviation, Flow Duration, Packet Length Variance, and Maximum Flow Inter-Arrival Time. These features collectively capture key characteristics of traffic rate, temporal dynamics, protocol behavior, and packet size variability. By emphasizing flow intensity and timing irregularities, the feature set effectively represents volumetric and temporal anomalies associated with DDoS attacks while maintaining a lightweight representation suitable for real-time deployment in resource-constrained SDN controllers.